Created
September 6, 2021 19:25
-
-
Save jfmherokiller/62d9b2e1a91bc0e339a99751cdc3f372 to your computer and use it in GitHub Desktop.
frida Outer Worlds pdb usage examples
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DebugSymbol.load("D:\\SteamLibrary\\steamapps\\common\\TheOuterWorlds\\Indiana\\Binaries\\Win64\\Indiana-Win64-Shipping.exe"); | |
// Get engine Version | |
var FEngineVersion = DebugSymbol.findFunctionsMatching("FEngineVersion::Current")[0]; | |
var FEngineVersionFunc = new NativeFunction(FEngineVersion, 'uint64', []); | |
var VersionLocation = new NativePointer(FEngineVersionFunc.call()); | |
var versionBytes = VersionLocation.readByteArray(6); | |
hexdump(versionBytes); | |
// getgobjectsSunbeam | |
var GObjectsLocatedFunc = DebugSymbol.findFunctionsMatching("IncrementalPurgeGarbage")[0]; | |
var DesiredLEAInst = Instruction.parse(Instruction.parse(Instruction.parse(Instruction.parse(Instruction.parse(Instruction.parse(Instruction.parse(GObjectsLocatedFunc).next).next).next).next).next).next).next; | |
var LEAValDisp = DesiredLEAInst.add(3).readInt(); | |
var GObjectsLOc = DesiredLEAInst.add(LEAValDisp).add(7); | |
//getFnames | |
var FNameGetNames = DebugSymbol.findFunctionsMatching("FName::GetNames")[0]; | |
var FNameGetNamesFunc = new NativeFunction(FNameGetNames, 'uint64', []); | |
var FNamesStore = new NativePointer(FNameGetNamesFunc.call()); | |
//get commandline | |
var FCommandLineGet = DebugSymbol.findFunctionsMatching("FCommandLine::Get")[0]; | |
var FCommandLineGetFunc = new NativeFunction(FCommandLineGet, 'uint64', []); | |
var CommandsLineData = new NativePointer(FCommandLineGetFunc.call()); | |
//get ProjectDir | |
var FGenericPlatformMiscProjectDir = DebugSymbol.findFunctionsMatching("FGenericPlatformMisc::ProjectDir")[0]; | |
var FGenericPlatformMiscProjectDirFunc = new NativeFunction(FGenericPlatformMiscProjectDir, 'uint64', []); | |
var ProjectDirData = new NativePointer(FGenericPlatformMiscProjectDirFunc.call()); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment