| View previous topic :: View next topic |
| Author |
Message |
zm0d
Master Cheater
 Reputation: 7
Joined: 06 Nov 2013
Posts: 423
|
 Posted: Fri Nov 22, 2013 6:19 pm Post subject: Finding symbol, class, method base address - ASLR |
 |
|
Hi again 
First, note the attached image please. The point in the red box is the interesting part.
My game, where I inject a DLL uses ASLR. I found a function in the game which contains some interesting part of code for me. But I cant "simply" do code injection, because of this god damn ASLR.
Well, how can I get the base address of this CalculateTransformMatrix?
I try it with GetProcAddress, but my result was 0...  Probably I did something wrong for the method name, because of the class prefix.
P.S.
It's my first time to deal with ASLR...
Greetz,
zm0d
| Description: |
| Take care of the red box :P |
|
| Filesize: |
8.76 KB |
| Viewed: |
9561 Time(s) |
|
|
|
| Back to top |
|
 |
justa_dude
Grandmaster Cheater
 Reputation: 23
Joined: 29 Jun 2010
Posts: 893
|
| Posted: Fri Nov 22, 2013 8:14 pm Post subject: |
|
|
| Can you find the address by using ctrl+alt+s in CE's memory viewer?
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25819
Location: The netherlands
|
| Posted: Fri Nov 22, 2013 8:31 pm Post subject: |
 |
|
make sure view->show symbols is turned off and view->show module addresses is on
that wil get you to the modulename+offset format, that you can use with the module base.
Note though, that patches will not automatically update the address like ce does when the classmethod name is used
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
zm0d
Master Cheater
Reputation: 7
Joined: 06 Nov 2013
Posts: 423
|
| Posted: Sat Nov 23, 2013 3:40 am Post subject: |
|
|
| Dark Byte wrote: |
that wil get you to the modulename+offset format, that you can use with the module base |
LOL'ed.... I could swear I tried this yesterday night, but probably I was sleeping already... this works nicely.. Thanks, mate 
| Dark Byte wrote: | Note though, that patches will not automatically update the address like ce does when the classmethod name is used
|
At least that I already knew
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
