Here are four search patterns that find this vector. They are written to use my homebrewed search function. All four patterns feel a little fragile to me, which is why I found so many. If you go this route, I suggest doing all of the patterns, throwing out any zero results, and then comparing all of the remaining results to verify that they point to the same location.
code:
// no good way to find this vector, so here's 4 patterns, run them all,
// throw out any where d was 0, check that all the results are the same.
//C7 87 40 02 00 00 04 00+ mov dword ptr [edi+240h], 4
//8B 0D 14 1F 46 01 mov ecx, metal_tokens_vector.start
d = hexsearch(4+4,
DWORD_, 0x00000240, DWORD_, 0x00000004,
0x8B, ANYBYTE, HERE, ADDRESS);
metal_tokens_vector_loc = peekd(d) - 4;
dump(metal_tokens_vector_loc);
// doesn't work in .32a
//C7 40 04 E2 00 00 00 mov dword ptr [eax+4], 0E2h
//0F 84 5B 2F 00 00 jz loc_4EE328
//8B 0D 14 1F 46 01 mov ecx, metal_tokens_vector.start
d = hexsearch(5+1+4,
0xC7, ANYBYTE, 0x04, DWORD_, 0x000000E2,
JZ,
0x8B, ANYBYTE, HERE, ADDRESS);
metal_tokens_vector_loc = peekd(d) - 4;
dump(metal_tokens_vector_loc);
//8D B7 48 02 00 00 lea esi, [edi+248h]
//E8 74 D1 EF FF call sub_408B20
//8B 15 14 1F 46 01 mov edx, metal_tokens_vector.start
// there were also variants using 0x1A8, 0x1E8, 0x348
d = hexsearch(4+1+4,
0x8D, ANYBYTE, DWORD_, 0x00000248,
CALL,
0x8B, ANYBYTE, HERE, ADDRESS);
metal_tokens_vector_loc = peekd(d) - 4;
dump(metal_tokens_vector_loc);
//A1 18 1F 46 01 mov eax, metal_tokens_vector.end
//2B C1 sub eax, ecx
//C1 F8 02 sar eax, 2
//8D 9E 68 03 00 00 lea ebx, [esi+368h]
d = hexsearch(3+2+3+4,
0xA1, HERE, ADDRESS,
0x2B, 0xC1,
0xC1, 0xF8, 0x02,
0x8D, ANYBYTE, DWORD_, 0x00000368);
metal_tokens_vector_loc = peekd(d) - 8;
dump(metal_tokens_vector_loc);
Author
Topic: Identifying materials (Read 1373 times)