Posted
first sorry for the bad English
UPDATE: FIXED SOME GRAMMAR
Update2: added pushvfstring. 2022/12/7
UPDATE3: added xorconst. 2022/12/7
Update4: getcallcheck_1 and output. 2022/12/8
now will start
_____________________
to get top and base search in strings for
Spawn function requires 1 argument
then double click and click on aSpawnFunctionR just one click not double and
Press x and press ok and then press f5 to decompile in line 44 u will find
top and base the first one is gonna be the top and the 2nd is going to be the base
should look like this
_____________________
to get the print addy search in strings for
Video recording started
then double click it and click the first Xref
and the first under call click it and f5 to decompile
then u got it unsigned int sub_******(int a1, int a2, ...) it will be like this
--------------------------------------------
to get spawn address search
Spawn function requires 1 argument
in strings and double click it and then click aSpawnFunctionR
and then press x and okay
then press f5 and go to the first line and done that's it it will be like
int __cdecl sub_******(int a1)
^^^^^ this might be different like fastcall or thiscall some like that
___________________________________________________
to get psuedo2adr search in strings for
tables cannot be cyclic
then double click it and click aTablesCannotBe and press x and press ok
then press f5
and go down till u see something like this:
and this will be it
_________________________________________________
to get rbx_getscheduler first search in strings for
SchedulerRate
then click aSchedulerrate and press x and press ok after that
go to the first upper push and double click it and decompile it
look for a sub without arguments like sub_******(); should be it will look like this
just double-click it and u got it
__________________________________________
to get rbx_getstate search in strings for
challenge
and double click it and click aChallenge and press x and press ok
then the first upper push double click it and decompile it
scroll under till you see something like this:
decompile that sub
and scroll down till you see an if statement
0x44C450 this is gestate
_________________________________________
to get luaO_nilobject just go to the psuedo2adr addy and decompile it
and it should look like this
v2 = **(_DWORD **)a1[7];
if ( -10002 - a2 > *(unsigned __int8 *)(v2 + 4) )
return &byte_21AFEB8;
that's it ^^^^^^^
_________________________________________
how to get rbx_pushvfstring first search for string
%s:%d: %s
then click on aSDS_0 and press x and then ok then decompile
it will look like this
sub_12961F0(*v5);
v6 = sub_12A6FC0();
return (int *)sub_12961D0(a1, (int)"%s:%d: %s", v51, v6, a2);
} thats it ^^^^^^^^
just decompile it and ur good to go
photo
________________________________________________
how to get xor addy first search for string
Variant cast failed
and click aVariantCastFai and then press x and go to first xref
after that just go up till you see
xorps xmm1, xmmword_*******
this will be it^^^^
__________________________________________________________
to get callcheck_1 first serach for string
ntdll
then click aNtdll and press x and then go to first xref
and the first under mov is the addy it will look like this
push offset aNtdll ; "ntdll"
mov dword_*******, edi
_________________________________________________________
to get output addy first search for string
Assertion failed: %s\n%s(%d)
then scroll down till you see the first subroutine and decompile it
___________________________________________________________
That's all let me know if something was wrong
want something? add me on disccord !Spl||HasH!#7562
Replied
gbukhyjgkuy jhyfthgvgvhn n bhgf bgnhfb gfvnbfgv bfgtv drbf vgdfvbdgx bfgv dfgb vdrtfgbrv dtfgrbdtv fgbdr vfgrbfgfgrbbdrv????
R just one click and then press ok and then double and the first on is going to be the first one click and base the first on is going to be the first on is going to be the 2nd is gonna be the base the 2nd is gonna be the first on is gonna be the 2nd is going to be the base the 2nd is gonna be the top and then press ok and the first on is gonna be the base search in strings for
Cancel
Post
"Questionable intellegence, but I like the mystery" - CubeFaces
https://cdn.discordapp.com/attachments/1136067487847415848/1138948596679589898/sig.png
want something? add me on disccord !Spl||HasH!#7562
Replied
Nice thread and a very good option for those who want to get addresses from IDA
Cancel
Post
Added
@Entity no all of the addys are 0x00001000 it will work on anything u can print with this too
Cancel
Post
want something? add me on disccord !Spl||HasH!#7562
Users viewing this thread:
( Members: 0, Guests: 1, Total: 1 )
Cancel
Post