| View previous topic :: View next topic |
| Author |
Message |
vmv
Cheater
![]() Reputation: 0
Joined: 29 Jun 2013
Posts: 32
|
 Posted: Fri Nov 22, 2013 11:14 am Post subject: Start address |
 |
|
Can anyone tell me where this function ends..or start/ends, i need to insert a codecave and it gives me crashes all the time ...
[url] [/url]
Thank you,
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25819
Location: The netherlands
|
| Posted: Fri Nov 22, 2013 11:19 am Post subject: |
|
|
rightclick and choose "select current function". It will then try to guess where it starts.
Else see if you can find the start manually. Usually a rbp save, or decrease of ESP by a specific value.
Also, in 64-bit functions tend to be 16 byte aligned (last digit of the address is 0)
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
vmv
Cheater
![]() Reputation: 0
Joined: 29 Jun 2013
Posts: 32
|
| Posted: Fri Nov 22, 2013 11:40 am Post subject: |
|
|
With "select current function" it's extremely huge... can't be 
Where should i insert the jump...dunno if i say it correctly.
What rbp save you mean ?
|
|
| Back to top |
|
|
justa_dude
Grandmaster Cheater
 Reputation: 23
Joined: 29 Jun 2010
Posts: 893
|
| Posted: Fri Nov 22, 2013 7:54 pm Post subject: |
|
|
| vmv wrote: | | With "select current function" it's extremely huge... can't be |
It's hard to know what you consider huge. But, it's possible (I guess, I didn't really study your screenshot closely) that the target is utilizing a scripting engine or emulator or something and what you're seeing isn't something that can divide cleanly into functions. It's even possible (though this would probably show up as rotten disassembly) that you're trying to disassemble data instead of code.
| vmv wrote: | | What rbp save you mean ? |
In most languages on stack computers, you push the return address onto the stack when you call a new function and adjust ebp to point to the new stack frame. It isn't by any means necessary, but it is handy when debugging because you can work backwards to map out a call stack. See this page for a most excellent description of the process.
edit, two minutes later... corrected link to point to correct page, oops.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
