View previous topic :: View next topic |
Author |
Message |
fingersmith Newbie cheater
Reputation: 0
Joined: 05 Apr 2016 Posts: 17
|
Posted: Sat Apr 09, 2016 1:35 am Post subject: Query on "The following opcodes write to XXXXXXXX" |
|
|
Good day to all !
I have found the instruction that write to address XXXXXXXX
02521028 fstp qword ptr [ecx+ebx]
My question is : if this instruction write to address XXXXXXXX the same double value, say 123.45678 for two thousand time per second, will the count of this instruction go up by 2000?
Or will the count be incremented only by writing different value to address XXXXXXXX.
In short, I am trying to ascertain the behavior of the count of an instruction.
A) Count increase only if fstp write different value to XXXXXXXX compare to last (i.e. current) value
B) Count increase as long as fstp instruction is called and it does not depend on value written by fstp to XXXXXXXX. (same or otherwise)
Thank you for your great help!
FS
|
|
Back to top |
|
 |
Cake-san Grandmaster Cheater
Reputation: 8
Joined: 18 Dec 2014 Posts: 541 Location: Semenanjung
|
Posted: Sat Apr 09, 2016 7:17 am Post subject: |
|
|
Different address,different count.Depends on the game.
_________________
... |
|
Back to top |
|
 |
fingersmith Newbie cheater
Reputation: 0
Joined: 05 Apr 2016 Posts: 17
|
Posted: Sat Apr 09, 2016 7:21 am Post subject: |
|
|
Hi.
Should not be depend on which games. Basically I am asking about the functionality of "Opscode write to XXXXXXXX". About how the count is being considered. Upon instruction call or depend on different value being written.
Thank you
|
|
Back to top |
|
 |
Cake-san Grandmaster Cheater
Reputation: 8
Joined: 18 Dec 2014 Posts: 541 Location: Semenanjung
|
|
Back to top |
|
 |
deama1234 Master Cheater
Reputation: 3
Joined: 20 Dec 2014 Posts: 328
|
Posted: Sat Apr 09, 2016 8:09 am Post subject: |
|
|
I think he just wants to know how (for example) HP gets decreased/increased with an instruction like "mov [eax],ecx"?
Basically, somewhere up higher "ecx" gets changed; the base HP value is moved into it, then it either subtacts or adds, and then [eax] points to the base HP, so the "mov [eax],ecx" instruction overwrites the base HP.
Now, if this was executed 2k times while you just stand there, your HP wouldn't go down or up. Think of it this way, when you are hit, that damage value gets put into this variable that is checked all the time when the HP function is run (where "mov [eax],ecx" is located); so if the damage variable is 0, then 0 gets added to it; but if its -10 (you took 10 damage), then -10 gets added to your base health, get it?
Works the same with FSTP. "FSTP [ecx+ebx]" is kinda like "mov [eax+ebx],ecx".
|
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Sat Apr 09, 2016 10:03 am Post subject: |
|
|
If you are debugging the variable address, the count will go up each time that instruction executes for your address.
It doesn't matter if the value didn't change, the debugger will still trigger and increase the count by 1.
If you are debugging the instruction address, the count will go up each time that instruction executes for ANY address.
|
|
Back to top |
|
 |
fingersmith Newbie cheater
Reputation: 0
Joined: 05 Apr 2016 Posts: 17
|
Posted: Sun Apr 10, 2016 2:12 am Post subject: |
|
|
Zanzer.
Thank you. U pretty much explain it. Thanks to rest as well.
As a side note, my situation is a little complex. Multiple instructions writing to same address, 1 address being written by multiple instruction.
What more, I suspect it is java object/class with GC combing every about 20secs.
FS
|
|
Back to top |
|
 |
fingersmith Newbie cheater
Reputation: 0
Joined: 05 Apr 2016 Posts: 17
|
Posted: Mon Apr 18, 2016 10:33 am Post subject: |
|
|
I am still confound by this situation.
I found out the instruction that write to the location that I desire to change.
At the same time, I also discover that this every instruction also write to a multitude of other addresses.
What am I suppose to do? Even if I AOBscan the instruction, I can't be sure if it is writing to the address that I want. It is not the usual 1-1 mapping of address to be change and instruction performing the change.
Any advice will be appreciated !
FS
|
|
Back to top |
|
 |
ParkourPenguin I post too much
Reputation: 152
Joined: 06 Jul 2014 Posts: 4695
|
|
Back to top |
|
 |
fingersmith Newbie cheater
Reputation: 0
Joined: 05 Apr 2016 Posts: 17
|
Posted: Tue Apr 19, 2016 7:28 am Post subject: |
|
|
Thank you Mr ParkourPenguin.
I will print out the post you recommended and study the 3 methods carefully.
The road to success is tough!
FS
|
|
Back to top |
|
 |
|