2

I want to get into reverse engineering and eventually be able to read the memory of a specific game during runtime and work with this data. For this purpose I have been doing research on that topic and was considering to start with a simple task to learn about the proper tools and stuff like finding offsets for various information.

I wanted to open an instance of the notepad editor, write some text into it and then access this text from another program after figuring out the right addresses. Although it seems as if OllyDbg is a famous choice I had problems to attach it to my notepad process. (Apparently some problem with the 64-bit Windows 10 would be my first guess here.)

Anyways, I was curious if you can suggest me tools and alternatives for OllyDbg to get into this, especially proving the possibility to search the memory contents with specific patterns, in my sample case the text I entered on screen.

Improve this question
7
  • 1
    Olly is x86-only, which is why you can't attach to x64 notepad.exe. To debug x64 binaries, you can use x64_dbg, IDA's remote x64 debugger, or WinDbg, among others.
    – rev
    Commented Sep 24, 2015 at 21:21
  • @AcidShout Actually I tried x64_dbg as well but it seems as if it doesn't have support to search in the memory or I was just unlucky to not find the option. Any advice on that?
    – Christian Ivicevic
    Commented Sep 24, 2015 at 21:23
  • I was actually unable to search, but that may be due to the fact I'm using an old version of x64_dbg. Can't update now, but what you should do is go to the .data section of the process and then right click -> "Find pattern", and there you search for your string. I would use Cheat Engine for that, however, as (imo) it has a better UI for this kind of stuff.
    – rev
    Commented Sep 24, 2015 at 22:27
  • notepad uses memory mapped sections you wont be able to find the data you have written in a notepad in the process memory of notepad.exe
    – blabb
    Commented Sep 25, 2015 at 6:05
  • As you venture into modifying game memory. I'd suggest also looking into dll or code injection. Being able to reside inside the games memory space makes the entire process much simpler (direct memory access is much easier and less intrusive than read/writeprocessmemory).
    – gandolf
    Commented Sep 25, 2015 at 16:24

2 Answers 2

Reset to default
3

Cheat Engine is probably the most well-known tool for scanning memory for strings.

Some of the better hex editors (such as 010 Editor and WinHex) also allow you to scan a process's memory for strings.

Improve this answer
1
  • The Cheat Engine seems like a really decent tool to get started with some basics. I really like the search which filters specific memory addresses - helps a lot to narrow down the possible locations for certain strings.
    – Christian Ivicevic
    Commented Sep 26, 2015 at 21:50
2

ReClass is used to rebuild structures/classes in memory and will output C/C++ compatible structures that you can easily copy into existing code. Really neat too. I've used it personally to access vtables

It is also EXTREMELY effective at following pointers in memory and previewing data

How to use ReClass

This guy does a good job of explaining how it is used in game hacking

Improve this answer
1
  • This tool will definitely come in handy, however for the beginning the Cheat Engine looks like the very first tool to work with when it comes to finding specific data in memory. ReClass will apparently be the next step of parsing the found data. Thanks for the suggestion :)
    – Christian Ivicevic
    Commented Sep 26, 2015 at 21:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.