| View previous topic :: View next topic |
| Author |
Message |
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
|
| Back to top |
|
 |
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
 Posted: Fri Nov 01, 2013 12:04 am Post subject: |
 |
|
Ok, I decided to go ahead and fix the bug myself. Basically there were 2 array overflow issues in TScanner.nextnextscanmembinary:
1-j could go past maxindex.
2-maxindex was 1 byte too big.
All in all I suggest the following fix: | Code: | TScanner.nextnextscanmembinary
...
begin
i:=0;
//maxindex:=chunksize;
maxindex:=chunksize-1; //ex: if you have 1 byte chunk, max index should be 0.
vsize:=variablesize;
alist:=addresslist;
currentbase:=0;
phandle:=processhandle;
while i<maxindex do
begin
j:=i+1;
currentbase:=alist[i].address and qword($FFFFFFFFFFFFF000);
//while j<=maxindex do //if j=maxindex and the if below is true, then j becomes maxindex+1.
while j<maxindex do
begin
if (currentbase)=(qword(alist[j].address+vsize-1) and qword($fffffffffffff000)) then
inc(j)
else
begin
dec(j);
break;
end;
end; |
Obviously that doesn't fix the problem for scans with the byte datatype, I'll look at it later but in the meantime the exact scenario is:
1-open config0.dat in ce x64, scan for a byte an unknown initial value.
2-open config1.dat, filter with unchanged value.
3-filter again with unchanged value -> crash.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25830
Location: The netherlands
|
| Posted: Fri Nov 01, 2013 4:43 am Post subject: |
|
|
Thanks, i hadn't had time to look into it yet (i did look over the file access when making the big endian file scanner but didn't see anything wrong there)
actually, it's a little bit more complex
it's fixed in the svn now
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Fri Nov 01, 2013 11:24 am Post subject: |
|
|
Got up in the middle of the night thinking "Oh Sh*** what if found=1 -> chunksize=1 -> maxindex=0 -> no while looping ?!"... Well looks like you found it first, sorry for screwing up.
Anyway, doing some tests around this bug I created a file that contains db 01,01, and guess what, if I scan for "1", type binary, CE will only find one result. After some investigation it boils down to variablesize being = 2 because getBytecountBinaryString (from memscan.pas) thinks that "1" takes 2 bytes, so you'd need a special handler incase result mod 8=1 (since 9 bits always take 2 bytes).
...But that'd only partly solve the problem, since I could redo my experiment with a file containing db 03,03 and scanning for "11". There the problem is that the scanning loop in TScanner.FirstScanmem/TScanner.FirstNextScanmem should be stopped at N bits from the end instead of a given number of bytes when scanning for binary strings.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
|
Dark Byte
Site Admin
Reputation: 471
Joined: 09 May 2003
Posts: 25830
Location: The netherlands
|
| Posted: Fri Nov 01, 2013 2:56 pm Post subject: |
|
|
check the svn. there was one more situation where next scan would bork out
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
Gniarf
Grandmaster Cheater Supreme
![]() Reputation: 43
Joined: 12 Mar 2012
Posts: 1285
|
| Posted: Fri Nov 01, 2013 4:05 pm Post subject: |
|
|
About the fix in getBytecountBinaryString, if you do it that way you get result=2+N for a 8*N+1 bit string (except when N=0) which gives 3 bytes for 9 bits. Correct me if I'm wrong but such string can only spread over 1+N bytes. So i'd go for:
| Code: | if (result mod 8<2) then //8*N bits spread over up to N+1 bytes
result:=1+result div 8 //8*N+1 always spread over N+1 bytes
else
result:=2+(result div 8);//8*N+(2 to 7) spread over up to N+2 bytes |
-------------------------------------
Just a some random bit of code I felt like dumping there, doesn't add or fix anything but looks cleaner to me: | Code: | j:=i;
//finds the last alist element that is entierely on the same page as alist[i]
while (j<maxindex) and ( (currentbase)=(qword(alist[j+1].address+vsize-1) and qword($fffffffffffff000)) ) do
begin
inc(j)
end; |
EDIT: apparently the x64 crash seems to have gone away with r2198.
_________________
DO NOT PM me if you want help on making/fixing/using a hack. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
.
