about finding adress for a debuger.

[DABhand]

You could use code injection.


Find a code cave, free space to have your own code, 10abf is always a good addy if you cant find one.

Then I would write this at the code cave


mov ecx , xxxxxx whatever value you want here in hex
jmp xxxxxxx (whatever addy you will jump from in the game)


And at the game coding, where the sub is


jump 10abf (and say yes to nop extra)

Any coding apart from the sub op code that is destroyed here will have to be replaced in your code cave. jumps take 5 bytes so bear that in mind.

[pikachu5501]

Thank you for you prompt reply . I will study this further. Now i know where to look.

[TippeX]

Originally Posted by DABhand

10abf is always a good addy if you cant find one.

hope thats baseless - otherwise its a heap area, and if the program hasn't initialised heaps then ur buggered....
wonder why people dont use virtualallocex and inject their code that way....

[pikachu5501]

Actualy, i saw something like that about code injecting in the CE tutorial but now i know what it does so i think i am ready to advance to that next level.

I found that learning to do trainer and all it is as fun (and frustrating sometime) as a game itself.

As usual, Thank for you priceless(the good way!) advices . I hope i will be able to give back anytime soon .

[DABhand]

Originally Posted by TippeX

hope thats baseless - otherwise its a heap area, and if the program hasn't initialised heaps then ur buggered....
wonder why people dont use virtualallocex and inject their code that way....

Its a safe area, ive used it for many a trainer myself.

[pikachu5501]

I use 10abf myself now and allways filled with 0, i wonder if it was something from an old legacy thing from another windows version or something.

[Synaesthesia]

Usually, first section of an .exe has tons of 00s at the end of it...