Reading value from EAX at a certain address

This is a discussion on Reading value from EAX at a certain address within the C Programming forums, part of the General Programming Boards category; Hello, I am trying to make a trainer for an old single player game. Basically, I want infinite money. I ...

  1. #1
    Registered User
    Join Date
    Dec 2004
    Location
    The Netherlands
    Posts
    91

    Reading value from EAX at a certain address

    Hello,

    I am trying to make a trainer for an old single player game. Basically, I want infinite money. I found out that this address is not static, but dynamic. It changes everytime I start the game.

    After some debugging I found out that the address holding the money value comes in the EAX register for a short while. I want to extract it's value.

    I know how to access EAX in C:

    Code:
    //This works in MS VS.
    int i;
    __asm mov i, eax;
    printf("%X\n", i);
    But the value isn't there the whole time. Thus, I can't "just" save it's value somewhere else.

    See my debugging logs for more info:

    Code:
    007e3e14 - mov ebx,[eax]
    007e3e16 - add ebx,edi
    007e3e18 - mov [eax],ebx //EAX = 073BBBB4 - The address holding the value of money
    007e3e1a - jns 007e3e22
    007e3e1c - mov [eax],00000000
    How can I retrieve that address? I have already injected my dll in the games process, I can access and change the memory data locally.

    Regards,
    apsync.

  2. #2
    Registered User
    Join Date
    Oct 2008
    Location
    TX
    Posts
    2,047
    Perhaps then you need a pointer to store the value inside the EAX register instead of an ordinary variable, as in:
    Code:
    int *ip;
    __asm mov ip, eax;
    printf("%X\n", *ip);

  3. #3
    Captain Crash brewbuck's Avatar
    Join Date
    Mar 2007
    Location
    Portland, OR
    Posts
    7,243
    Quote Originally Posted by apsync View Post
    Code:
    007e3e14 - mov ebx,[eax]
    007e3e16 - add ebx,edi
    007e3e18 - mov [eax],ebx //EAX = 073BBBB4 - The address holding the value of money
    007e3e1a - jns 007e3e22
    007e3e1c - mov [eax],00000000
    Can you show a few more instructions prior to this piece of code? Specifically, where is the value of eax coming from?
    Code:
    //try
    //{
    	if (a) do { f( b); } while(1);
    	else   do { f(!b); } while(1);
    //}

  4. #4
    Registered User
    Join Date
    Dec 2004
    Location
    The Netherlands
    Posts
    91
    Quote Originally Posted by itCbitC View Post
    Perhaps then you need a pointer to store the value inside the EAX register instead of an ordinary variable, as in:
    Code:
    int *ip;
    __asm mov ip, eax;
    printf("%X\n", *ip);
    Yes, the question is WHEN/WHERE do I read the value from EAX. Obviously I can't put it on top of my main function. (Thanks for the response though, always appreciated.)

    Quote Originally Posted by brewbuck View Post
    Can you show a few more instructions prior to this piece of code? Specifically, where is the value of eax coming from?
    Sure:

    Code:
    007E3E00 - 8b 54 24 04                - mov edx,[esp+04]
    007E3E04 - 53                         - push ebx
    007E3E05 - 56                         - push esi
    007E3E06 - 57                         - push edi
    007E3E07 - 8d 81 c8 00 00 00          - lea eax,[ecx+000000c8]
    007E3E0D - be 07 00 00 00             - mov esi,00000007
    007E3E12 - 8b 3a                      - mov edi,[edx]
    007E3E14 - 8b 18                      - mov ebx,[eax]
    007E3E16 - 03 df                      - add ebx,edi
    007E3E18 - 89 18                      - mov [eax],ebx ; // BP
    007E3E1A - 79 06                      - jns 007e3e22
    007E3E1C - c7 00 00 00 00 00          - mov [eax],00000000
    007E3E22 - 83 c2 04                   - add edx,04
    007E3E25 - 83 c0 04                   - add eax,04
    007E3E28 - 4e                         - dec esi
    007E3E29 - 75 e7                      - jne 007e3e12
    007E3E2B - e8 60 fd ff ff             - call 007e3b90
    007E3E30 - 5f                         - pop edi
    007E3E31 - 5e                         - pop esi
    007E3E32 - 5b                         - pop ebx
    007E3E33 - c2 04 00                   - ret 0004
    After some thoughts, I can also do a move eax, 100000 at 007E3E18. I don't need to read any values from registers that way, however, I'm still interested how that could be achieved.

  5. #5
    Registered User
    Join Date
    Oct 2008
    Location
    TX
    Posts
    2,047
    Quote Originally Posted by apsync View Post
    Yes, the question is WHEN/WHERE do I read the value from EAX. Obviously I can't put it on top of my main function.
    For that you would need timing diagrams of program flow. When does the "money" address gets loaded into the EAX register?
    Without indepth information it would be hard if not impossible to get at this address without polling the EAX register periodically.

  6. #6
    Registered User
    Join Date
    Dec 2004
    Location
    The Netherlands
    Posts
    91
    Quote Originally Posted by itCbitC View Post
    For that you would need timing diagrams of program flow. When does the "money" address gets loaded into the EAX register?
    Without indepth information it would be hard if not impossible to get at this address without polling the EAX register periodically.
    Whenever I hit the "End Turn" button. I'll try to match a pattern in memory somewhere.

  7. #7
    Registered User
    Join Date
    Oct 2008
    Location
    TX
    Posts
    2,047
    Do you have any manuals on this game?
    What chipset does this game console use?
    What bit pattern does the "end turn" key generate?
    It must be possible to simulate "end turn" in software.

    Look for answers to some of those questions in your manuals.
    You can also post those manuals here and forum'ers will help out.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Memory leaks problem in C -- Help please
    By Amely in forum C Programming
    Replies: 14
    Last Post: 05-21-2008, 11:16 AM
  2. import address table (IAT)
    By George2 in forum C++ Programming
    Replies: 5
    Last Post: 02-20-2008, 07:01 AM
  3. Getting a grasp on pointers
    By lilrayray in forum C Programming
    Replies: 23
    Last Post: 07-26-2006, 06:58 PM
  4. Memory Address
    By Stack Overflow in forum C Programming
    Replies: 5
    Last Post: 05-25-2004, 11:43 AM
  5. Pointer address
    By cheeves in forum C Programming
    Replies: 7
    Last Post: 10-30-2003, 07:26 PM

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21