Search the Community
Showing results for tags 'Find'.
-
Hello! I wanted to share my "protocol" to find any value in any application, I tried to group everything I learned from GG and people from this forum who helped me and others! If 1- doesn't work, go to 2-, etc... Each time I repeat until I find my value (sometimes they can be more than one), or nothing. I can see the value I'm searching for in memory, it is not a static value. If I dont know the value, go to 4-: 1- dword exact search if integer (1,2,3...), float exact search if not (0.1,0.5,1.8...), sometimes I do a group search of related values 2- Double exact search for integer or not (+ float exact search for integer if it fails, but I usually dont do that cause it is often time wasting) Now I think the value is encrypted or changes place each time: 3- Dword exact search "encrypted" if integer (I think a not integer value (float or double) is never encrypted this way (even if it is possible)) Now it is the same if I know the value or or not: 4- fuzzy Dword search value or float depending if it is integer value or not 5- if I know exactly how the value changes, I use advanced fuzzy search menu (more button) and I type the changes i can see to maybe waste less time, or only increased/decreased 6- fuzzy change/unchanged Now I'm sure the value always changes place, I search for a pointer: 7- Dword fuzzy search and "changed" each time the value changes, or after a loading, for certain values for example 8- Once there are just a few values, I can freeze the pointers one by one and see if the value still changes, if not, it is the good pointer Now i just follow the pointer, and look for my value, or try to change weird looking ones (it can still be encrypted) after where I land in memory. Sometimes they can be multiple pointers, so if I dont find my value I just go down in memory and follow the next pointer and repeat that. When my value is found, i look around it in memory (before or after) if I can't see something realted to (another currency...). It can be quite far sometimes, but there can still be interesting static values related. When I found what I want, I look for static values around it in memory tab and I copy as a group search with group size checked. Then I go in search tab, exact search and historic and I mark the last entry. Now I'll be able to find my value again next time :). Do you think it is good? Would you add something?