{"action":"created","issue":{"url":"https://api.github.com/repos/erfg12/memory.dll/issues/28","repository_url":"https://api.github.com/repos/erfg12/memory.dll","labels_url":"https://api.github.com/repos/erfg12/memory.dll/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/erfg12/memory.dll/issues/28/comments","events_url":"https://api.github.com/repos/erfg12/memory.dll/issues/28/events","html_url":"https://github.com/erfg12/memory.dll/issues/28","id":328817576,"node_id":"MDU6SXNzdWUzMjg4MTc1NzY=","number":28,"title":"Memory allocation","user":{"login":"Frank569","id":39875870,"node_id":"MDQ6VXNlcjM5ODc1ODcw","avatar_url":"https://avatars3.githubusercontent.com/u/39875870?v=4","gravatar_id":"","url":"https://api.github.com/users/Frank569","html_url":"https://github.com/Frank569","followers_url":"https://api.github.com/users/Frank569/followers","following_url":"https://api.github.com/users/Frank569/following{/other_user}","gists_url":"https://api.github.com/users/Frank569/gists{/gist_id}","starred_url":"https://api.github.com/users/Frank569/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Frank569/subscriptions","organizations_url":"https://api.github.com/users/Frank569/orgs","repos_url":"https://api.github.com/users/Frank569/repos","events_url":"https://api.github.com/users/Frank569/events{/privacy}","received_events_url":"https://api.github.com/users/Frank569/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":6,"created_at":"2018-06-03T10:36:06Z","updated_at":"2018-06-24T12:44:15Z","closed_at":null,"author_association":"NONE","body":"Hello,\r\n\r\nI already wanted to congratulate you for your project which allowed me to understand how to create a trainer.\r\n\r\nI allow myself to contact you because I am developing a Trainer for the game Dying Light Enhanced Edition and I am stuck in my development because I can not allocate memory in the process.\r\n\r\nBelow is the way I proceed to work on modifying the memory.\r\n\r\nI start by looking in memory, HEX values F3 0F 11 83 54 09 00 00 40\r\n\r\n```\r\n// Variable\r\nprivate Task<long> ResultatOneKill = null;\r\nprivate Mem m = new Mem();\r\n\r\nResultatOneKill = m.AoBScan(\"0x700000000000\", 0x7FFFFFFFFFFF, \"F3 0F 11 83 54 09 00 00 40\");\r\nif (ResultatOneKill.Result > 0)\r\n{\r\n    // Convertion of the value of ResultatOneKill.Result in usable address for m.writeMemory ( a value of type long => (140717704298565) to a value string => (0x7FFB64C74045)\r\n\r\n    string sAdresse = String.Format(\"{0:X2}\", ResultatOneKill.Result);\r\n    if (chkInfiniteHealth.Checked)\r\n    {\r\n         // Modification of the memory values ​​to the address indicated in the sAddress variable.\r\n         m.WriteMemory(sAdresse, \"bytes\", \"0x2F 0xF0 0x76 0x2B 0x41 0x0F 0x28 0xC0 0xEB 0x28 0x48 0x8D 0xBB 0x38 0xF7 0xFF 0xFF 0x83 0xCA 0xFF 0x48 0x8B 0x07 0x48 0x8B 0xCF 0xFF 0x90 0x48 0x01 0x00 0x00 0x90 0x90 0x90 0x73 0x05 0x0F 0x28 0xC7 0xEB 0x08 0x0F 0x2F 0xF0 0x72\");\r\n    }\r\n    else\r\n    {\r\n       m.WriteMemory(sAdresse, \"bytes\", \"0x2F 0xF0 0x76 0x2B 0x41 0x0F 0x28 0xC0 0xEB 0x28 0x48 0x8D 0xBB 0x38 0xF7 0xFF 0xFF 0x83 0xCA 0xFF 0x48 0x8B 0x07 0x48 0x8B 0xCF 0xFF 0x90 0x48 0x01 0x00 0x00 0x0F 0x2F 0xF7 0x73 0x05 0x0F 0x28 0xC7 0xEB 0x08 0x0F 0x2F 0xF0 0x77\");\r\n    }\r\n}\r\nelse\r\n{\r\n    MessageBox.Show(\"Erreur, plage mémoire non trouvée\", \"Erreur\", MessageBoxButtons.OK, MessageBoxIcon.Error);\r\n}\r\n\r\n```\r\n\r\nWhen I do the test with Cheat Engine, I see that it changes memory area ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? replace it with this C7 83 54 09 00 00 00 00 C8 42 E9 C0 7C 63 02 90 90 90 90 90 90 90 90 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\r\n\r\nAnd that's what I can not do in my program.\r\nI copy you below the content of the script Cheat Engine in case it allows you to better understand my problem.\r\n\r\n```\r\n[Enable]\r\n\r\nalloc(ih_1,128,gamedll_x64_rwdi.dll) //Infinite Health\r\naobscanmodule(ih_aob1,gamedll_x64_rwdi.dll,F3 0F 11 83 54 09 00 00 40)\r\nregistersymbol(ih_aob1)\r\nlabel(returnhere_ih_1)\r\n\r\n//Infinite Health - 2nd Compare\r\naobscanmodule(ih_aob2,gamedll_x64_rwdi.dll,FF 90 48 01 00 00 0F 2F F7)\r\nregistersymbol(ih_aob2)\r\n\r\n//--------------------------------------------------//\r\nih_1:\r\nmov [rbx+00000954],(float)100\r\njmp returnhere_ih_1\r\n//--------------------------------------------------//\r\n\r\nih_aob1:\r\njmp ih_1\r\nnop\r\nnop\r\nnop\r\nreturnhere_ih_1:\r\n\r\nih_aob1-B:\r\ndb 72 03\r\n\r\nih_aob2+6:\r\ndb 90 90 90\r\n\r\n[Disable]\r\n\r\nih_aob1:\r\ndb F3 0F 11 83 54 09 00 00\r\nunregistersymbol(ih_aob1)\r\ndealloc(ih_1)\r\n\r\nih_aob1-B:\r\ndb 77 03\r\n\r\nih_aob2+6:\r\ndb 0F 2F F7\r\nunregistersymbol(ih_aob2)\r\n```\r\n\r\n\r\nThank you in advance for your help\r\n\r\nRegards,\r\n\r\n\r\n\r\nFrank\r\n\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/erfg12/memory.dll/issues/comments/399754057","html_url":"https://github.com/erfg12/memory.dll/issues/28#issuecomment-399754057","issue_url":"https://api.github.com/repos/erfg12/memory.dll/issues/28","id":399754057,"node_id":"MDEyOklzc3VlQ29tbWVudDM5OTc1NDA1Nw==","user":{"login":"hollow87","id":216605,"node_id":"MDQ6VXNlcjIxNjYwNQ==","avatar_url":"https://avatars0.githubusercontent.com/u/216605?v=4","gravatar_id":"","url":"https://api.github.com/users/hollow87","html_url":"https://github.com/hollow87","followers_url":"https://api.github.com/users/hollow87/followers","following_url":"https://api.github.com/users/hollow87/following{/other_user}","gists_url":"https://api.github.com/users/hollow87/gists{/gist_id}","starred_url":"https://api.github.com/users/hollow87/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hollow87/subscriptions","organizations_url":"https://api.github.com/users/hollow87/orgs","repos_url":"https://api.github.com/users/hollow87/repos","events_url":"https://api.github.com/users/hollow87/events{/privacy}","received_events_url":"https://api.github.com/users/hollow87/received_events","type":"User","site_admin":false},"created_at":"2018-06-24T12:44:15Z","updated_at":"2018-06-24T12:44:15Z","author_association":"CONTRIBUTOR","body":"Use CheatEngine and look at the address `ad` use the auto assembler option at the address `ad` How many bytes does it replace? (minimum of 5 as that's whats needed for the 0xE9 jump to the code cave) That's the 3rd parameter.  The 4th parameter if you don't know what you should provide just use the default."}}
{"actor":{"display_login":"hollow87"}}