| View previous topic :: View next topic |
| Author |
Message |
kik4444 Expert Cheater
Reputation: 0
Joined: 07 Sep 2013 Posts: 120 Location: Bulgaria
|
Posted: Fri Nov 22, 2013 4:51 am Post subject: Code dissection question |
|
|
| In the code structure dissection, is there an option to see which values in the offsets are static by removing every offset which had values that changed? In other words, it's there an option to save all the current values in the offsets and make CE remove offsets with values that changed? This would make searching for a good compare a lot easier when you're dealing with 5+ groups |
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Fri Nov 22, 2013 5:24 am Post subject: Re: Code dissection question |
|
|
| kik4444 wrote: | | In the code structure dissection, is there an option to see which values in the offsets are static by removing every offset which had values that changed? In other words, it's there an option to save all the current values in the offsets and make CE remove offsets with values that changed? This would make searching for a good compare a lot easier when you're dealing with 5+ groups |
I don't think there exists such a function, but I agree that it would be useful. Being able to detect the ones that /didn't/ change might be useful, as well. You could probably simulate the behavior with a plugin or manually copying the corresponding memory into files and running a fc /b on them. |
|
| Back to top |
|
 |
zm0d Master Cheater
Reputation: 7
Joined: 06 Nov 2013 Posts: 423
|
Posted: Fri Nov 22, 2013 5:50 am Post subject: |
|
|
One way is to use the scanner for unchanged/change value.
Just insert your specific start address and your finish address and you're good to go
Hint: You can create multiple scanner tabs in CE, so you could make one for each group This helps you to remove all addresses that change their value  |
|
| Back to top |
|
 |
kik4444 Expert Cheater
Reputation: 0
Joined: 07 Sep 2013 Posts: 120 Location: Bulgaria
|
Posted: Fri Nov 22, 2013 6:10 am Post subject: |
|
|
I actually never knew I could do that, I'll try it out when I get back home, thx  |
|
| Back to top |
|
 |
zm0d Master Cheater
Reputation: 7
Joined: 06 Nov 2013 Posts: 423
|
Posted: Fri Nov 22, 2013 7:01 am Post subject: |
|
|
Your welcome  |
|
| Back to top |
|
 |
kik4444 Expert Cheater
Reputation: 0
Joined: 07 Sep 2013 Posts: 120 Location: Bulgaria
|
Posted: Fri Nov 22, 2013 6:48 pm Post subject: |
|
|
| Hey I just got back and I'm free to try this out, but how do I start with it? I mean I don't know how to start this type of scan - from start address to finish? I mean I can probably handle myself from there but I dunno how to start. |
|
| Back to top |
|
 |
justa_dude Grandmaster Cheater
Reputation: 23
Joined: 29 Jun 2010 Posts: 893
|
Posted: Fri Nov 22, 2013 8:28 pm Post subject: |
|
|
| kik4444 wrote: | | Hey I just got back and I'm free to try this out, but how do I start with it? I mean I don't know how to start this type of scan - from start address to finish? I mean I can probably handle myself from there but I dunno how to start. |
Unknown initial value. |
|
| Back to top |
|
 |
kik4444 Expert Cheater
Reputation: 0
Joined: 07 Sep 2013 Posts: 120 Location: Bulgaria
|
Posted: Sat Nov 23, 2013 5:47 am Post subject: |
|
|
| Then what? |
|
| Back to top |
|
 |
zm0d Master Cheater
Reputation: 7
Joined: 06 Nov 2013 Posts: 423
|
Posted: Sat Nov 23, 2013 6:21 am Post subject: |
|
|
Take a look at my attached screenshot
in the Start textbox you insert your structure start address, and in the Stop textbox your insert your last structure member address (structure start address + last offset known). Then you start scanning for "Unknow initial value" if you did that you can filter out structure member that are static/not static with changed/unchanged scans. |
|
| Back to top |
|
 |
kik4444 Expert Cheater
Reputation: 0
Joined: 07 Sep 2013 Posts: 120 Location: Bulgaria
|
Posted: Sat Nov 23, 2013 6:37 am Post subject: |
|
|
| zm0d wrote: | Take a look at my attached screenshot
in the Start textbox you insert your structure start address, and in the Stop textbox your insert your last structure member address (structure start address + last offset known). Then you start scanning for "Unknow initial value" if you did that you can filter out structure member that are static/not static with changed/unchanged scans. |
Ok thx
EDIT: Just a small question: do I scan in ALL value types when doing this? Or is 4 bytes enough? |
|
| Back to top |
|
 |
|