Problem with locating and patching address at a dynamically allocated memory

Hello guys, I'm playing with Quake3Demo using an injected DLL. I've found out the address I want to patch for the infinite ammunition hack. The problem is that the asm instruction is located at a dynamically allocated memory inside the quake3.exe process. This region of memory is created only after the user starts a match (by pressing the Fight button). The address of this region may be different in every game execution. When I pass the base address of quake3 for the FindPattern(), the function never locates it for obvious reasons.

My DLL is very simple: in DllMain() it retrieves the baseaddr and its size and then creates a thread where it will try to find the existence of that asm instruction using FindPattern().

What can I do to solve this trouble?

Learn about pointers?

Originally Posted by Hitokiri~

Learn about pointers?

I already know about C++ pointers.

Originally Posted by DeathPum

I already know about C++ pointers.

Then apply them to the game you're trying to mod.

The address has to be in some kind of V-Table so yeah, try to find that.
However check your function to find the pattern as you may lack of a proper mask.

Op, if I understood right... your problem is the addressing changing every time, is that right? Did you got an offset of it? Baseaddr+offset.

Like game.exe+deadbeef, that address is different on every execution, as the basemodule addr from game.exe changes (ASLR).
But what game.exe+deadbeef points doesn't change :} .. At least if it isn't at heap from conditional flow execution, like a pointer stored on a dynamic allocated var, where alloc/dealloc isn't always deterministic.

On this scenario you may have difference between executions, even using offsets.

Easy instructions with CE. Basis is breaking when the static address is written to, then finding the pointer to that address.

Add the address in CE normally.
Right click on the entry and select Find what writes to this address.
Attach the debugger.
Wait until you find an OPcode that writes to this address.
Select it and click "more information"
CE will give you a guess as to where the pointer is (usually the value stored in the EDI register).
The pointer you just discovered should have a static address (app.exe + offset). If not try this again with the pointer, go deeper, inception shit.
So reading the memory located at Application.exe + (Application.exe + offset) will give you the dynamic memory reading you are looking for.

Problem with locating and patching address at a dynamically allocated memory

Post a Reply

Similar Threads

Tags for this Thread