I am currently reversing Stardew Valley and I have been trying to trace the pointers to a static base address for values like gold and energy. The problem is that I can't find any static base addresses. It seems like no matter what path I take I end up getting instructions that nothing accesses. I searched online and someone said the same thing, and mentioned something about it being managed code written with .NET. My question is this: Is it possible that the game doesn't have static base addresses for these values, and, if so, how would I go about finding the values automatically if there's no static address?
1
-
2Leaving the .NET fact aside, there is no reason why game state has to be static. Static address means the developer used a static object or global variables, which he can but doesn't has to. And .NET just complicates the situation.– Johann AydinbasApr 18, 2019 at 23:18
Add a comment
|
1 Answer
Almost static address can be achieved when the developer use global or static variables.
While this was somewhat popular in the old days, today it is very rare and also considered a bad practice. Furthermore, features like ASLR are used to prevent an observer to exploit known static variables by relocating the image at a random address (details omitted as not pertaining this question).
Well designed software minimizes the use of global variables, but they cannot be removed altogether. Some software, may have references to singleton in global variables, others might have passed those references from one function to another.
Dealing with. NET binaries simplifies the matter, but does not change the fact that your data can be allocated at different addresses everytime.
To find the information you need, start by debugging the game when you actively perform an action (e.g. Sell, trade, or ecc..) and try to identify what is changed. If assuming there are no antidebugging measures, you will see where your data is manipulated. From there you can trace back where your data has been created and follow back to the root allocator. At that point you have many opportunities ranging from being able to follow the allocation chain at runtime, up to walking the managed heap for the single instance of a particular type.
