Page 1 of 1

[Help] DLLs and complex addresses?

PostPosted: Wed Dec 22, 2010 10:44 pm
by Fouf
_

Re: [Help] DLLs and complex addresses?

PostPosted: Thu Dec 23, 2010 1:34 am
by L. Spiro
First off:
viewtopic.php?f=30&t=5519
Stop using DWORD and definitely stop using 4.
Code: Select all
memcpy( (LPVOID)&Bombs, (LPCVOID)&buffer, sizeof( UINT_PTR ) ); // Bombs is in the wrong position and sizeof() should be used instead of hardcoding numbers.  NEVER HARDCODE NUMBERS.



Secondly:
[] brackets in Complex Addresses replicate the dereference (*) operator in C/C++.
Whether you are working remotely or locally (remotely using ReadProcessMemory() or locally with an injected DLL), you need to create a function called DeRef() to make things easier.

If you are working remotely:
Code: Select all
UINT_PTR DeRef( UINT_PTR _uiptrPointer ) {
     UINT_PTR uiptrRet;

     if ( !::ReadProcessMemory( hProcess, reinterpret_cast<LPVOID>(_uiptrPointer), &uiptrRet, sizeof( uiptrRet ), NULL ) ) { return 0UL; }
     return uiptrRet;
}


If you are working locally inside the target process via an injected DLL:
Code: Select all
UINT_PTR DeRef( UINT_PTR _uiptrPointer ) {
     return (*reinterpret_cast<UINT_PTR *>(_uiptrPointer));
}



With your helper function working, simply replace “[” with “DeRef( ” and “]” with “ )”.

Code: Select all
[[0x00570074+0x0]+0x0]+0x8C

becomes:
Code: Select all
DefRef( DefRef( 0x00570074+0x0 )+0x0 )+0x8C


And since this resolves to a pointer to a DWORD, your code becomes:
Code: Select all
DWORD * pdwFinal = reinterpret_cast<DWORD *>(DefRef( DefRef( 0x00570074+0x0 )+0x0 )+0x8C);
(*pdwFinal) = 90;  // Modify the value.



L. Spiro

Re: [Help] DLLs and complex addresses?

PostPosted: Thu Dec 23, 2010 4:42 am
by Fouf
_

Re: [Help] DLLs and complex addresses?

PostPosted: Thu Dec 23, 2010 4:55 am
by L. Spiro
If it only crashes while your threads are running then the answer is obvious: Close the threads before uninjecting.

Otherwise use a stable uninjector, such as the one in MHS.

If you are sure the injector is working, undo modifications to the game code that you may have made.


L. Spiro