Offset Changed After Update — How Should I Access/Write Now,HELP?

Hey, how are you?

I'm trying to update my norecoil after a recent patch, but I'm not sure if I'm handling the new offset correctly.

Background:
Previously, I used the address (base + offsetClient) as a pointer to a struct, like this:

Code:

DWORD_PTR baseAddr = NULL;
 
const uintptr_t offsetClient = 0x3298DF0; ///44 88 3D ? ? ? ? 44 89 3D ? ? ? ? 4C 89 3D ? ? ? ? 44 88 3D ? ? ? ? 4C 89 3D ? ? ? ? for the struct
const uintptr_t offsetRecoil1 = 0x668;    // C7 83 ? ? ? ? ? ? ? ? C7 83 ? ? ? ? ? ? ? ? FF 90 ? ? ? ? F3 0F 10 93 ? ? ? ? 0F 57 F6 0F 2F F2 
const uintptr_t offsetRecoil3 = 0x0EF8;
 
void applyRecoil(void)
{
    DWORD64 clientAddr = *(DWORD64*)(baseAddr + offsetClient);
 
    if (clientAddr != NULL)
    {
        *(DWORD64*)(clientAddr + offsetRecoil1) = (DWORD64)-1;
        *(DWORD64*)(clientAddr + offsetRecoil3) = (DWORD64)0;
    }
}

But now, after the update, in IDA I see that byte_13298DF0 is just a byte, not a pointer or struct, and I'm not sure if it's just a flag or if the structure/pointer has moved.

My question:
Should I still treat this offset as a pointer to a struct (read the pointer at (base + offset), then use sub-offsets)?
Or is it now just a simple flag/byte, so I should write to it directly (like *(BYTE*)(base + offset) = 1?

I already tried to handle it like before (as a pointer), but it’s not working and I'm getting crash/report errors.

Could you please take a look and let me know the correct way to access/manipulate this address after the update? If you need a screenshot or a dump, I can send it.

Thanks a lot!

Offset Changed After Update — How Should I Access/Write Now,HELP?

Post a Reply

Similar Threads

Tags for this Thread