Jump to content
  • 0

Why the same function with different values ​​does not work on 32 bit systems


Question

Posted

function isProcess64Bit()

    -- Function -> by CmP: https://gameguardian.net/forum/topic/36604-how-to-get-instruction-set-architecture-on-emulator-virtual-memory-addresses/?do=findComment&comment=135506

    local regions = gg.getRangesList()

    local lastAddress = regions[#regions]["end"]

    return (lastAddress >> 32) ~= 0

  end

  local ISA = isProcess64Bit()

 

  function offsetExe()

    if ISA == false then

      offset_cdExe = 0x04

      offset_AnonToPtrVal = 0x7C

      offset_PtrToVal = 0xA0

      offset_toJump = 0x50

      offset_ToPointer = 0x30

      dataType = gg.TYPE_DWORD

    elseif ISA == true then

      offset_cdExe = 0x08

      offset_AnonToPtrVal = 0xE8

      offset_PtrToVal = 0x118

      offset_toJump = 0x88

      offset_ToPointer = 0x18

      dataType = gg.TYPE_QWORD

    end

  end

  offsetExe()

 

  function dec2hex(dec)

    local hex = string.gsub(dec, " ", "")

    local hex = string.format("%X", hex)

 

    return "0x"..hex

  end

 

  function searchString()

    local t = {}

    local replaceManager = {}

    gg.clearResults()

    gg.setRanges(gg.REGION_CODE_APP)

    gg.searchNumber("h 00 4E 53 74 36 5F 5F 6E 64 6B 31 32 30 5F 5F 73 68 61 72 65 64 5F 70 74 72 5F 65 6D 70 6C 61 63 65 49 31 31 41 74 74 61 63 6B 53 74 61 74 65 4E 53 5F 39 61 6C 6C 6F 63 61 74 6F 72 49 53 31 5F 45 45 45 45 00", gg.TYPE_BYTE)

    t = gg.getResults(2)

    gg.clearResults()

    gg.setRanges(gg.REGION_C_DATA | gg.REGION_OTHER)

    gg.searchNumber(t[2].address, dataType)

    t = gg.getResults(1)

    gg.clearResults()

    gg.searchNumber(t[1].address - offset_cdExe, dataType)

    t = gg.getResults(1)

    t[1].address = t[1].address + offset_cdExe

    gg.clearResults()

    gg.setRanges(gg.REGION_C_ALLOC | gg.REGION_ANONYMOUS)

    gg.searchNumber(t[1].address, dataType)

    t = gg.getResults(1)

    t[1].address = t[1].address + offset_AnonToPtrVal

    t = gg.getValues(t)

    if ISA == false then

      t[1].value = t[1].value&0xFFFFFFFF

    end

    t[1].address = t[1].value + offset_PtrToVal

    t[1].flags = gg.TYPE_DWORD

    replaceManager = gg.getValues(t)

    gg.addListItems(replaceManager)

    new_address = replaceManager[1].address - offset_toJump

    gg.addListItems({{address = new_address + 0x4, flags = gg.TYPE_DWORD}}) -- value

    gg.addListItems({{address = dec2hex(new_address), flags = gg.TYPE_DWORD}})

  end

  function replayTics()

    local tt = {}

    local replaceManagerr = {}

    gg.clearResults()

    gg.setRanges(gg.REGION_CODE_APP)

    gg.searchNumber("h 00 4E 53 74 36 5F 5F 6E 64 6B 31 31 30 5F 5F 66 75 6E 63 74 69 6F 6E 36 5F 5F 66 75 6E 63 49 5A 4E 31 31 41 74 74 61 63 6B 53 74 61 74 65 31 36 6F 6E 52 65 70 6C 61 79 52 65 63 65 69 76 65 64 45 4F 4E 53 5F 31 30 75 6E 69 71 75 65 5F 70 74 72 49 36 52 65 70 6C 61 79 4E 53 5F 31 34 64 65 66 61 75 6C", gg.TYPE_BYTE)

    tt = gg.getResults(2)

    gg.clearResults()

    gg.setRanges(gg.REGION_C_DATA | gg.REGION_OTHER)

    gg.searchNumber(tt[2].address, dataType)

    tt = gg.getResults(1)

    gg.clearResults()

    gg.searchNumber(tt[1].address - offset_cdExe, dataType)

    tt = gg.getResults(1)

    tt[1].address = tt[1].address + offset_cdExe

    gg.clearResults()

    gg.setRanges(gg.REGION_C_ALLOC | gg.REGION_ANONYMOUS)

    gg.searchNumber(tt[1].address, dataType)

    tt = gg.getResults(1)

    tt[1].address = tt[1].address + offset_ToPointer

    tt = gg.getValues(tt)

    if ISA == false then

      tt[1].value = tt[1].value&0xFFFFFFFF

    end

    tt[1].address = tt[1].value

    tt[1].flags = gg.TYPE_DWORD

    replaceManagerr = gg.getValues(tt)

    gg.addListItems(replaceManagerr)

  end

  searchString()

  replayTics()
The search string function works on 32-bit and 64-bit systems. But replayTics does not work on 32-bit systems.

1 answer to this question

Recommended Posts

  • 0
Posted

I mistakenly mixed up the offsets, changed the offsets for the 32 system with the 64 bit one and everything worked

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.