PDA

View Full Version : Sig Search help



copymark
04-27-2010, 04:19 PM
This is WeaponIDtoAlias:



241E0B00 /$ 8B4424 04 MOV EAX,DWORD PTR SS:[ESP+4]
241E0B04 |. 83F8 22 CMP EAX,22
241E0B07 |. 7D 0C JGE SHORT client.241E0B15
241E0B09 |. 85C0 TEST EAX,EAX
241E0B0B |. 7C 08 JL SHORT client.241E0B15
241E0B0D |. 8B0485 E0DC3924 MOV EAX,DWORD PTR DS:[EAX*4+2439DCE0]
241E0B14 |. C3 RETN
241E0B15 |> 33C0 XOR EAX,EAX
241E0B17 \. C3 RETN


ok, i need 0x2439DCE0! :redface:

so i thought i will make a sig from 0x241E0B0D and add 0x03:


DWORD address = (DWORD)(m_pMemTools->findPattern((DWORD)GetModuleHandle("client.dll"),0x2f1000,(PBYTE)"\x8B\x04\x85\x00\x00\x00\x00\xC3\x33\xC0\xC3","xxx????xxxx")+0x03);


of course i dont get 0x2439DCE0 but 0x241e0b10

so my question is now:
How can i get 0x2439DCE0?

<i actually dont know a lot about sig scanning>

syntroniks
04-27-2010, 06:22 PM
Might need to dereference somewhere in there. Add 3 to your address and dereference.

wav
04-28-2010, 03:36 AM
dwThisPointerIsHeterosexual = dwAddress;

dwDontSupportHomoMarriage = *( PDWORD )dwThisPointerIsHeterosexual;

copymark
04-28-2010, 06:47 AM
thanks:redface:

in case somenone needs it:

credits to aVitamin, i only made the sig


m_dwAliasAddress = *(DWORD*)(m_pMemTools->findPattern((DWORD)GetModuleHandle("client.dll"),0x2f1000,(PBYTE)"\x8B\x04\x85\x00\x00\x00\x00\xC3\x33\xC0\xC3\xCC\xCC\xCC\xCC","xxx????xxxxxxxx")+0x3);


char *cWeapon::getWeaponAlias(int iWeaponID)
{
try
{
char** ppszAlias = (char**)m_dwAliasAddress;
return ppszAlias[iWeaponID];
}
catch (...)
{
return 0;
}
}