Complete tutorial on how to find H1Z1 offsets
Tools needed:
Offset identifiers:
cGraphics: "FullScreenEffectID_1"
cGame: "PlayerName"
Please leave a like or rep if this tutorial helps you, this took me a good 20 minutes to make. <3
Steps [x64dbg]
1. Open H1Z1, sort the server list by lowest player account first, join a server
2. Once loaded into the game, open x64dbg [folder\x64\x64_dbg.exe]
3. Once x64dbg opens press Control+I
4. In the drop-down box for the process to attach to select H1Z1, should be at the top
5. On the middle-right of that window click "Dump", save it to your desktop as something like "H1Z1_dump.exe"
6. Close x64dbg
7. Continue on to IDA Pro steps
Steps [IDA Pro]
1. Open IDA Pro, be sure to run the 64-bit version [a shortcut is in your start menu for it if you can't find it]
2. Agree to the terms if you haven't already
3. Click new
4. Select "H1Z1_dump.exe" for the file to disassemble
5. In the much more confusing box, don't change anything, just press OK
6. IDA Pro will now load the dumped H1Z1 file, if it says "Bad declaration. See the message window for details" ignore it; press OK
7. Wait a couple seconds; your IDA Pro window should look close to this
8. Press Shift+F12 to open up the strings window, this will take about a minute to generate. Be patient.
9. Once the string window opens, search for whichever offset you want from the identifiers. I'm going to search for cGraphics, so I'll search for the string that is exactly "FullScreenEffectID_1".
10. Once you've found the exact string, double click it, this will take you over to the "IDA View-A" tab.
11. If your IDA View-A window looks similar to this, you're good so far. Otherwise, you did something wrong, you probably opened H1Z1.exe instead of the H1Z1_dump.exe that we got earlier.
12. Press Control+X to look at the cross references, it should show a couple of results on cGraphics and cGame both. Just press OK, leaving the first result selected. If it says that it can't find any cross references, wait one minute then repeat this step until it gives you some results.
13. Your IDA View-A window should now look similar to the picture below. The offset you're looking for is in the line above the blue one on the end. In this example the cGraphics offset would be 0x14292D610.
13. Rinse and repeat for the other offset you didn't do.
- IDA Pro (x64) - Search "hex rays ida pro 6 6 incl decompiler sdk" on The Pirate Bay, only one result
- x64dbg - http://sourceforge.net/projects/x64d...d?source=files
Offset identifiers:
cGraphics: "FullScreenEffectID_1"
cGame: "PlayerName"
Please leave a like or rep if this tutorial helps you, this took me a good 20 minutes to make. <3
Steps [x64dbg]
1. Open H1Z1, sort the server list by lowest player account first, join a server
2. Once loaded into the game, open x64dbg [folder\x64\x64_dbg.exe]
3. Once x64dbg opens press Control+I
4. In the drop-down box for the process to attach to select H1Z1, should be at the top
5. On the middle-right of that window click "Dump", save it to your desktop as something like "H1Z1_dump.exe"
6. Close x64dbg
7. Continue on to IDA Pro steps
Steps [IDA Pro]
1. Open IDA Pro, be sure to run the 64-bit version [a shortcut is in your start menu for it if you can't find it]
2. Agree to the terms if you haven't already
3. Click new
4. Select "H1Z1_dump.exe" for the file to disassemble
5. In the much more confusing box, don't change anything, just press OK
6. IDA Pro will now load the dumped H1Z1 file, if it says "Bad declaration. See the message window for details" ignore it; press OK
7. Wait a couple seconds; your IDA Pro window should look close to this
8. Press Shift+F12 to open up the strings window, this will take about a minute to generate. Be patient.
9. Once the string window opens, search for whichever offset you want from the identifiers. I'm going to search for cGraphics, so I'll search for the string that is exactly "FullScreenEffectID_1".
10. Once you've found the exact string, double click it, this will take you over to the "IDA View-A" tab.
11. If your IDA View-A window looks similar to this, you're good so far. Otherwise, you did something wrong, you probably opened H1Z1.exe instead of the H1Z1_dump.exe that we got earlier.
12. Press Control+X to look at the cross references, it should show a couple of results on cGraphics and cGame both. Just press OK, leaving the first result selected. If it says that it can't find any cross references, wait one minute then repeat this step until it gives you some results.
13. Your IDA View-A window should now look similar to the picture below. The offset you're looking for is in the line above the blue one on the end. In this example the cGraphics offset would be 0x14292D610.
13. Rinse and repeat for the other offset you didn't do.
Possible to post the new offsets for last nights update?
Originally Posted by phoenixcrypt
