Page 1 of 1

Where are the RAX values ?

Posted: Sun May 15, 2022 4:10 pm
by Kevin_DA
Hello, I would like to know where the RAX values are stored in the memory value?
Because for example I would like to modify only the first pass of the execution.

Re: Where are the RAX values ?

Posted: Sun May 15, 2022 7:45 pm
by Kevin_DA
In fact what I am trying to do is to modify the rax value: 0000000000000000
Without using a hardware break point.
And also without changing the line: [r9-04],ax

How to do it ?

Image

Re: Where are the RAX values ?

Posted: Sun May 15, 2022 9:24 pm
by SunBeam
^ It's cool and dandy that you've blurred out the left-hand side of the picture, but you forgot the stack (bottom-right) and top banner where we can clearly see your game name: WWE2K22_x64.exe. Therefore don't get the reason for the blur.

As for your inquiry, please learn a bit of assembler.

To anyone else (from this forum or OCD): if my suggestion is useless, then please take your time and give a better one. Let's see how you get the user to understand how to debug the game and deduce where AX comes from, in a way so that he understands without asking additional questions. On your own time. Then call me names or say I was rude. I know why I'm writing this, as there are some fuckwads just waiting to twist my words or use them to prove the world how bad of a person I am... when all in all I am saying "take the time to learn and you'll get the answer to your question".

Re: Where are the RAX values ?

Posted: Sun May 15, 2022 9:25 pm
by Toga
Kevin_DA wrote:
Sun May 15, 2022 7:45 pm
In fact what I am trying to do is to modify the rax value: 0000000000000000
Without using a hardware break point.
And also without changing the line: [r9-04],ax

How to do it ?

Image
By Injection
ie:
press <CTRL>a on that code line
then press <CTRL><SHIFT>a to create an injection point
then modify AX ( not RAX ) to something you like ( and something that will fit in a WORD )
ie:
mov AX , 01 // AX = 2 bytes )

ps. you don't even have to save AX (2 bytes) because it's not used later ( movzx eax, byte ptr [rcx+1a] )


-edit-- oh lol i didn't see you've got an answer from SunBeam already whilest typing this... /blush

Re: Where are the RAX values ?

Posted: Sun May 15, 2022 9:36 pm
by SunBeam
Toga wrote:
Sun May 15, 2022 9:25 pm
then modify AX ( not RAX ) to something you like ( and something that will fit in a WORD )
Is there a reason you're telling him to modify AX and not RAX? Is it just cuz you saw the instruction using "ax"?

Re: Where are the RAX values ?

Posted: Sun May 15, 2022 9:41 pm
by Toga
SunBeam wrote:
Sun May 15, 2022 9:36 pm
Toga wrote:
Sun May 15, 2022 9:25 pm
then modify AX ( not RAX ) to something you like ( and something that will fit in a WORD )
Is there a reason you're telling him to modify AX and not RAX? Is it just cuz you saw the instruction using "ax"?
yes because from what i've got from the screenshot that part is only using a 32 bits EAX and it's lower bits parts,
so there's no reason changing a 64 bit register.

-edit-
all in all it's a bit unclear to me what the op wants to achieve
does he wants to change the 2 bytes where [r9+04] is pointing to?
or change the 4 bytes... use EAX or mov DWORD PTR [r9+04], ff .
And why does the op won't touch the [r9+04], ax
whilest EAX is overwritten next anyway