Hex Editor Offset -> MySEQ offset?

[coloradoderek]

Good Morning.
I was just wondering if anyone could tell me how to convert an offset from a Hex Editor to a MySEQ offset.

An Example would be:
In the Hex Editor, it shows the offset as 0099CAB1, but the MySEQ equivilant would be 0xA0CAB1 I understand the 0x is just a prefix to signal a hex number, so really its just how does A0 compare to 0099 as far as offsets go.

I understand the Offsets in a Hex Editor are supposed to actually be in hex, (i.e. 0x0099CAB1 would be what you enter into MySEQ) but it doesn't work despite it claiming to be hex. something is different. Plus if you convert to Decimal, its pretty obviously A0CAB1 doesn't equal 0099CAB1. so either MySEQ is using some special code to enter its data, or the hex editor is doing something, or (the most likely culprit) I just don't know enough to see what is going on.

I can provide many more examples but they are all real similar.

Thanks.

EDIT: It's possible the Hex Editor I was using (WinHex) is my issue. I started using another one and "all of a sudden" the offsets in the hex editor are exactly the same as the offsets in the .ini file (!!!) So I'm going to do more research with this different editor and see if I can yet figure this out! thanks for reading.

[eqmule]

Start address is 0x400000 by default for windows executables.

But Eqgame.exe use ASLR, that means it can load in on any start address.
You will need to check the module list in your hex editor to determine the start address.

In your example it looks like it loaded in at 0x470000 (0xA0CAB1 - 0x470000 = 0x59CAB1 and 0x59CAB1 + 0x400000 IS 0x99CAB1)
That needs to make sense to you if you are going to locate offsets using a hex editor while eq is running...

[coloradoderek]

Thank you for explaining that to me. It will help get me in the right direction.