1

Firstly I acknowledge that this is very borderline opinionated, but I'd like to emphasize this is more a thing of possibilities given some shortcomings of the default just writing down the offsets of things.

I do a lot of reverse engineering and then I write C/C++ code to mess with what I've learned. Suppose there is a class like this, representing a monster:

OFFSET  SIZE    VALUE
0       8       Pointer to methods
1280    4       X coordinate
1284    4       Y coordinate
128C    4       Z coordinate
1400    4       Health

where, for example, *(float*)((uint8_t*)obj + 0x1280) would give the X coordinate. The rest of the class is unknown, and the only known method is *(uint32_t*)((uint8_t*)*(uint32_t*)obj + 0xC), which just sets the health.

These kinds of classes can be updated very frequently, making it incredibly annoying to just have recorded the offsets of different things. I have seen it suggested to create a padded class with just uint8_t[next off - start], but even that just feels really awkward.

Right now the best thing I can think of to do would be to create a bunch of different bytescans (excluding the offsets) for different methods of the object that access its members and automatically determine the offsets, but still.

My problem is that although I don't actually mind the updating itself, my code looks terrible. I effectively treat these objects as just integers floating around and have a bunch of scattered functions that operate on them like objects, but really they aren't.

Is there a "proper" way to define an object with "suggested" offsets, with or without llibraries, and regardless, what would be a decent way to have clean code working with undocumented and mostly unknown objects like these?

1 Answer 1

1

You could create a struct of pointers and initialise them at run time. In some cases it might also be possible to alias to arrays.

If using a padded struct, be careful of compiler alignment of the fields.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.