Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[Moriabbey]

I'm working on some dwarf fortress memory hacking for a college programming class, and I need some help on memory addresses.

The documentation for DFHack says that there's a file with absolute memory addresses of DF objects that it uses for memory access. It doesn't actually name the file, but it seems like the only file in DFHack with absolute memory addresses is symbols.xml, so it seems like that must be the one, but when I start dwarf fortress and check the addresses in a memory hacking tool, most of them seem to be unused. So what gives? Do I have the wrong file? Are these actually relative and not absolute addresses? If anyone knows what's going on and could explain, it would be much appreciated.

[Warmist]

You are correct: symbols.xml has the absolute memory addresses. However in that file usually there are multiple DF versions for multiple platforms. Also depending on what OS you are doing that (hint-windows) the absolute address gets relocated due to ASLR .

Usually hacking tools have a way to get module address and then it's <address from symbols.xml> -0x40000 (default windows image base)+<dwarffortress.exe module offset>

[Moriabbey]

How do I find out what the module offset for Dwarf Fortress is?

Also, what do you mean when you say "image base?"

[Quietust]

How do I find out what the module offset for Dwarf Fortress is?

If you're writing a DFHack plugin, you don't need to know - DFHack figures it out for you and does all of the necessary adjustments for you.
If you're writing a 3rd-party application that connects to Dwarf Fortress from outside (e.g. like Dwarf Therapist does), this should give you enough information.

Also, what do you mean when you say "image base?"

"ImageBase" is one of the fields in the EXE/DLL file format header which tells Windows what the program's "preferred" base address is - if the program was compiled with Relocation support (guaranteed for DLLs, though not guaranteed for older EXEs), then Windows can feel free to load it at a different address chosen at random (a technique known as Address space layout randomization, or ASLR).

The default ImageBase for a 32-bit Windows application is 0x00400000, while the default ImageBase for a 64-bit Windows application is 0x0000000140000000, and all of the values in DFHack's "symbols.xml" file are the addresses you would see if Dwarf Fortress were to load at the default location.

[Moriabbey]

If you're writing a DFHack plugin, you don't need to know - DFHack figures it out for you and does all of the necessary adjustments for you.
If you're writing a 3rd-party application that connects to Dwarf Fortress from outside (e.g. like Dwarf Therapist does), this should give you enough information.

I'm not actually trying to write anything- all I'm really trying to do is use a memory editor to do some super basic memory hacking.

"ImageBase" is one of the fields in the EXE/DLL file format header which tells Windows what the program's "preferred" base address is - if the program was compiled with Relocation support (guaranteed for DLLs, though not guaranteed for older EXEs), then Windows can feel free to load it at a different address chosen at random (a technique known as Address space layout randomization, or ASLR).

The default ImageBase for a 32-bit Windows application is 0x00400000, while the default ImageBase for a 64-bit Windows application is 0x0000000140000000, and all of the values in DFHack's "symbols.xml" file are the addresses you would see if Dwarf Fortress were to load at the default location.

Two things- first off (I'm sorry that this is kind of a dumb question) I'm having a lot of trouble looking at the .exe header. I've found the dumpbin exe, but I can't figure out how to use it- do I run it from the command line somehow?

Second, if I do find the image base, how does that help with ASLR? It seems like finding the 'default' address for the program wouldn't help me much if Windows can just load it at a random address anyway.