Different offset on dumping

[moh4mmed]

RVA: 0x2760510 Offset: 0x275F510 VA: 0x2760510 (float value)

Why there is two different offset and when I hook this offset then it's not working

Someone HELP

[MC874]

Hi @moh4mmed, RVA is Relative Virtual Address, it takes the offset from the beginning of a file / the start of lib address that exist on memory. Meanwhile VA (Virtual Address) is the method address while you're dumping the game. VA should not be used, you need to use only RVA.

Quote

RVA: 0x2760510 Offset: 0x275F510 VA: 0x2760510 (float value)

It seems the RVA & VA is the same. It should be different. Try redumping.

[moh4mmed]

 

8 hours ago, MC874 said:

Hi @moh4mmed, RVA is Relative Virtual Address, it takes the offset from the beginning of a file / the start of lib address that exist on memory. Meanwhile VA (Virtual Address) is the method address while you're dumping the game. VA should not be used, you need to use only RVA.

It seems the RVA & VA is the same. It should be different. Try redumping.

RVA: 0x2760510 VA: 0x7e24399510

 protected Void [[[][]][[][[[][[[[[]]]]][[[][[][]]][][[[][[][[](Int32 [[]]][[]][]]][][][[[][[[[[][[]]][][[[[]]]]][[[]) { }

I tried Hooking this (64bit game) but no luck so far RVA = same VA = change everytime. When I dump the lib through il2cpp dumper apk it gives offset as above mentioned but this one is dumped by zygisk dumper. Can you please help me to hook this offset through GG & BTW int32=1 here and I want it to be int32= 0

Edited September 30 by moh4mmed

[MC874]

Hi @moh4mmed, as I said earlier:

Quote

RVA = same VA = change everytime

That's why you need to use RVA because it's constant. Just grab the library base address and add RVA to it (Base address + RVA)
---

Quote

protected Void [[[][]][[][[[][[[[[]]]]][[[][[][]]][][[[][[][[](Int32 [[]]][[]][]]][][][[[][[[[[][[]]][][[[[]]]]][[[]) { }

You're trying to hook a method, also it is void types. You can change the "int32" as desired, but you need to find some instruction based on parameter it's located. For example, if "int32" is the first parameter, you need to find register R1 and change it to your value. For example:

MOV R0, R1 -> MOV R0, #1

---
So yeah, editing void method is kind of hard. You need to understand assembly first.