Çözüldü Fortnite CR3 & EXTERNAL

hern0s' Alıntı:

There is several ways to accomplish this.

Walk through PFN database, physical address range and compare PFN PTE frame with the physical address shifted by 12 bits (<<12) If they are equal it means you found self referenced pml4 and can be sure that that's a pml4 base.

With the physical address you found try to read an address you sure it's %100 present in game's virtual address context, for example game base address, compare it with the PE and DOS signature, If they are match congratulations you found page directory base they use. If they don't match, continue your loop and seek for next match untill you find one.

This method called brute forcing.

Btw self reference method doesn't work everytime, for example on battlefield's EAAC but I'm sure it works for EAC.

Genişletmek için tıkla ...

Trydos12' Alıntı:

I will try to do it, but when I modified cr3 I got a bluescreen


EAC has not been updated in Apex, I checked it

Mainly probably just RUST and Fortnite

Genişletmek için tıkla ...

hern0s' Alıntı:

You don't need to modify it for example don't __writecr3(), you resolve their pdb with the method I said above and then use it for your physical read/write.

Genişletmek için tıkla ...