need help about translate DMA

[rikkuz]

==================================
code snippet from RendDX9.dll

FLD DWORD PTR DS:[ESI+30]<---
MOV DWORD PTR DS:[EAX],ECX
FSTP DWORD PTR DS:[EAX+4]

Basepointer-[[RendBase + 0x227660] + 0x8 + 0x30]
======== i get this from caliber1942========

i try to trace dma, and this is what i did
- renddx9.dll+0x227660 = 0x03FC7660 value at this address is 0x031887A4 (in hex edit A4 87 18 03)
then
- 0x031887A4+0x8 = 0x03F8A754 value at this address is 0x03DEB500 (in hex edit 00 B5 DE 03)
then
- 0x03DEB500+0x30 = 0x03DEB530 value at this address is 0x5E8BFFFF

rendbase+0x49B26 = 03DE9B26 is where the code is
FLD DWORD PTR DS:[ESI+30]<---

0x03DEB530 is address i get :tired:

can any tell me where did i wrong or to get to that address i have to do domething more.

Thank you

[Spontaneous]

Wow its been a while since I even thought about how to do this but if I remember correctly, this is how to get that.

First you find your main DMA address. Breakpoint it, which gets you to around the code with what you pasted above. You got the +30 part correct. Now what your wondering is how he got the x8. Well what you do is breakpoint the 2nd DMA. This will bring more code up and is where you get the x8. This can be done so one time and time again to get static dma pointers. It can be tricky tho cause sometimes the code that breakpoints will be more then just 1 number in the code.

Now I could be a little off cause I havent done such in over a year but thats how I remember it.

[rikkuz]

lol thank to you again. but i'm not get the picture yet but i'll try.

[Kosire]

http://pc.nanobot2k.org/Tutorials/eedok_pointers.txt

Thats the base idea, although for BF2 you will likely need to search down multiple pointers, breakpointing each one and then searching.

I don't actually like this method and prefer to just breakpoint on the first code address and then just trace/read the assembly code back up until i see where it loaded that pointer from.

It'll be something like mov [register], 0x[hard coded address]

[snipester]

DMA always pissed me off. It's just that much harder, I take my stuff directly from Opsearch and run it in OllyDebug.