You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Feb 28, 2022. It is now read-only.
$FunOffset=$FixAddr+2 or setx $FunOffset,$FixAddr+2
/////////////////////////////// 2
explanation:
you have to know that there are 2 commands
mov : which is normal command from x64dbg system ,it will not handle any variable from this plugin.
and
movx : which is parallel command of mov but in this (first parameter will not analyzed, just the second one.) like this movx rax,$x , it mean its same mov just the second parameter can analyzed that all.
in this command (movx rax,$x) we didn't put like this {rax} , because as I told u , movx is modified command of mov , so movx at the end will executed mov command after analyzed the second parameter.
so with example will be like this :
movx eax ,{eax}
this will be proceed like this : plugin will analyzed second parameter which is {eax} =1
then command will be like this : mov eax,1 then it will executed .
I hope u got the process and this apply to all (parallel commands of x64dbg ).
in other hand you will note that movx is opposite of setx command , because setx get value
after analyzed then it assigned to the variable of AdvancedScript System.
note : in new version no need to use setx command u can write directly like this :
$FixAddr={eax} >>>which is >>> setx $FixAddr,{eax}
for the bug u mention can u share the script u have?
the command u have problem is
mov command So just replace it with movx to be able to fix it as I explain before.
and why u use ref.addr($i) ? if u get the result form findallmemx then it will assigned directly in array that
u defined .
so u can reach to all element of this array .
I think I miss some update of the ReadMe I will reupdate it soon with more samples.
Thanks for support and try
any question feel free to ask .
BR
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1.The grammar is complicated
The original grammar:
mov FixAddr,ref.addr(i)
Plug-in Syntax:
mov eax,ref.addr($i)
setx $FixAddr,{eax}
The original grammar:
mov FunOffset,[FixAddr+2]
Plug-in Syntax:
mov eax,[$FixAddr+2]
setx $FunOffset,{eax}
....
2.Grammar is getting Messier
//setx( Not belonging to C grammar )
setx and movx
//if( There is a big difference between C grammar )
if and cmp
3.By the way, BUG was discovered.
//Always the same value
The text was updated successfully, but these errors were encountered: