I have been looking through a video games executable trying to find the values or variables in order to make a dev tool for real time editing. I have tried to trace the references back to maybe .float but nothing but references. I would love to assume that the byte in question is the possible toggle im looking for. enter image description here

Notice how the address takes 3 rows 2 for the xref and 1 for the .byte 0 I am hoping maybe possibly it could be as simple as making a button that switches the .byte 0 into .byte 1 activating god mode and other features. Tried xref to and two and no xrefs from godmode. enter image description here using IDA 6.1, PPC binary

  • You will find xrefs to godmode only, since it is a string. But to find the godmode variable, you have to check the instructions around the xref addresses (0x823cc3e4 and 0x823cc3e0, which is really only one reference, just the address was constructed with 2 instructions).
    – ebux
    Jan 13 '16 at 14:08
  • Wow, coming into all of this from just picking up .net and C# this stuff is impressive. I see register 11 is used in both xrefs except aGodModeS@1# used r3 also. The numeral 1 makes me think they are a toggle. Will dig into this after work. Thank you again. Jan 13 '16 at 15:44

The marked .byte 0 values are the string terminating zeros, so if you want to find the switch values, you have to check the code used by these strings. Thus, follow the references back and you may see something like similar to the following pseudo code in assembly:

flag = aDisabled_
if (god_mode == 1)
   flag = aEnabled_
sprintf(godStr, aGodModeS, flag)

Finally you have to found the address of "god_mode" variable. Of course, it may be read out in a more complex way, for example by calling a getter function of a configuration class.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.