HelpSignature Scanning Problem

Posts 1–11 of 11 · Page 1 of 1
Signature Scanning Problem
I am having a problem with my sig scanning...
 
Sig Scanning Class
Code:
#pragma once
#include <Windows.h>
#include <string>

// This is not my dwFindPattern, credits @learn_more for creating this sexy beast
#define INRANGE(x, a, b)    (x >= a && x <= b)
#define getBits( x )    (INRANGE((x&(~0x20)),'A','F') ? ((x&(~0x20)) - 'A' + 0xa) : (INRANGE(x,'0','9') ? x - '0' : 0))
#define getByte( x )    (getBits(x[0]) << 4 | getBits(x[1]))

class CFindPatternEx {
private:
	HANDLE hModule;
	PBYTE Buffer;

	DWORD dwFindPattern(DWORD dwAddress, DWORD dwLength, const char* szPattern)
	{
		const char* pat = szPattern;
		DWORD firstMatch = NULL;
		for (DWORD pCur = dwAddress; pCur < dwLength; pCur++)
		{
			if (!*pat) return firstMatch;
			if (*(PBYTE)pat == '\?' || *(BYTE*)pCur == getByte(pat)) {
				if (!firstMatch) firstMatch = pCur;
				if (!pat[2]) return firstMatch;
				if (*(PWORD)pat == '\?\?' || *(PBYTE)pat != '\?') pat += 3;
				else pat += 2;
			}
			else {
				pat = szPattern;
				firstMatch = 0;
			}
		}
		return NULL;
	}

	DWORD FindPatternSimplified(DWORD dwAddress, DWORD dwLength, const char* szPattern, DWORD Offset) {
		DWORD result = dwFindPattern(dwAddress, dwAddress + dwLength, szPattern);
		PBYTE bresult = (PBYTE)result;
		bresult += Offset;
		if (bresult)
			return *(DWORD*)bresult;
		else
			return 0;
	}
public:
	CFindPatternEx(std::string ModulePath) {
		hModule = CreateFileA(ModulePath.c_str(), GENERIC_READ, // open for reading
			0, // do not share
			NULL, // default security
			OPEN_EXISTING, // existing file only
			FILE_ATTRIBUTE_NORMAL, // normal file
			NULL);


		if (hModule == INVALID_HANDLE_VALUE)
			printf("Failed to open a handle to the dll Error %d\n", GetLastError());


		Buffer = (PBYTE)VirtualAlloc(NULL, GetFileSize(hModule, NULL), MEM_COMMIT, PAGE_EXECUTE_READWRITE);

		if (!Buffer)
			printf("Could not Allocate %d bytes of memory\n", GetFileSize(hModule, NULL));
		else
			printf("Successfully allocated %d bytes of memory\n", GetFileSize(hModule, NULL));

		DWORD dwBytesRead;
		if (ReadFile(hModule, Buffer, GetFileSize(hModule, NULL), &dwBytesRead, NULL))
			printf("Read file, bytes read : %d\n", dwBytesRead);
		else
			printf("Failed to read file Error %d\n", GetLastError());
	}

	~CFindPatternEx() {
		printf("Deconstructor called, cleaning up..\n");
		CloseHandle(hModule);
		VirtualFree(Buffer, NULL, MEM_RELEASE);
	}

	DWORD FindPatternEx(std::string szPattern, DWORD Offset) {
		return FindPatternSimplified((DWORD)Buffer, GetFileSize(hModule, NULL), szPattern.c_str(), Offset);
	}
};


I am using the class above (probably bad, just want to see how it works before i re-write it) and for testing i am finding 2 offsets
Code:
printf("m_flFlashMaxAlpha : 0x%0x\n", FindPatternClient->FindPatternEx("0F 2F F2 0F 87 ? ? ? ? F3 0F 10 A1 ? ? ? ? 0F 2F CC 0F 83", 13));
printf("m_dwClientState:  : 0x%0x\n", FindPatternEngine->FindPatternEx("A1 ? ? ? ? F3 0F 11 80 ? ? ? ? D9 46 04 D9 05", 0));
for the m_flFlashMaxAlpha it is returning correctly
Code:
m_flFlashMaxAlpha : 0xa2f4
but I used Zat's tutorial on how to find a sig on UC (I read the sticky one here too) but that is returning
Code:
m_dwClientState:  : 0x5bb2c4a1
which has the extera a1 at the end which i dont need.

Could someone tell me why this is happening? I would like to make my cheat 100% pattern scan so I dont have to update the offsets all the time and this is giving me a little trouble.

Thanks in advance
Bump //2Short
Wasser dumped some patterns on UC and this is what his ClientState was:
Code:
\xCC\xA1\x00\x00\x00\x00\x8D 
add 1
xx????x
And remember to - engine.dll to get the offset.
Quote Originally Posted by ActualCheats View Post
Wasser dumped some patterns on UC and this is what his ClientState was:
Code:
\xCC\xA1\x00\x00\x00\x00\x8D 
add 1
xx????x
And remember to - engine.dll to get the offset.
That's not the problem I'm having... My signatures are returning the correct offset but they have random numbers/letters before and after them
Quote Originally Posted by ImWhacky View Post
That's not the problem I'm having... My signatures are returning the correct offset but they have random numbers/letters before and after them
Oh fuck, I should read the whole post.
Quote Originally Posted by ActualCheats View Post
Oh fuck, I should read the whole post.
Lol, it's aight didn't know wasser gave some signs tho thanks
Quote Originally Posted by ImWhacky View Post
Lol, it's aight didn't know wasser gave some signs tho thanks
It was in a thread on UC when they started XORing shit.
Still need help! Bump
Quote Originally Posted by ImWhacky View Post
Still need help! Bump
It's not adding a random hex value, it's just that you're not removing the image base. The reason that m_flFlashMaxAlpha is working is because you're reading the offset stored in a netvar. The m_dwClientState is an address leading to a clientstate class instance, and it will point to it's value in CSGO.exe, not in engine.dll, therefore you need to do what the guy above said. You need to subtract the adress you recieved from the pattern scan with the engine.dll's module.

You can get that value from MODULEENTRY32.hModule.
Quote Originally Posted by gtaplayer2 View Post
It's not adding a random hex value, it's just that you're not removing the image base. The reason that m_flFlashMaxAlpha is working is because you're reading the offset stored in a netvar. The m_dwClientState is an address leading to a clientstate class instance, and it will point to it's value in CSGO.exe, not in engine.dll, therefore you need to do what the guy above said. You need to subtract the adress you recieved from the pattern scan with the engine.dll's module.

You can get that value from MODULEENTRY32.hModule.
Thanks got it working
Been over a week since last update/bump after answers, assuming solved.

/Closed.
Posts 1–11 of 11 · Page 1 of 1
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Talk with us