How to find a file loaded in the memory ??

Discussion in 'Wii U - Hacking & Backup Loaders' started by NexoCube, Aug 22, 2016.

  1. NexoCube
    OP

    NexoCube stop using piracy :(

    Member
    1,184
    587
    Nov 3, 2015
    France
    Stack Pointer
    Hello,

    I've finally found how to hack Black Ops 2 and inject Mod Menu

    My goal isn't to destroy BullyWiiPlaza work, i respect him and i'm thankful to him for all the hints he gave me :) (Not too many, as expected xD)

    So, there's a file in the game that is used to do mod menu (.ff)

    But i need to know his position in the memory.

    So i'm asking tempers, if you know how to do :P

    I know that he's maybe between 0x40000000 and 0x50000000

    But i don't know where :/ Can someone help me ?
     
  2. Mega-Mew

    Mega-Mew GBAtemp Fan

    Member
    409
    649
    May 10, 2015
    France
    Just make a RAM dump then search the file with an hex editor
     
  3. NexoCube
    OP

    NexoCube stop using piracy :(

    Member
    1,184
    587
    Nov 3, 2015
    France
    Stack Pointer
    But .ff are encrypted, are they still encrypted once in RAM ?
     
  4. Mega-Mew

    Mega-Mew GBAtemp Fan

    Member
    409
    649
    May 10, 2015
    France
    I don't know how work this game, so I don't know
     
  5. NexoCube
    OP

    NexoCube stop using piracy :(

    Member
    1,184
    587
    Nov 3, 2015
    France
    Stack Pointer
    AND where games files are located in RAM ?
     
  6. Mega-Mew

    Mega-Mew GBAtemp Fan

    Member
    409
    649
    May 10, 2015
    France
    It's game specific
     
    NexoCube likes this.
  7. NexoCube
    OP

    NexoCube stop using piracy :(

    Member
    1,184
    587
    Nov 3, 2015
    France
    Stack Pointer
    Dumped 0x10000000 to 0x50000000

    And i found "vol/content/french/file_secret.ff"
    Then, how did i write into it ?
     
  8. victormr21

    victormr21 GBAtemp Advanced Fan

    Member
    552
    69
    Dec 29, 2015
    How we make a RAM dump? In TCPGecko only I can do a Memory dump, its the same? If not how can I do It?
    Bye!
     
  9. NexoCube
    OP

    NexoCube stop using piracy :(

    Member
    1,184
    587
    Nov 3, 2015
    France
    Stack Pointer
    It's the same thing