View previous topic :: View next topic |
Author |
Message |
jvook Newbie cheater
Reputation: 0
Joined: 17 May 2016 Posts: 19
|
Posted: Wed May 18, 2016 7:09 pm Post subject: AOBScan not working as I expect |
|
|
I found a search string with AOB scan that gives me the result I want. I know it works because if I scan with Array of Bytes it finds the address I need. But when I execute the script it finds a really early address in memory (something like 00B80000). This address doesn't show up in the array of bytes scan, and when I browse it in the memory browser, it is just all ?????? everywhere so I have no idea why it's getting picked up in the scan.
Here is the script I'm using, can someone help?
Code: | [ENABLE]
aobscan(keygreen, 6B 00 65 00 79 00 5F 00 62 00 6F 00 6E 00 65 00 73)
label(_keygreen)
registersymbol(_keygreen)
keygreen:
_keygreen:
[DISABLE]
unregistersymbol(_keygreen) |
|
|
Back to top |
|
 |
Zanzer I post too much
Reputation: 126
Joined: 09 Jun 2013 Posts: 3278
|
Posted: Wed May 18, 2016 7:12 pm Post subject: |
|
|
aobscan() searches all memory, not just writable.
Change the Writable checkox to Scan all memory if you want to see those results in the manual scan.
By the way, you don't need a separate label in your code.
Code: | [ENABLE]
aobscan(_keygreen, 6B 00 65 00 79 00 5F 00 62 00 6F 00 6E 00 65 00 73)
registersymbol(_keygreen)
[DISABLE]
unregistersymbol(_keygreen) |
|
|
Back to top |
|
 |
jvook Newbie cheater
Reputation: 0
Joined: 17 May 2016 Posts: 19
|
Posted: Wed May 18, 2016 7:27 pm Post subject: |
|
|
Thanks for your help. I tried it in with all-memory settings and it still doesn't find the aobscan result. Here is a pic of the memory region aobscan is finding -- it seems to be not only unwritable but unreadable? Why are all these question marks here?
Is there any arguments to aobscan I can set to ignore this region or something?
Why is it finding a result here?
s32.postimg.org/lqe7fx5qd/Untitled.png
|
|
Back to top |
|
 |
Dark Byte Site Admin
Reputation: 470
Joined: 09 May 2003 Posts: 25788 Location: The netherlands
|
Posted: Wed May 18, 2016 7:36 pm Post subject: |
|
|
It's not a pointer, but an address
just give it as address _keygreen+_0 , not a pointer
to explain pointers: 6B 00 65 00 = 0065006b . your AOB will always find that, since that is exactly what you are looking for.
Therefore, what you're doing is not a pointer, but data
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
Back to top |
|
 |
jvook Newbie cheater
Reputation: 0
Joined: 17 May 2016 Posts: 19
|
Posted: Wed May 18, 2016 7:40 pm Post subject: |
|
|
Thanks a lot it works now
|
|
Back to top |
|
 |
|