Im pretty new here so dont be too rude to me ;D joke :P
Im just wondering about one thing, some people here might know that you can create patterns out of static adresses by olly or ida plugins,
so Im wondering how this works in dept :)
here an examble what I mean:
Code: Select all
bool Compare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
if(*szMask=='x' && *pData!=*bMask) return 0;
return (*szMask) == NULL;
}
DWORD Pattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i<dwLen; i++)
if (Compare((BYTE*)(dwAddress+i),bMask,szMask)) return (DWORD)(dwAddress+i);
return 0;
}
bool Status = false;
void foo ()
{
Status = Pattern((DWORD)GetModuleHandleA("moudule.dll"), 0x97D000, (PBYTE)"\x71\x37\x50\x94\x71\x37", "xxxxxx");
}( "libXY.dll + 0x12345" into -> "\x71\x37\x50\x94\x71\x37 && xxxxxx" )
Just as a little remark for people who never worked with patterns,
they are used to find adresses again pretty fast after e.g. an game update..
I think no-one here would like to search adresses and offsets again after some anoying patches ;D
And my personal optinion about this is that they are pretty usefull even when they are made with plugins ..
but as I said, I want to know how the creation works and for me its not handy to open all the time e.g. olly
after found an Adress in CheatEngine to make them to patterns ... I would prefer a small tool where you
just c/p the module.dll + adress and it prints it or saves it into a log file :P ... Thats what Im trying to do :D
,greetings GAFO
