Quote:
Originally Posted by No0oB
RealBaseAdress? what? i didnt know there is something that is more base than the base
|
yes most call it realbase, or from your old source you called it BaseCall_Offset...just remember your coding:
Quote:
from your old source:
".*?(8B0D(.{8})898D40F1FFFF6A01)" & _ ;Base_Address
".*?(A1(.{8})578B482081C1EC)" & _ ;BaseCall_Offset
|
so this regex are right named:
realbase hex 00B4EF34
(3BCE7CDC8B0D(.{8})8B51148B72088BCE
or same with your old BaseCall_Offset regex A1(.{8})578B482081C1EC)
base hex B4F5FC
(8B0D(.{8})898D40F1FFFF6A01)
unfreeze hex 48C
(0F95C084C0[FF88]{2}85(.{8}) )
look in your old source:
Quote:
".*?(8B0D(.{8})898D40F1FFFF6A01)" & _ ;Base_Address
".*?(A1(.{8})578B482081C1EC)" & _ ;BaseCall_Offset
...
$aUnfreezeOffset = StringRegExp($Data, $UnfreezeOffset, 1)
$aBaseAddress = $info[0][1]
If IsArray($aUnfreezeOffset) Then
$UnfreezeAddress = ("0x" & $aBaseAddress) - 0x1C
$UnfreezeAddress = Hex($UnfreezeAddress + Dec(Reverse($aUnfreezeOffset[1])))
$ArraySize = UBound($info, 1)
ReDim $info[$ArraySize][3]
$info[$ArraySize - 1][0] = "Unfreeze_Address"
$info[$ArraySize - 1][1] = _RemoveZero($UnfreezeAddress)
$info[$ArraySize - 1][2] = Dec($UnfreezeAddress)
EndIf
|
there you use right regex for Base_Address, right regex for BaseCall_Offset (realbase adress) and calculate it right.
just what i wrote before:
Quote:
BaseAddress(the real one and not your regex for realbase/callbase offset)-1C+UnfreezeOffset=right unfreeze adress
from your old source with right baseadress regex:8B0D(.{8})898D40F1FFFF6A01
result in right calculation:
B4F5FC-1c+48C=B4FA6C right unfreeze adress
|
or show me with your regex.txt how you calculate this right:
Quote:
original txt:
#Unfreeze Address = BaseAddress+UnfreezeOffset
BaseAddress: 3BCE7CDC8B0D(.{8})8B51148B72088BCE
what result in B4EF34-1c+48C= B4F3A4 wrong offset
|
you just wrote the wrong regex for baseadress in this app, what you wrote is realbase regex.
need to write like this:
Quote:
Base_Address: 8B0D(.{8})898D40F1FFFF6A01 (right baseadress regex)
Real_Base_Address: 3BCE7CDC8B0D(.{8})8B51148B72088BCE (your wrong called baseadress regex)
|
then calculate as you descripe and get right result by using base adress:
B4F5Fc-1c+48C=B4FA6C right unfreeze adress
Quote:
Originally Posted by No0oB
if im wrong slap me with a large trout ot something 
|