| View previous topic :: View next topic |
| Author |
Message |
Pastah
Newbie cheater
 Reputation: 0
Joined: 11 May 2020
Posts: 19
|
 Posted: Tue May 12, 2020 12:56 pm Post subject: Hidden or unknown memory region? |
 |
|
I'm currently attached to a game but for some reason everything is showing up as ?? i.e. question marks, except in other DLLs like sound related ones. Why is this happening? How do I get it to show? See pic related
.spacer
| Description: |
|
| Filesize: |
109.56 KB |
| Viewed: |
1301 Time(s) |
|
|
|
| Back to top |
|
 |
Csimbi
I post too much
 Reputation: 97
Joined: 14 Jul 2007
Posts: 3255
|
| Posted: Tue May 12, 2020 1:58 pm Post subject: |
|
|
| Either the process it gone or the code must have been relocated.
|
|
| Back to top |
|
|
Pastah
Newbie cheater
Reputation: 0
Joined: 11 May 2020
Posts: 19
|
| Posted: Tue May 12, 2020 2:04 pm Post subject: |
|
|
| Csimbi wrote: | | Either the process it gone or the code must have been relocated. |
How would I deal with code relocating? I tried scanning for floats in the region of the main exe but I get 0 results for searching changed after 1st initial unknown value scan.
This is for a unity based game btw.
|
|
| Back to top |
|
|
OldCheatEngineUser
Whateven rank
 Reputation: 20
Joined: 01 Feb 2016
Posts: 1586
|
| Posted: Tue May 12, 2020 2:23 pm Post subject: |
|
|
| Csimbi wrote: | | Either the process it gone or the code must have been relocated. |
in addition it could be an unloaded module or instead of unloaded it can be remapped, or in rare cases it can be a sub-process that was created in suspended state and then mapped the sections to within the parent address space which can be later terminated or unmapped.
but my guess is it was an unloaded module, since its less likely to see programs to relocate pages of executable data i.e. code.
edit:
| Pastah wrote: | | This is for a unity based game btw. |
so it may not be a module either, that is the nature of bytecode in general the game loader manage this by allocating memory for the code to run and later then deallocating once done or no longer needed.
_________________
About Me;
I Use CE Since Version 1.X, And Still Learning How To Use It Well!
Jul 26, 2020
| STN wrote: | | i am a sweetheart. |
|
|
| Back to top |
|
|
Pastah
Newbie cheater
Reputation: 0
Joined: 11 May 2020
Posts: 19
|
| Posted: Tue May 12, 2020 2:31 pm Post subject: |
|
|
| OldCheatEngineUser wrote: | | Csimbi wrote: | | Either the process it gone or the code must have been relocated. |
in addition it could be an unloaded module or instead of unloaded it can be remapped, or in rare cases it can be a sub-process that was created in suspended state and then mapped the sections to within the parent address space which can be later terminated or unmapped.
but my guess is it was an unloaded module, since its less likely to see programs to relocate pages of executable data i.e. code.
edit:
| Pastah wrote: | | This is for a unity based game btw. |
so it may not be a module either, that is the nature of bytecode in general the game loader manage this by allocating memory for the code to run and later then deallocating once done or no longer needed. |
How would I be able to RE anything if this is the case?
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
