Aquatic
May 14th, 2004, 00:46
Bear with me...
Say you wanted to always resolve the location for '# of lives' in your game.
You could do a function:
'Location held by static pointer' +/- distance to lives value.
Now this works because even though the locations of values are dynamically allocated at runtime, the relative distance between them remains the same. So whatever the distance between 'location held by static pointer' and your value is in one instance of live memory, that distance will be the same at the next runtime.
This does not work in dynamic pointers of course, because the location held by a dynamic pointer will change at each runtime. i.e (esi+4) (There is usually a register involved with dynamic pointers).
The beauty of static pointers is that you can use any one, you just need to add the distance between the location it holds and your value. Then if you wanted to resolve a second value, you can just use that same static pointer.
The problem is, how do you locate a static pointer's location in memory? 99% of values that you BP on in memory will be generated by dynamic pointers which are useless.
Static pointers are the only true non-dynamic part of live memory. (The only thing that has a predictable location.)
QUOTE:
http://216.239.53.104/search?q=cache:wPZuqcARiUAJ:www.mpcheatz.de/mpc/forum/showthread/t-35738.html+%22static+pointer%22+trainer&hl=en
You guys understand what I am talking about now?
(Isn't there always at least one 'Global Static Base Pointer'?)
So, what is a quick way to locate these static pointers?
Say you wanted to always resolve the location for '# of lives' in your game.
You could do a function:
'Location held by static pointer' +/- distance to lives value.
Now this works because even though the locations of values are dynamically allocated at runtime, the relative distance between them remains the same. So whatever the distance between 'location held by static pointer' and your value is in one instance of live memory, that distance will be the same at the next runtime.
This does not work in dynamic pointers of course, because the location held by a dynamic pointer will change at each runtime. i.e (esi+4) (There is usually a register involved with dynamic pointers).
The beauty of static pointers is that you can use any one, you just need to add the distance between the location it holds and your value. Then if you wanted to resolve a second value, you can just use that same static pointer.
The problem is, how do you locate a static pointer's location in memory? 99% of values that you BP on in memory will be generated by dynamic pointers which are useless.
Static pointers are the only true non-dynamic part of live memory. (The only thing that has a predictable location.)
QUOTE:
Quote:
if you find the correct STATIC BASE POINTER, it's location never changes. the STATIC BASE POINTER (SBP) holds the address for the DYNAMIC BASE POINTER (DBP) which does change at run time. so, the SBP holds the hex in four bytes which points to the DBP which is the base pointer for the addresses in the code. for instance a line in the code might be MOV EAX, (EBP+0x09). if you did a breakpoint on an address (let's say the address which holds the field of view (zoom) is 4E5170A) and the code keeps showing code which references (EBP+0x09) then you know that you take the address which holds the zoom (4E5170A) and subtract the 0x09 from it which will give you the EBP address (4E51701) which would be the same as the DBP above. convert the address 4E51701 to decimal (let's just say that it is 21764521, although i don't have a converter handy). then you clear tsearch and then do a new search looking for a type LONG and value 21764521. this will show you the address which is the SBP which never changes. sometimes you will get several addresses that point to the DBP when you do that search. you have to look at them and sometimes test with different maps or different numbers of players in COOP or whatever and see which one really points to the actual address you are looking for. after you know the SBP, then you work backwords. from within your trainer you: 1 do a LONG read of memory at the SBP address which will give you the DBP 2 add the offset that is in the code back (which in this case is 0x09) 3 this is the dynamic address holding the field of view. poke to it and: 4 change the field of view (poke using FLOAT, which is also four bytes) hope this helps- |
http://216.239.53.104/search?q=cache:wPZuqcARiUAJ:www.mpcheatz.de/mpc/forum/showthread/t-35738.html+%22static+pointer%22+trainer&hl=en
You guys understand what I am talking about now?
(Isn't there always at least one 'Global Static Base Pointer'?)
So, what is a quick way to locate these static pointers?