[TUT]unpack cshell.dll

[lauwy]

We are going to unpack cshell.dll

First of al we need to load cshell.dll in to an other proces.
We do this becouse the we don't need to unpack it manualy, and this is an easy way.

So we need to make a script that loads cshell.dll we can do that easy with c++:

#include "windows.h"
#include <iostream>

int main()
{
	DWORD err;
	HINSTANCE hDLL = LoadLibrary("CShell.dll");               // Handle to DLL
	if(hDLL != NULL) {
		printf("Library has been loaded\n");
        }
	else 	{
        err = GetLastError();
		printf("Couldn't load dll\n");
	}
	system("pause");
	return 0;
}

Complire and put it in your crossfire map.

Add OllyDbg PE Dumper to Ollydbg (Or download ollydbg below (in the file.rar))

Open the script.
If you see that it is loaded open ollydbg.

Klik on file, attach. Go to the procces from the program you made.

Go to plugin and click on Olly PE Dumper, make a Dump of proces.

In the drop down menu click on cshell.
Click on Dump.

Save it as a .dll
Close your program to load cshell.dll
open the .dll you dumpt. And that is your unpackt dll

If you don't know how to do this, watch the video. (online in a few minits)




For ollydbg + PE Dumper
And loadlibarary script:

[haloistaken100]

You da man bro
i was having a hard time figuring this out thanks ;D

[Master-S]

Thanks!

/mgs2short

[lauwy]

If you know how it needs to be done, it's very easy :P
But it took long before I knew how to do it :P

[infidel_]

You have my gratitude!
I'll be tinkering this in a few...

[Osama_Farooq]

nice job very helpful,.

[Synns]

Very nice tutorial.

[infidel_]

I politely request the mods to sticky this thread. It'll be useful to some and for future development.

Thanks.

[lCalib3rl]

i havent understand it -.-

[lauwy]

What do you don't understand?

What it is:

You can find PTC commands and more in Cshell.dll

How to unpack?

[lCalib3rl]

i have a problem with Olly.
in your Vido you have plugin but i haven it why?

[lauwy]

Add OllyDbg PE Dumper to Ollydbg (Or download ollydbg below (in the file.rar))

/to short mssg

[lCalib3rl]

/to short mssg

ah i have understand yet it :d thanks your the

[lauwy]

Np

You can also download the plugin from internet

[lCalib3rl]

Np

You can also download the plugin from internet

here i have download the plugin bzt when i do it in the folder than
its doeasent work