Something with pointers

[Utev]

When I use "pointer search" with range and get a lot of results. Should I just start trying them one ofter another? From smallest difference to biggest?

OR

Is there easier way to find the real one? And does it really matter what pointer you use?

Here is example. How would you start finding a real pointer?

[L. Spiro]

From a purely brute-force way, I would examine each pointer and see how they behave has the HP values move around.

I would also check the locations where they point and see if there are any indications of them pointing to the starts of structures.


But a more graceful approach would be to use the new Auto-Hack feature in the teaser release.

Find what reads HP. You get a lot of code addresses.
If you find one that has, for example, MOV EAX, [ECX+1A8], then you can tell from your Found Address list that 1265A54 is the pointer you want.

If you find ones that have different offsets from the register inside the [], look for the one that is most common.
And furthermore, you may easily get lucky enough to see something like:

MOV EAX, DWORD PTR [1265A54]
MOV EAX, [EAX+1A8]

And that would be your answer right there.


L. Spiro

[Utev]

From a purely brute-force way, I would examine each pointer and see how they behave has the HP values move around.

I would also check the locations where they point and see if there are any indications of them pointing to the starts of structures.


But a more graceful approach would be to use the new Auto-Hack feature in the teaser release.

Find what reads HP. You get a lot of code addresses.
If you find one that has, for example, MOV EAX, [ECX+1A8], then you can tell from your Found Address list that 1265A54 is the pointer you want.

If you find ones that have different offsets from the register inside the [], look for the one that is most common.
And furthermore, you may easily get lucky enough to see something like:

MOV EAX, DWORD PTR [1265A54]
MOV EAX, [EAX+1A8]

And that would be your answer right there.


L. Spiro

I thought it would be 1265A54 but seems like that it isin't. It works fine for me but not for others. I also tried rest of them. Without result.

[L. Spiro]

Anyway use Auto-Hack and your problems are solved.


L. Spiro

[Utev]

Anyway use Auto-Hack and your problems are solved.


L. Spiro

Where do I find this new Auto-Hack?

[L. Spiro]

Right-click the stored address, Find What Reads/Writes/Accesses This Value.


L. Spiro

[Utev]

Right-click the stored address, Find What Reads/Writes/Accesses This Value.


L. Spiro

I downloaded newest MHS, but opinion What Reads/Writes/Accesses This Value isin't enabled?

[L. Spiro]

Did you get the Sneak Peek from the General section?


L. Spiro