Hey, how are you?
I'm trying to update my norecoil after a recent patch, but I'm not sure if I'm handling the new offset correctly.
Background:
Previously, I used the address (base + offsetClient) as a pointer to a struct, like this:
Code:
DWORD_PTR baseAddr = NULL;
const uintptr_t offsetClient = 0x3298DF0; ///44 88 3D ? ? ? ? 44 89 3D ? ? ? ? 4C 89 3D ? ? ? ? 44 88 3D ? ? ? ? 4C 89 3D ? ? ? ? for the struct
const uintptr_t offsetRecoil1 = 0x668; // C7 83 ? ? ? ? ? ? ? ? C7 83 ? ? ? ? ? ? ? ? FF 90 ? ? ? ? F3 0F 10 93 ? ? ? ? 0F 57 F6 0F 2F F2
const uintptr_t offsetRecoil3 = 0x0EF8;
void applyRecoil(void)
{
DWORD64 clientAddr = *(DWORD64*)(baseAddr + offsetClient);
if (clientAddr != NULL)
{
*(DWORD64*)(clientAddr + offsetRecoil1) = (DWORD64)-1;
*(DWORD64*)(clientAddr + offsetRecoil3) = (DWORD64)0;
}
}
But now, after the update, in IDA I see that byte_13298DF0 is just a byte, not a pointer or struct, and I'm not sure if it's just a flag or if the structure/pointer has moved.
My question:
Should I still treat this offset as a pointer to a struct (read the pointer at (base + offset), then use sub-offsets)?
Or is it now just a simple flag/byte, so I should write to it directly (like *(BYTE*)(base + offset) = 1?
I already tried to handle it like before (as a pointer), but it’s not working and I'm getting crash/report errors.
Could you please take a look and let me know the correct way to access/manipulate this address after the update? If you need a screenshot or a dump, I can send it.
Thanks a lot!