Getting save register addresses

Open TheNotZen364 opened this issue 9 months ago • 3 comments

Hi all, I'm slightly confused on if I'm doing address's correctly.

I found the byte pattern for 1 of the registry things but I'm not sure if I need to do something else, does this mean 0X82719050 is the address or is it something different?

Mar 06 '25 13:03 TheNotZen364

That looks correct.

Mar 06 '25 15:03 blueskythlikesclouds

are you using something like ida pro or ghidra? i cant find any of this in a decrypted binary in hxd.

Mar 07 '25 00:03 GriffinFire

Its a ghidra plugin it comes up if you search for it

Mar 07 '25 00:03 TheNotZen364