[Solved] No Access (all ??'s) in Memory View?

Memory scanning, code injection, debugger internals and other gamemodding related discussion
Post Reply
Drakkhen
Fearless Donors
Fearless Donors
Posts: 6
Joined: Fri Mar 03, 2017 3:54 pm
Reputation: 0

[Solved] No Access (all ??'s) in Memory View?

Post by Drakkhen » Fri Mar 10, 2017 5:15 am

Solved! I think.

I had an odd unknown entry in the permissions for that drive. Huge hex-like number in braces. Anyway, deleted that. Still had issues. Changed debuggers back and forth (ollydbg wouldn't attach to NMS, no matter what version I used) and rebooted a couple times. Final try, ran CE first (as admin), loaded NMS, then attached and CE went glitchy for a second. It then seems to have resolved addresses to names of functions (hadn't done that before). It's working now.

I've managed to get some of the scripts from the original table working (new aobs and some code changes) so, I'm not sure if it was permissions or the debugger or both, but either way it's working now.


Original Post:

Hello!

This question specifically relates to No Man's Sky, but it's a general question as well.

So, I know enough about ASM and CE to be able to make some minor scripts and I can usually always take an existing table and make it work on a newer version, etc. And this is where my problem lies...

NMS has a new patch out, and I was attempting to use it on the current version. Alas, only two cheats worked, the rest would not. I assumed this had to do with offsets changing or the AOB's just being inaccurate after the patch. So I load up NMS, have CE set to the VEH debugger and.... the Memory View of CE reports "No Access" and all of the bits and bytes of the actual memory are all ??'s.

So, NMS aside, why do I have no access? I've run CE with full admin rights... I've never had this issue with any other game, 32 or 64 bit. I can see all the opcodes and functions, but if I try searching for assembly or memory I get 0 matches.

Also, if I use one of CE's addresses, say "NMS.EXE"+00ABCDEF ... it goes to the completely wrong offset and CE seems to get a bit bonkers.

Any help would be greatly appreciated. Thanks!
Last edited by Drakkhen on Sat Mar 11, 2017 2:49 am, edited 1 time in total.

User avatar
++METHOS
Administration
Administration
Posts: 150
Joined: Thu Mar 02, 2017 9:02 pm
Reputation: 16

Re: No Access (all ??'s) in Memory View?

Post by ++METHOS » Fri Mar 10, 2017 8:32 am

Odd. I would check security/permission settings for folders/files of target to ensure that you have read/write access on everything. You might also try attaching to target using Ollydbg or x32/x64dbg.

User avatar
SunBeam
Trouble Makers
Trouble Makers
Posts: 188
Joined: Thu Mar 02, 2017 10:15 pm
Reputation: 32

Re: No Access (all ??'s) in Memory View?

Post by SunBeam » Fri Mar 10, 2017 9:17 am

If this happens only with this game, then it's a protection mechanism implemented in the latest patch. Try EACGuard driver in Ghost Recon post and see if that makes memory readable.

Eric
Hall of Famer
Hall of Famer
Posts: 33
Joined: Thu Mar 02, 2017 11:01 pm
Reputation: 9

Re: No Access (all ??'s) in Memory View?

Post by Eric » Fri Mar 10, 2017 9:20 am

Alas, only two cheats worked
...

User avatar
++METHOS
Administration
Administration
Posts: 150
Joined: Thu Mar 02, 2017 9:02 pm
Reputation: 16

Re: No Access (all ??'s) in Memory View?

Post by ++METHOS » Fri Mar 10, 2017 9:24 am

True. :D I initially disregarded that point, as the target could be protecting only specific areas of memory. Normally, this might render the first part of my previous comment irrelevant, however, if those two cheats were made by hooking a different module that is unprotected (e.g. one of the target dll's), then it could still be possible? -- Albeit, not very likely.

Trying ollydbg or another program might give some indication as to whether or not the target has implemented some sort of CE detection. More than likely, though, the scope goes beyond that.

User avatar
SunBeam
Trouble Makers
Trouble Makers
Posts: 188
Joined: Thu Mar 02, 2017 10:15 pm
Reputation: 32

Re: No Access (all ??'s) in Memory View?

Post by SunBeam » Fri Mar 10, 2017 12:39 pm

I've overlooked that as well :) It's likely the poster doesn't have enough experience to study what's going on and the functions initially found via patterns to have changed structure, either a bit or entirely (like it happens with every Dishonored 2 update).

User avatar
STN
Founder
Founder
Posts: 1476
Joined: Thu Mar 02, 2017 7:48 pm
Reputation: 85

Re: No Access (all ??'s) in Memory View?

Post by STN » Fri Mar 10, 2017 3:50 pm

Yeah the game code has changed a lot breaking most cheats, doesn't have any protections.

Post Reply

Who is online

Users browsing this forum: No registered users