Posted: Thu Nov 21, 2024 9:04 am Post subject: Getting pointer offset from another pointer
Hi all,
I am trying to calculate the path of a pointer using memory pointed by another pointer, something like this
[[xxx.DLL+123abc]+[[xxx.DLL+123abc]+456*4]*4]+4
I could not find related info and I will really appreciate if anyone can provide some help.
If the offset's type is an 8-byte integer, that should work fine. If it's not, explicitly specify the type by putting one of the following tokens in parenthesis before the dereference:
BYTE - 1-byte unsigned
CHAR - 1-byte signed
WORD - 2-byte unsigned
SHORT - 2-byte signed
DWORD - 4-byte unsigned
LONG - 4-byte signed
QWORD / UINT64 - 8-byte unsigned
LONGLONG / INT64 - 8-byte signed
e.g. 4-byte signed value:
Code:
local address = getAddress'[[xxx.DLL+123abc]+(LONG)[[xxx.DLL+123abc]+456*4]*4]+4'
print(('%08X'):format(address))
If you want to add an address to the address list, you can specify the offset like that too:
Regarding the address list, it seems offsets are truncated to 4-byte signed integers before they're added to the pointer node. This differs from the symbol handler. _________________
I don't know where I'm going, but I'll figure it out when I get there.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum