How To locate Nativ...
 
Notifications
Clear all

How To locate Native functions " Step by Step "

Page 1 / 3

KranK
Posts: 336
Topic starter
(@KranK)
Reputable Member
Joined: 9 years ago

Hey RG in this tutorial I will show you how alocate natives function .

Note: this tutorial focused on GTA 5 , however this will work in Any Rage (RockStar Advanced Gaming Engine) Based game.

Let's get to the tutorial

1. Open IDA

2. Open Last GTA V .elf

3. Click Alt+B

4. its the most tricky part ( we need the value of 'lis %r3' ) that = 3C60 , and we need 2 first bytes of any native hash ill take example with GET_PLAYER_PED = 0x6E31E993

5. so in that case it will be 3C606E31 , so we enter that in the string box and check the checkbox "find all occurences" than click ok

6. now it will take some time until you get the result usual there is only one result but if there if few make sure to chose one that much the actual native hash you searching for and than double click it .
it will look something like

seg001:00424100 sub_4240F4 lis       r3, 0x6E31 # 0x6E31E993

7.after you duble click it you will see

seg001:00424100                 lis       r3, 0x6E31 # 0x6E31E993
	seg001:00424104                 lis       r4, ((off_1B9B2D8+0x10000)@h)

Depends on what native you search but you got the idea

8. now you have to click on (off_XXXXXXX) in that case its the (off_1B9B2D8) !

9. and it will bring you here

seg021:01B9B2D8 off_1B9B2D8:    .long loc_1525450       # DATA XREF: sub_4240F4+10*o

you have to click the (loc_XXXXXXX) in that case its the (loc_1525450) !

10. and you will see something like that

seg001:01525450 loc_1525450:                            # DATA XREF: seg021:off_1B9B2D8*o
	seg001:01525450                 mflr      r0
	seg001:01525454                 bl        sub_1776544
	seg001:01525458                 stdu      r1, -0x80(r1)
	seg001:0152545C                 std       r0, 0x90(r1)
	seg001:01525460                 mr        r31, r3
	seg001:01525464                 lwz       r3, 8(r31)
	seg001:01525468                 lwz       r3, 0(r3)
	seg001:0152546C                 extsw     r3, r3
	seg001:01525470                 bl        sub_41EEF0
	seg001:01525474                 lwz       r4, 0(r31)
	seg001:01525478                 stw       r3, 0(r4)
	seg001:0152547C                 addi      r1, r1, 0x80
	seg001:01525480                 b         loc_17765A8

and here we go the second (bl sub_XXXXXX) is our native function in this case its (bl sub_41EEF0)

Hope that it helps !

Reply
Name of the Video Game, and any other Tags
10 Replies
Cyb3r
Posts: 1598
(@cyb3r)
Noble Member
Joined: 10 years ago

This is awesome dude. Keep it up!

Reply
Cain532
Posts: 1280
(@cain532)
Noble Member
Joined: 10 years ago

Love it, thanks for this tut Krank!

Reply
KranK
Posts: 336
Topic starter
(@KranK)
Reputable Member
Joined: 9 years ago

This is awesome dude. Keep it up!

Love it, thanks for this tut Krank!

Thanks guys 😀

Reply
Nullerdk
Posts: 28
(@Nullerdk)
Eminent Member
Joined: 9 years ago

nice sir thanks for tut

Reply
Page 1 / 3