Search by previous values

[EnMan]

I don't know in advance which values in memory are current. But I have a guess that they have already been formed. I know the previous value. (This is a pair of values on two dice from 1 to 6). Can I somehow find these values before they are formed? I wanted save values before change then filter it.

[kiynox]

[ @EnMan ]
---

Quote

which values in memory are current

1. Values are passed to registers, you can see-it using: RegView. Do note that this tool is only for Armeabi-v7a architecture, which is Arm 32-bit and can't be any others. You can either check your game libs on "/data/data/your_app_name/lib" folder.
2. You can also use debugger: Frida or GDB and set some breakpoint to see current register value.

---

Quote

I know the previous value

If you know the previous value, why don't just find the address that causing the value to change? (You can find it using Pointer search)
---

Edited January 4 by kiynox

[Wembbu]

On 12/27/2023 at 1:59 PM, EnMan said:

I don't know in advance which values in memory are current. But I have a guess that they have already been formed. I know the previous value. (This is a pair of values on two dice from 1 to 6). Can I somehow find these values before they are formed? I wanted save values before change then filter it.

Pretty sure what you want to do is find an address where a specific value is going to appear.

I'm pretty sure you can't do exactly that, but what you can can do is use a debugger (lldb or gdb) to break the instruction and see when and where exactly it writes a value of a specific register.