2

The 2 main approaches to disassembly are Linear sweep - decode all bytes appearing in sections of the executable that are typically reserved for machine code (e.g. the .text section of an ELF binary) as machine code Recursive traversal - take into account the control flow behavior of the program being disassembled in order to determine what to disassemble ...


2

when you are here 4017ff: 55 push rbp your 5th argument will be available at [rsp+28] (8 bytes for return address and 20 bytes for HOMEPARAMS (space for saving the 4 args passed via register) two pushes and one subtract will make your argument no 5 available at 0x28 + 0x8 +0x8 +0x48 = 0x80 so rbp+0 will hold the address of 5th ...


1

the instruction lea loads the Effective Address of its operand so after executing lea rcx, qword ptr ds:[xxxxxxx] rcx will hold the address xxxxxxx so if you are sure you need rcx to be 0 in that instruction simply wipe the address from that specific operand that is make 48:8d05 xyzabcd as 48:8d0425 00000000 or assemble lea rax,qword ptr ds:[0] keep in mind ...


1

I've spent many hours (too many for me to admit) trying to figure this out and I just realized what it is, right after hitting submit. push instructions implicitly decrease the stack pointer. The call to the function DotProduct calls push three times; once in the call instruction itself, where the return address is implicitly pushed, and twice in the ...


1

It is indeed possible, and not that hard to do - providing the game doesn't have any anti-cheat nor integrity checks. The thing you are looking for is called function hooking. If you don't want to mess with assembly there are few good libs that can do the most important and tedious part of work for you. Detours - developed by Microsoft Frida PolyHook Take ...


Only top voted, non community-wiki answers of a minimum length are eligible