Help with finding a pointer

Oct 26, 2017
6
0
1
#1
Hey guys, I've been trying to find the static address for the nitrous in need for speed most wanted 2. But as I go up in pointers manually, on the second pointer I get an instruction without offset (mov ebx, cbx etc.) so I can't trace further. I also tried pointerscan for the value with level 7 and max offset 7000 and still on second pointer scan - 0 results.. I'm kinda new tell me if I missed something and I will provide more info.
 

FreeER

RCE Fanatics
Talents
Mar 10, 2017
90
3
8
#3
tonka4ok post_id=21939 time=1509016116 user_id=9810 said:
I get an instruction without offset (mov ebx, cbx etc.) so I can't trace further
if it's something like mov ebx, [eax] then the offset is 0 eg. mov ebx, [eax+0] if it's more like mov ebx, eax then look up in the code to see where eax got it's value.

Generally I prefer using assembly scripts over pointers however so I don't know too much about working with pointers when it's hard to track them down, I'd just hook something that uses it and copy the address to some memory if nothing else.
 
Oct 26, 2017
6
0
1
#4
You mean you trace down the changes from the value's memory region without looking for pointers ?
 

jungletek

Reality Bytes
Oct 17, 2017
158
6
18
#5
tonka4ok post_id=23013 time=1509631055 user_id=9810 said:
You mean you trace down the changes from the value's memory region without looking for pointers ?
Nah, a hook for nitrous in your case would be something like this:

Find Nitro address, use find what accesses or find what writes to find a routine that updates constantly (ideal) or only when your nitro decreases/increases.

Use AutoAssembler to write an (AOBscan optional) injection where you define a global variable (let's say nitroAddress) and then write the address of nitro to [nitroAddress] before executing (or not, depending on what you're doing) the original code that you detoured with your injection.

You can then add an address to your address list in the main CE window that points to [nitroAddress] (because you defined that variable in your injection script) and it will dynamically update the address whenever the code path you hooked is executed.
 
Top Bottom