Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I'm using ghidra and cheat engine to reverse engineer a game's function. In ghidra's decompiler this function references two locations known as _DAT_XXX. I know the addresses of these locations in the binary.
But how do I find the addresses of the locations when the process is running?
if (_DAT_00dd5c44 <= DAT_00dd5c3c) {
return 0;
}
If the executable was compiled as position dependent code, the addresses will not change - they will remain the same in process' virtual memory each time you run it. In this case, it simply suffices to find these addresses once during the runtime and they won't change.
In this (more likely) case, the addresses will change during each execution because of ASLR. The thing that won't change however is their relative offset to each other. Since at compilation time, compiler has to take into account, that the resulting program can be loaded at different addresses it will use the relative offsets when accessing functions and data. For example, you will see something like mov rax, [rip+0x1234] instead of mov rax, [0x555555655655]. So you will need to find out the address of the data by calculating this relative offset.
To avoid the problems related to ASLR, you may simply disable it for the time you need. In Linux you can do it by:
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
and you can enable it once again by running:
echo 2 | sudo tee /proc/sys/kernel/randomize_va_space
Finally, to get the address of the data referenced like mov, rax, [rip+0x1234] you will have to debug your program, place a breakpoint at that line and simply read the rip value and add the relevant offset to it (in this case rip+0x1234).
