Code: Select all
newmem:
mov rax,playerPtr
mov [rax],rcx
code:
mov eax,[rcx+000000BC]
jmp return
playerPtr:
dq 0
player:
jmp newmem
nop
return:
registersymbol(player)
registersymbol(playerPtr)
Maybe this discussion can be helpful for anyone trying to read tables
This registers a playerPtr variable and lets the game write its value
Code: Select all
newmem:
mov r8,playerPtr
cmp [r8],rcx
jne code
xor r14,r14
code:
mov r8d,[r12+38]
jmp return
health:
jmp newmem
return:
registersymbol(health)
Here the pointer is used for a comparison. My reading of this is vague. Maybe there is a simple replace. Or there most likely is a simple replace or ten different ones that would accomplish the same thing. But the author wanted to play with remote code execution and used this for an exercise
The code section in the first statement is never used from what I can understand. I don't know the exact syntax of these tables or how they are interpreted. If there are magic sections with special names. I don't know if the return statement name is special
It's clear that code is referenced and used in the second table. But in the first one it can be removed am I right? And what about return what is that
And newmem can be called anything right? Are there any special names? ... Hmm