Looking for any to teach me how to find a specific pointer using classname

[xhenor]

ive already dumped a il2cpp file and know how to use gg but a problem has been buggering me it seems that u need to find a specific pointer to edit the value or know the value of an offset can anyone teach me how to find a pointer using a class name 

[Platonic]

On 3/12/2022 at 1:58 PM, xhenor said:

ive already dumped a il2cpp file and know how to use gg but a problem has been buggering me it seems that u need to find a specific pointer to edit the value or know the value of an offset can anyone teach me how to find a pointer using a class name 

you search the class name with GG in the region of which the metadata is located. pointer search the address that holds the first char of the string in region Ca or A. Then do offset calculation. Go to the address of the value. You could get more then one result. two or three but you can quickly review each of them. The pointer you need is always few addresses below current address. can't give you an accurate offset because it could differ depending which structure is used. but commonly it looks like this:

[Platonic]

4 minutes ago, Platonic said:

 but commonly it looks like this:

 

[Platonic]

You search for example this class name

The first char capital "C" or "67" pointer search its address in the corresponding region, could be A or Ca even other. Depends on the instruction set your device supports.

You could get more then one result. Check each one manually by going to the address of it.

In this case i checked the first result.

And we are back at the same screenshot as the first post. But this is just one structure. There are many different structures. But now that purple pointer you can use for find fields of that class. Select it and do pointer search in Region A. Best is to do it when your in lobby or in a match.

From there on out you can save the results and do the same field offset calculations as you have in your class shown in the dump.cs

 

[Platonic]

But the logic is the same. Pointer of class is always below class name. Not sure if i should say below or above. based on how instructions are fetched and decoded this kind of is confusing for have right term. I think in this case "above" is correct.