suggested, let's use normalized binaries with no ASLR in. There's no impact over the execution (you can run the game with the modified .exe as well) and will surely help everyone around doing reversing to keep things steady. Working with same binary, we'll know where we are.
He suggested this blog link: [Link]
Once you read-up what you're to do, you'll land on this step -> "Open up a VS command prompt and use:". What that means.. if you have Visual Studio installed.. is WinKey > "Developer":
Take your pick (I have all those versions installed, cuz I needed them to compiled various versions of Unreal Engine 4..). I'd recommend opening it as Administrator
, although it might work without it. But just to be safe.
Then navigate to game folder:
This will alter your executable, as it's a change in the PE header. So you will see the timestamp of the executable has changed.
Alternately, if you don't have VS installed and still wanna do it, then install [Link]
and follow the steps below:
1) Right-click on your executable and:
2) You want to load the whole executable (I don't know if opening it partially allows to save changed integrally). So click "No":
3) Then head into the Optional Header:
4) And untick "DLL can move":
5) Click OK, then Save and "Yes" to "Overwrite original file".
So now when you'll open the executable in a debugger or CE (like I said, there's no impact over execution, so you can run it safely.. as in play the game), you'll see this:
The EP is now referenced to the standard 140000000
So here are the 2 executables (DX11) I have, with the above modifications in place:
I will continue the analysis with 220.127.116.1131 (DX11), as, like I said, I don't want to re-offset/find everything again for the latest build. You'll just have to use aobscan to get to the spots I'm referencing here, in case you wanna use them in the most recent build. I have no interest in that, as I'm not actively playing the game nor care for bugs or other crap the regular user looks at. Said it so you know.