View Single Post
Dragokas
Veteran Member
Join Date: Nov 2017
Location: Ukraine on fire
Old 02-03-2022 , 11:53   Re: DHooks getting param
Reply With Quote #2

Set up dhook parameter type as "Address".
Then, read memory using LoadFromAddress.

I think, you'll need firstly to dereference pointer (4 bytes) to get access to class members.
Then, read memory at desired offset. Dereference array pointer to get access to its data.
Then read array the same way filling each index of char[].
To analyze memory you can use sm_ptr.
__________________
Expert of CMD/VBS/VB6. Malware analyst. L4D fun (Bloody Witch & FreeZone)
[My plugins] [My tools] [GitHub] [Articles] [HiJackThis+] [Donate]
Dragokas is offline