So I got this app loaded in x64, there is a function, let's say "HeatGainedPerShot", which is basically the value which an object gains everytime it fires, Such a value would normally exist in the code, but as this is C++, it is simply impossible to revert to source code, thus leading me to a debugger,

So I found it, well.. the debugger displays many leading to the same adress, but that's for later.

0000000140201A9D | 48:8D0D FC7FFF02       | lea rcx,qword ptr ds:[1431F9AA0]      |00000001431F9AA0:"FireMode.HeatPerShot"

As you can see rcx is what contains it, Is there a way to do math on it? or change it to a zero,

  • proof of concept:::
  • lea 0,qword ptr ds:[1431F9AA0]
  • or
  • lea rcx*0,qword ptr ds:[1431F9AA0]

I know it doesn't work, but would it not be possible to do something like that?

( https://i.imgur.com/hHCWS3l.png )

  • Do you want to write the value to that address or just change it before its being used in a calculation? In the latter case you can try patching the instruction with something like 4831c9 xor rcx, rcx that will zero the value of rcx register which will be used later in the code. – sudhackar Jul 27 '20 at 18:05
  • Well, it is the same thing as long as there is 0 "heat" gained whenever you fire, (just the same way you would patch it in the code itself), could you elaborate more on using '4831c9' ? Also, what is with this? i.imgur.com/732ygpz.jpg ... ty for your contribution. – memapa4364 Jul 27 '20 at 20:05
  • I am afraid your aforementioned technique has not worked as I do not know how to exactly implement it, but here is an image that displays what I am trying to achieve if my post had not gotten to the point: i.imgur.com/hHCWS3l.png – memapa4364 Jul 27 '20 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.