Untitled
cpy r4, r0 cpy r10, r1 stmb sp!, {r4 ,r5 ,r6 ,r7 ,r8 ,r9 ,r10 ,r11 ,lr } sub sp, sp, #0xc str r0, [sp, #local_2c] cpy r8, t //ldr r4, [DAT_29083A91] #assuming + 4 //add r4, pc, r4 //cmp r4, #0x0 //... intialization checks here, but skipping since no space bl LAB_2908350D LAB_2908350D: ldr r0, [DAT_29083927] // string type intialization, might need to correct this offset, from here cmp r8, #0x0 ldr r0, [pc, r0] ldr r0, [r0, #0x5c] // to here ldr r11, [r0, #0x0] mov r0, #0x0 str r0, [sp, #8] beq LAB_29083555 //branch to thunk, don't wanna screw with this so I'll keep it, or maybe not, idk ldr r0,[DAT_29083ae5] //load string mov r2,#0x0 ldr r0,[pc,r0]=>PTR_DAT_0161570c //indirection to final string DAT ldr r1,[r0,#0x0]=>DAT_0164aa28 //they are ultimately the same cpy r0,r8 bl FUN_00e56650 //basic c# or unity func, replace appropriately cmp r0,#0x0 bne LAB_2908357d b LAB_29083739 LAB_29083555: bl thunk_FUN_005e1634 // find my equivalent, typically "NullReferenceException", aka crash on purpose //not asm, not data, padding? random machine code // starts at 006a4d74 originally, or +4 bytes last addr, at 29083559 in code cave /* 80 05 9f e5 00 20 a0 e3 00 00 9f e7 00 10 90 e5 00 00 a0 e3 30 c6 1e eb 00 00 50 e3 78 00 00 0a 17 33 fe eb */ LAB_2908357d: cpy r0,r8 mov r1,#0x7 mov r2,#0x0 bl FUN_00e5af38 //system.substring method cpy r4,r0 cmp r0,#0x0 bne LAB_2908359d //Success bl thunk_FUN_005e1634 LAB_2908359d: cpy r0,r4 mov r1,#0x20 mov r2,#0x0 mov r3,#0x0 bl FUN_00e59258 //system.string.split method cpy r4,r0 //string[] cmd_param = t.Substring(7).Split(' '); cmp r0,#0x0 bne LAB_290835c1 //Success bl thunk_FUN_005e1634 LAB_290835c1: ldr r0,[r4,#0xc] //r4 holds the string right now, 0xc is .__length of it stored into r0 cmp r0,#0x2 //if (cmd_param.Length == 2) bne LAB_29083719 // Length is not 2 ldr r0,[r4,#0x14] // From here... if (int.TryParse(cmd_param[1], out int cmd_health)) add r1,sp,#0x8 mov r2,#0x0 bl FUN_01006e14 //Int32.TryParse cmp r0,#0x0 // To here..? beq LAB_29083725 //ChatResponse = "Please use an integer"; ldr r0,[r4,#0xc] cmp r0,#0x0 bne LAB_290835f5 //Success bl thunk_FUN_005e1698 //diff thunk 1 LAB_290835f5: ldr r0,[DAT_29083ae9] //make me point directly to PhotonNetwork typeinfo ldr r0,[pc,r0]=>PTR_DAT_016156e4 //type info for PhotonNetwork ldr r10,[r4,#0x10] ldr r0,[r0,#0x0]=>DAT_0163fcb8 //once again ldr r1,[r0,#0x74]=>DAT_20004acb //thunk checks cmp r1,#0x0 bne LAB_29083615 //Success bl thunk_FUN_006642b4 //diff thunk 2 LAB_29083615: mov r0,#0x0 mov r6,#0x0 bl FUN_0113920c //PhotonNetwork.get_Playerlist cpy r5,r0 add r9,r0,#0x10 //| //v LAB_29083629: cmp r5,#0x0 bne LAB_29083635 //Success bl thunk_FUN_005e1634 LAB_29083635: ldr r0,[r5,#0xc] cmp r6,r0 bge LAB_29083731 //what's bge? cmp r0,r6 bhi LAB_2908364d //whats bhi? bl thunk_FUN_005e1698 //diff thunk 3 LAB_2908364d: ldr r4,[r9,r6,lsl #0x2] // PhotonPlayer cmp r4,#0x0 bne LAB_2908365d //Success bl thunk_FUN_005e1634 LAB_2908365d: cpy r0,r4 //prep PhotonPlayer into GetNickName arguements mov r1,#0x0 //Method info stuff? bl FUN_01127738 //Player.GetNickName cpy r1,r10 mov r2,#0x0 bl thunk_FUN_00e5623c //it says thunk, but really it means op_equality, player.NickName == cmd_nickName cmp r0,#0x0 beq LAB_29083705 // ChatResponse = "Player not found"; ldr r0,[sp,#0x4] ldr r7,[r0,#0x18] ldr r0,[DAT_29083aed] //ldr r0, [0x556108] From here, typeinfo intialization for Vector3 add r0=>DAT_0169bae2,pc,r0 //interim, im equal to add r5, pc, r5 ldrb r0,[r0,#0x0]=>DAT_0169bae2 //ldrb __this,[r5,#0x0]=>DAT_01fa19d9 == ldrb r0, [r0, #0x0] To here cmp r0,#0x0 bne LAB_290836b5 //Success, its intialized ldr r0,[DAT_29083af1] //past this point means its not, i wont bother with this ldr r0=>DAT_01640748,[pc,r0]=>PTR_DAT_01615724 bl FUN_0063177c ldr r0,[DAT_29083af5] mov r1,#0x1 add r0=>DAT_0169bae2,pc,r0 strb r1,[r0,#0x0]=>DAT_0169bae2 // 268 equivalent of line 141's Vector3 shenanigans /* if (DAT_01fa19d9 == '\0') { thunk_FUN_003aafa4(&UnityEngine.Vector3_TypeInfo); DAT_01fa19d9 = '\x01'; } */ LAB_290836b5: cmp r7,#0x0 bne LAB_290836c1 bl thunk_FUN_005e1634 //thunk 5 LAB_290836c1: cmp r4,#0x0 bne LAB_290836cd bl thunk_FUN_005e1634 LAB_290836cd: cpy r0,r4 mov r1,#0x0 bl FUN_01127738 undefined FUN_01127738() cpy r1,r0 ldr r0,[DAT_29083af9] = 00F70810h mov r3,#0x0 ldr r0,[pc,r0]=>PTR_DAT_01615718 = 0164af1c ldr r0,[r0,#0x0]=>DAT_0164af1c = A0000847h ldr r2,[DAT_29083afd] = 00F70800h ldr r2,[pc,r2]=>PTR_DAT_01615714 = 0164ae2c ldr r2,[r2,#0x0]=>DAT_0164ae2c = A00007CFh bl FUN_00e56c00 undefined FUN_00e56c00() cpy r11,r0 b LAB_29083711 //b vs bl? LAB_29083705: ldr r0,[DAT_29083b01] = 00F707F0h ldr r0,[pc,r0]=>PTR_DAT_0161571c = 0164d7fc ldr r11,[r0,#0x0]=>DAT_0164d7fc LAB_29083711: add r6,r6,#0x1 b LAB_29083629 LAB_29083719: ldr r0,[DAT_29083b09] = 00F707B8h ldr r0,[pc,r0]=>PTR_DAT_016156f8 = 0164ca08 b LAB_2908372d LAB_29083725: ldr r0,[DAT_29083b05] = 00F707BCh ldr r0,[pc,r0]=>PTR_DAT_01615708 LAB_2908372d: ldr r11,[r0,#0x0]=>DAT_0164d81c LAB_29083731: cmp r8,#0x0 beq LAB_2908375d LAB_29083739: ldr r0,[DAT_29083b0d] = 00F7078Ch mov r2,#0x0 ldr r0,[pc,r0]=>PTR_DAT_016156f0 = 0164aa2c ldr r1,[r0,#0x0]=>DAT_0164aa2c = A00005CFh cpy r0,r8 bl FUN_00e56650 undefined FUN_00e56650() cmp r0,#0x0 bne LAB_29083785 b LAB_29083819 LAB_2908375d: bl thunk_FUN_005e1634 /* the "padding" from earlier ac 03 9f e5 00 20 a0 e3 00 00 9f e7 00 10 90 e5 08 00 a0 e1 ae c5 1e eb 00 00 50 e3 2e 00 00 0a 95 32 fe eb */ LAB_29083785:
Leave a Comment