<Matti> but I don't see how anyone could be so lazy as to answer 'idk' to a question someone asks you because they're trying to help you
<Matti> namely is that the same version as the latest on the site
<Matti> I've had this problem before where I couldn't tell if someone was simply lazy/stupid or an actual bot
<Matti> this AI thing is getting out of hand
<mrexodia> I banned that user and deleted the issue (re @mrfearless: should charge the amount of bitcoin it would cost to buy the product for #2797 - lol)
<mrfearless> concur
<mrfearless> looks like very specialized software anyhow
<mrfearless> requiring hardware keys and licenses
<mrfearless> I imagine you could do it in a plugin, have breakpoints on VirtualAlloc - either manually or from the plugin itself perhaps. Then when breakpoint is triggered, plugin can check if it was for VirtualAlloc call, (determine length of alloc and store that) then it can single step, collect the value in eax, check its not null, then dump to file based on debuggee name + concat of "_dump"+ dumpNo for the length of the alloc
<exploit1337> Thx , the issue is that there are about 200+ calls of virtualalloc and I need at least to check them at dump view to see the headers that interests me (re @mrfearless: https://twitter.com/IntezerLabs/status/1467842258653245445?s=20)
<exploit1337> Only constants are shown
<Gdhkeix> Hi all!
Im facing some problem on arm based Win11 with x64 emulation. For example if im injecting simple code to x64 process like
int 3
mov rbp, 0x11223344
nop
so when i hit first bp and step then mov instruction i see 0x11223344 in rbp, but when i step to nop rbp becomes zero (rbp == 0)!!! Is it binary translation bug?
Thnx in advance
Im facing some problem on arm based Win11 with x64 emulation. For example if im injecting simple code to x64 process like
int 3
mov rbp, 0x11223344
nop
so when i hit first bp and step then mov instruction i see 0x11223344 in rbp, but when i step to nop rbp becomes zero (rbp == 0)!!! Is it binary translation bug?
Thnx in advance
<Dimy> Hello guys, I feel like I'm missing something dumb but how can I log an adress relative to the module's base adresse ?
I tried the following but it only gives me some "???" in the log when opened with a text editor
https://cdn.discordapp.com/attachments/360907625837101067/917792764148727839/unknown.png
I tried the following but it only gives me some "???" in the log when opened with a text editor
https://cdn.discordapp.com/attachments/360907625837101067/917792764148727839/unknown.png
<Dimy> My best attempt so far is
https://cdn.discordapp.com/attachments/360907625837101067/917799881941332018/unknown.png
https://cdn.discordapp.com/attachments/360907625837101067/917799881941332018/unknown.png
<Dimy> I tried to put the whole expression between{} so it gets evaluated but it doesn't work unfortunately, I'm probably missing something dumb
<Dimy> Ok I'm dumb, it was simply
https://cdn.discordapp.com/attachments/360907625837101067/917804284555436052/unknown.png
https://cdn.discordapp.com/attachments/360907625837101067/917804284555436052/unknown.png
<Rainb0wCodes_484> such as Minecraft.Windows.exe
<Rainb0wCodes_484> only the applicationframehost is there
<Rainb0wCodes_484> i am running as administrator
<mrexodia> program:0 is already the base
<mrexodia> but yeah looks like a bug
<lpcvoid> You can't
<Diacaprio> Any other options
<mrexodia> Read the rules
<c0rt3x0> Yes sorry my mistacke
<kaens> Compilers optimise; that alone makes it impossible to get the exact source, not to mention all the formatting and comments which are sometimes http://uguu.org/sources.html :)
<kaens> @Yakov5776
<Yakov5776> Oh I know
<kaens> I'd say if the goal is to "extract the source" that's nothing but fun... If you wanna analyse or patch, you can analyse or patch assembly and binary
<big steppa> but it works with other files i tried on a dll but havent tried on another exe though