So I am just going to give an example
FlashDuration is here:
Code:
567A6AD6 C705 784BF25A 38>MOV DWORD PTR DS:[5AF24B78],client.56CE8>; ASCII "m_flFlashDuration"
567A6AE0 C705 A44BF25A A8>MOV DWORD PTR DS:[5AF24BA4],1DA8
567A6AEA C705 7C4BF25A 01>MOV DWORD PTR DS:[5AF24B7C],1
567A6AF4 C705 804BF25A 00>MOV DWORD PTR DS:[5AF24B80],0
567A6AFE C705 984BF25A 20>MOV DWORD PTR DS:[5AF24B98],client.567A4>
567A6B08 E8 6360EFFF CALL client.5669CB70
567A6B0D B9 F04BF25A MOV ECX,client.5AF24BF0
So the offset is 0x1DA8
FlashDuration is client.dll + LocalPlayer + 0x1DA8
but how can you retrieve LocalPlayer if you only know where the offset is?
So we are on this location in Olly, at the place of flashduration, we see that it is an adress + the offset, but how can we 'reverse' this so that we know to WHAT adress it is adding 0x1DA8?
I hope you understand my problem, because I can't find the adress anywhere in Olly from this location
Code:
567A6A90 E8 DB60EFFF CALL client.5669CB70
567A6A95 B9 784BF25A MOV ECX,client.5AF24B78
567A6A9A C705 3C4BF25A 4C>MOV DWORD PTR DS:[5AF24B3C],client.56CE8>; ASCII "m_bHasHelmet"
567A6AA4 C705 684BF25A 98>MOV DWORD PTR DS:[5AF24B68],2398
567A6AAE C705 404BF25A 00>MOV DWORD PTR DS:[5AF24B40],0
567A6AB8 C705 444BF25A 00>MOV DWORD PTR DS:[5AF24B44],0
567A6AC2 C705 5C4BF25A 90>MOV DWORD PTR DS:[5AF24B5C],client.5669C>
567A6ACC E8 9F60EFFF CALL client.5669CB70
567A6AD1 B9 B44BF25A MOV ECX,client.5AF24BB4
567A6AD6 C705 784BF25A 38>MOV DWORD PTR DS:[5AF24B78],client.56CE8>; ASCII "m_flFlashDuration"
567A6AE0 C705 A44BF25A A8>MOV DWORD PTR DS:[5AF24BA4],1DA8
567A6AEA C705 7C4BF25A 01>MOV DWORD PTR DS:[5AF24B7C],1
567A6AF4 C705 804BF25A 00>MOV DWORD PTR DS:[5AF24B80],0
567A6AFE C705 984BF25A 20>MOV DWORD PTR DS:[5AF24B98],client.567A4>
567A6B08 E8 6360EFFF CALL client.5669CB70
567A6B0D B9 F04BF25A MOV ECX,client.5AF24BF0
567A6B12 C705 B44BF25A 24>MOV DWORD PTR DS:[5AF24BB4],client.56CE8>; ASCII "m_flFlashMaxAlpha"
567A6B1C C705 E04BF25A A4>MOV DWORD PTR DS:[5AF24BE0],1DA4
567A6B26 C705 B84BF25A 01>MOV DWORD PTR DS:[5AF24BB8],1
567A6B30 C705 BC4BF25A 00>MOV DWORD PTR DS:[5AF24BBC],0
567A6B3A C705 D44BF25A 60>MOV DWORD PTR DS:[5AF24BD4],client.5669C>
567A6B44 E8 2760EFFF CALL client.5669CB70
567A6B49 B9 2C4CF25A MOV ECX,client.5AF24C2C
567A6B4E C705 F04BF25A A0>MOV DWORD PTR DS:[5AF24BF0],client.56CE8>; ASCII "m_iProgressBarDuration"
567A6B58 C705 1C4CF25A 50>MOV DWORD PTR DS:[5AF24C1C],1D50
567A6B62 C705 F44BF25A 00>MOV DWORD PTR DS:[5AF24BF4],0
567A6B6C C705 F84BF25A 00>MOV DWORD PTR DS:[5AF24BF8],0
567A6B76 C705 104CF25A 60>MOV DWORD PTR DS:[5AF24C10],client.5669C>
567A6B80 E8 EB5FEFFF CALL client.5669CB70
I am learning c++ and asm so try to make the explenation understadable for me.
19 