| View previous topic :: View next topic |
| Author |
Message |
Jeffrey_ Expert Cheater
Reputation: 1
Joined: 10 Jun 2011 Posts: 164
|
Posted: Sat Jul 25, 2015 12:57 pm Post subject: Comparing a value stored in a pointer for Code Injection |
|
|
I'm having trouble trying to make a code injection to prevent certain items from decreasing, after dissecting the data structure I found the id for an item but it is stored in a pointer at offset 0C
This is the injection I've started with
| Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
newmem:
originalcode:
sub [ecx+08],eax
mov esi,eax
exit:
jmp returnhere
"TESV.exe"+7F89F:
jmp newmem
returnhere:
[DISABLE]
dealloc(newmem)
"TESV.exe"+7F89F:
sub [ecx+08],eax
mov esi,eax
//Alt: db 29 41 08 8B F0 |
How would I manage to use it to uniquely identify an item in this case?
|
|
| Back to top |
|
 |
Rydian Grandmaster Cheater Supreme
Reputation: 31
Joined: 17 Sep 2012 Posts: 1358
|
Posted: Sat Jul 25, 2015 5:52 pm Post subject: |
|
|
Well the first thing to do is figure out which offset is the item's ID, which you'll have to do by memory watching and testing, or maybe there's some technical info out there on item structures for the game that might include the offset or at least the order of data for items?
Then the code to use depends on what type of value the ID or whatever is (byte, 2 byte, 4 byte, float, etc.) and what you want to do (sub only it, or sub all but it, stuff like that).
_________________
|
|
| Back to top |
|
 |
Jeffrey_ Expert Cheater
Reputation: 1
Joined: 10 Jun 2011 Posts: 164
|
Posted: Sat Jul 25, 2015 6:18 pm Post subject: |
|
|
It's more or less that Every item in the game has their ID's stored in the base address (in this case it's a pointer) and every ID is stored at Offset 0C within the pointer.
If you look at the screenshot in the highlighted row in the structure is that I was using two different items (and I know their ID's already) to see if I could find where they are stored. Both of their ID's are and As you can see they are stored at the same offset within the pointer.
What would I need to add to the code injection to make sure only these items are modified?
|
|
| Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Sat Jul 25, 2015 7:15 pm Post subject: |
|
|
| Code: | [ENABLE]
alloc(newmem,2048)
label(returnhere)
label(originalcode)
label(exit)
label(ignore)
newmem:
cmp [ecx+C],F
je ignore
cmp [ecx+C],3133B
je ignore
jmp originalcode
ignore:
xor eax,eax
originalcode:
sub [ecx+08],eax
mov esi,eax
exit:
jmp returnhere
"TESV.exe"+7F89F:
jmp newmem
returnhere:
[DISABLE]
dealloc(newmem)
"TESV.exe"+7F89F:
sub [ecx+08],eax
mov esi,eax
//Alt: db 29 41 08 8B F0 |
|
|
| Back to top |
|
 |
Jeffrey_ Expert Cheater
Reputation: 1
Joined: 10 Jun 2011 Posts: 164
|
Posted: Sat Jul 25, 2015 8:01 pm Post subject: |
|
|
I'm afraid that doesn't work, however carrying on with looking at the structure using the new addresses the the pointer was pointing to
The ID's are stored in a different structure than the structure that contains the data for the item amount. Where should I continue from here? any clues on how I could implement this into my current injection template?
|
|
| Back to top |
|
 |
panraven Grandmaster Cheater
Reputation: 62
Joined: 01 Oct 2008 Posts: 958
|
|
| Back to top |
|
 |
|