#[tutorial] How to get *some* internal offsets

1 messages · Page 1 of 1 (latest)

crystal hill
#

IdentityPtr

IDA Pro

  1. Press View → Open Subviews → Strings or Shift+F12 to open the Strings tab.

  2. Search for Current identity is %d.

  3. Go to its xref.

  4. Press TAB or F5 to decompile. It will take you here:

v2 = sub_39D48F0(qword_66EAF08);
v3 = *(_OWORD *)v2;
*(_QWORD *)(v2 + 0x28) = sub_CE75A0;
*(_QWORD *)(v2 + 0x18) = a1;
if ( (int)((__int64)(*(_QWORD *)(a1 + 0x20) - *(_QWORD *)(a1 + 8)) >> 4) <= 0 )
{
    v9 = v3;
    sub_1516AB0(0, "Current identity is %d", (_DWORD)v3);

The qword passed as input to the function that produces v2 (i.e. qword_XXXXXXX) is the identity struct pointer.

Here, qword_66EAF08 is used as input to produce v2, so:

IdentityPtr = 0x66EAF08
#

luaO_nilobject

IDA Pro

  1. Search for string: Attempt to migrate WeakObjectRef across VM boundary

  2. Go to its xref.

  3. Decompile with TAB or F5. It will take you here:

if ( *(_QWORD *)(*(_QWORD *)(*(_QWORD *)(v3 + 8) + 24LL) + 3192LL) != *(_QWORD *)(v5 + 3192) )
    sub_39E51D0("Attempt to migrate WeakObjectRef across VM boundary");
v6 = *(_BYTE *)(a2 + 1);
if ( (v6 & 4) != 0 )
{
    *(_BYTE *)(a2 + 1) = v6 & 0xFB;
    *(_QWORD *)(a2 + 88) = *(_QWORD *)(v5 + 48);
    *(_QWORD *)(v5 + 48) = a2;
}
v7 = sub_26F9F10(a2, 4294957296LL);
v10 = *(_QWORD *)v7;
if ( (unsigned int)(v9 - 1) >= *(_DWORD *)(*(_QWORD *)v7 + 8LL) )
{
    v12 = *(char **)(v10 + 16);
    if ( v12 == (char *)&unk_4CCF758 )
    {
LABEL_14:
        i = (double *)&unk_4CD0028;
    }
    else

unk_4CD0028 is luaO_nilobject.

luaO_nilobject = 0x4CD0028
#

OpCodeTableLookup

IDA Pro

  1. Press Ctrl+Alt+S or go to Edit → Plugins → Sigmaker.

  2. Press Search for a signature → OK.

  3. Paste this signature:

42 0F B6 8C 30 ? ? ? ? 0B CA
  1. You will be taken to a line like:
movzx   ecx, ds:byte_52E3230[rax+r14]

byte_52E3230 is the OpCodeLookupTable.

OpCodeTableLookup = 0x52E3230

FireProximityPrompt

IDA Pro

  1. Press Ctrl+Alt+S or go to Edit → Plugins → Sigmaker.

  2. Press Search for a signature → OK.

  3. Paste this signature:

48 89 5C 24 ? 55 56 57 41 56 41 57 48 8D 6C 24 ? 48 81 EC ? ? ? ? 48 8B F9 E8

  1. Click OK to search.

  2. You will be taken to a line like:

mov     [rsp-8+arg_0], rbx
  1. Press F5 to decompile.

The function at the top (e.g. sub_1D147C0) is FireProximityPrompt.

FireProximityPrompt = 0x1D147C0

luau_execute

IDA Pro

  1. Press Ctrl+Alt+S or go to Edit → Plugins → Sigmaker.

  2. Press Search for a signature → OK.

  3. Paste this signature:

E8 ? ? ? ? 84 DB 0F 85 ? ? ? ? 88 5F ? E9 ? ? ? ? 49 8B 41

  1. Click OK to search.

  2. You will be taken to a line like:

call    sub_273D6E0

The called function (e.g. sub_273D6E0) is luau_execute.

luau_execute = 0x273D6E0
toxic laurel
#

wasnt all of this arleady leaked

#

ud

crystal hill
#

alright vro atleast be positive

toxic laurel
#

this useful ❤️

crystal hill
#

😭

#

IM DONE VRO

toxic laurel
#

ilyt