Cshell Dumped 9/19/12

[arun823]

Bleh, took me 30 seconds to dump this, Have fun!

Virus Scan 1

Virus Scan 2

/Approve attachment? @.REZ @Kid Cudi

[[MPGH]Flengo]

I might look into this just for fun

Wonder what I can find.

[[MPGH].REZ]

Good work
/approved

[Avery17]

Can someone tell me how to open this properly? It seems like I'm the only one who isn't getting it....

ADR_NameTags1			0x37255A7F
CShellOffset                        0x37100000
Offset Address                     0x00155A7F


Address   Hex dump          Command                                  Comments
00155A7B    BB 01000000     MOV EBX,1
00155A80    A1 70858037     MOV EAX,DWORD PTR DS:[37808570]
00155A85    8D5424 1C       LEA EDX,[ESP+1C]
00155A89    C74424 1C 00000 MOV DWORD PTR SS:[ESP+1C],0
00155A91    8B88 84000000   MOV ECX,DWORD PTR DS:[EAX+84]
00155A97    52              PUSH EDX

It's just not coming up right for me...

[arun823]

Can someone tell me how to open this properly? It seems like I'm the only one who isn't getting it....

ADR_NameTags1			0x37255A7F
CShellOffset                        0x37100000
Offset Address                     0x00155A7F


Address   Hex dump          Command                                  Comments
00155A7B    BB 01000000     MOV EBX,1
00155A80    A1 70858037     MOV EAX,DWORD PTR DS:[37808570]
00155A85    8D5424 1C       LEA EDX,[ESP+1C]
00155A89    C74424 1C 00000 MOV DWORD PTR SS:[ESP+1C],0
00155A91    8B88 84000000   MOV ECX,DWORD PTR DS:[EAX+84]
00155A97    52              PUSH EDX

It's just not coming up right for me...

You need a disassembler, preferably IDA. Look up on google or youtube how to use IDA or learn the basics.

[Avery17]

You need a disassembler, preferably IDA. Look up on google or youtube how to use IDA or learn the basics.

I've tried IDA but I still have the same issues... I'm not sure what I should set all the settings to for this either.

[arun823]

I've tried IDA but I still have the same issues... I'm not sure what I should set all the settings to for this either.

I don't even understand what your issue is, Enlighten me?

[Avery17]

Refer to previous post explaining the issue...

I go to an address, expecting certain Assembly code and it's obviously the wrong assembly code. Meaning the file is offset incorrectly, however when I reset the file to have the correct offset it only lines up certain addresses correctly and other addresses are still misaligned.