In this lab we want to overwrite a property of the __thiscall object. We will tackle this in a few simple steps.

• Attach a hook to the non-exported GetWalkingSpeed function pointer

  • Print the WalkingSpeed float to the output area. What is the walking speed?

float __thiscall Player::GetWalkingSpeed(class Player* this)
{
    return ((int32_t)((long double)this->m_walkingSpeed));
}

• Now, capture the address of the this object by accessing the value of ECX inside your hook

  • https://frida.re/docs/javascript-api/#process

• You now have the pointer to the object and the offset of the property inside the object (Binary Ninja)

  • Using the offset you can now read the float yourself inside the hook

  • You can also overwrite the float in memory. What happens when you do that?

  • https://frida.re/docs/javascript-api/#nativepointer