7.3.2. 25549 Can't find a thing

[St1me]

Since I updated the game to 25549 I can't find anything in CE, and moreover not a single static pointer (green value in CE). Now I have now idea how to update the little tool I wrote.

[Vandra]

It's obfuscated now.

The Free Lunch Is Over - Obfuscation is Coming

[oDev]

Seems to load just fine in IDA 7 still, going to play around a bit and see what I can find

EDIT: This still looks the same, still uses static pointers
https://hastebin.com/otuwamoxuq.cpp

Not sure what is going on.


ObjMgrBase = 0x114FD7C <---- untested, but this is the address according to IDA


Maybe they've just done something that confuses CE?

[St1me]

Seems to load just fine in IDA 7 still, going to play around a bit and see what I can find

EDIT: This still looks the same, still uses static pointers
https://hastebin.com/otuwamoxuq.cpp

Not sure what is going on.


ObjMgrBase = 0x114FD7C <---- untested, but this is the address according to IDA


Maybe they've just done something that confuses CE?

That might be the case. I've found some variables in memory (server name for example) and when I tried to get some pointers for them (in CE), all of the pointers started with THREADSTACK0 or THREADSTACK1, it used to be wow-64 base address...

[oDev]

That might be the case. I've found some variables in memory (server name for example) and when I tried to get some pointers for them (in CE), all of the pointers started with THREADSTACK0 or THREADSTACK1, it used to be wow-64 base address...

Hmm very interesting

This code might come in handy soon cheatengine-threadstack-finder/ntinfo.cpp at thread-base-addr * makemek/cheatengine-threadstack-finder * GitHub


EDIT: x64 object manager base according to IDA: wow-64.exe+0x1A3C1C0

[lolp1]

Seems to work as always for me. Some examplex for x64 rebased to zero 7.2.3.25548

     internal static cliass Pointers64
    {           
        static Pointers64()
        {
            ImageBase = System.Diagnostics.Process.GetCurrentProcess().MainModule.BaseAddress;
        }

        internal static readonly IntPtr ImageBase;
        internal struct Manager
        {
            internal static readonly IntPtr EnumVisibleObjects;

            static Manager()
            {
                EnumVisibleObjects = ImageBase + 0x006E5400;
            }
        }

        internal static cliass SpellBook
        {
            internal static readonly IntPtr Information;
            internal static readonly IntPtr Count;
            static SpellBook()
            {
                Information = ImageBase + 0x1CAE098;
                Count = ImageBase + 0x1CAE090;
            }
        }

Dumped from normalpatterns as always.

[oDev]

rebased to zero 7.2.3.25548

Just to be clear, this is a typo right? I'm on 7.3.2.25549

Haven't actually tested reading from memory yet myself, but everything looks normal in IDA

[lolp1]

Just to be clear, this is a typo right? I'm on 7.3.2.25549

Haven't actually tested reading from memory yet myself, but everything looks normal in IDA

I meant 7.3.2.25549, fixed code tags, my framework is working as normal.