search type.

Started by IRS, June 29, 2010, 03:04:35 AM

Previous topic - Next topic

IRS

I've been hacking for about a month now.. and never come across this problem before.. but is there some kind of Hex Editor or Wiird search that will remove addresses that dont have the same values at each other? or any relatively easy way to do that? im trying to search for two values that are identical in two different addresses.. but i dont know what the address is.. and i dont know what that value is. i have a general area i can search (around 1000 in offset from the first portion of the area to the end)

and for clarification.. a way to clear it up like this:

80345630 60000000
80567348 84592480
81246784 60000000
81643028 89457002

and after the search it would leave only
80345630 60000000
81246784 60000000

as those are the only address with identical values, but if you do not know what the value is.. and the value is static, is there still something you can use to search for it? -clarification, it will pick up any address that has a the same value with another address in the same search, so its possible to have many different addresses with different searches.. so you could easily scan them to find a value you want to check.

thanks,
I R S

dcx2

If you use Gecko.NET you can sort search results by value and delete all the ones you know can't be valid results.

I imagine you're doing unknown searches.  Once you think you know what value you want, you can always save your unknown search and do a specific search, in your example search for 60000000 and it would get rid of everything else.

IRS

#2
Well my honest problem is.. i don't really know what is valid and what isn't im looking for a weapon ID in my game.. but i dont have a clue what it is.. all i know is its a 32 bit value..and within a range.. and im going to have to guess at at it i guess.. lol. ill check out gecko.NET real fast then and see if anything looks right.. thanks!

-edit-

that would be nice though if one of them had that function.. it would make some searches a lot easier.. another question.. what does flag search do? cant figure that out..

and could you give me a link for gecko.NET  i cant find it in the site.. or on google.. lol

found.. http://wiird.l0nk.org/forum/index.php/topic,4886.0.html

dcx2

If you know a range, you could do a specific search for greater than your min, and then do another specific search for less than your max.

There's a link to Gecko.NET in my signature.  There is a second link for any bug reports or feature requests.

Flag search looks for single binary changes in the value.  These generally correspond to certain events, like one of many doors being unlocked, and each door would be a bit.  You can't test for any specific value, because you don't know what order the doors are laid out in memory.  One door could be 0x80, the other could be 0x20, the third could be 0x40.  If you walk through each door in that order, the value goes from 0x80 to 0xA0 to 0xE0 - those are all 1 bit changes.  When there's a 1 bit change in the value, the flag search will see it.

IRS

Ok. if i find a use for that i will now know what it does at least ;) thanks!! lol