Pattern

[TenshiSan]

How do you get your Patterns?

is it in the IDA-Code or do I get them by Sniffing the Packets from WoW?
Edit 1 : For example the Objectmanager or PlayerBase

"Sorry for my bad english"

[namreeb]

I find the easiest way is by looking at the code in OllyDBG. It makes it easy to identify what bytes need to be wildcarded.

[Azzie2k8]

How do you get your Patterns?

is it in the IDA-Code or do I get them by Sniffing the Packets from WoW?
Edit 1 : For example the Objectmanager or PlayerBase

"Sorry for my bad english"

The following might not be 100% correct but I will try to explain it a bit.

I will try to explain what byte patterns are.
Basicly the RAM contains a copy of the games machine code when the program is executed. This machine code consists of bytes(simple numbers) which represend Opcodes or fixed numbers and so on.

When creating a pattern you look at the byte representation of this memory area. If you want to find a function for example you look at a part or the whole function so you will have a close to 100% match when searching this exact pattern.
The thing about pattern searching is that you will have to deal with certain parts of the memory that will change during patches ( some pretty much random offsets changes ). Most function layouts will not be changed during a patch so you can search for the general layout of that function as a byte pattern.

To search a pattern in ida you can simply turn the changing bytes into ?? This will make IDA accept any value in there but you will need to read up on this.

To get the patterns you can just go to the hex view in IDA. There is also a option in the Options tab of IDA that will show you the first x bytes of a line in IDA Text View.

Hope this helped.

Edit: seeing your first thread I think you are just too lazy to google but my last sentence should help then.

[Evieh]

How do you get your Patterns?

IDA with PatternMaker plugin ftw.
Search for it here in the memory editing section, it's in here somewhere.

[LogicWin]

http://rapidshare.com/files/433634900/PatternMaker.plw

10char 10char