Patterns/Signatures[S2S & More]

[R4v0r]

Not tested but I know for sure that they are 100% accurate.

SendToServer: Removed on request..

LTClientExE: \x8B\x44\x24\x04\x50\x68\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x83\xC4\x08\xC3 xxxxxx????x????xxxx

DrawPrim: \x8B\x08\x8B\x91\x00\x00\x00\x00\xFF\xD2\x8B\xE5\x5D\xC2\x14\x00 xxxx????xxxxxxxx

GlassWalls: \x6A\x01\x6A\x07\x8B\x95 xxxxxx

Credits:
• R4v0r AKA xImmortal

[iamspeedforyou]

Not tested but I know for sure that they are 100% accurate.

LTClientExE: \x8B\x44\x24\x04\x50\x68\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x83\xC4\x08\xC3 xxxxxx????x????xxxx

DrawPrim: \x8B\x08\x8B\x91\x00\x00\x00\x00\xFF\xD2\x8B\xE5\x5D\xC2\x14\x00 xxxx????xxxxxxxx

GlassWalls: \x6A\x01\x6A\x07\x8B\x95 xxxxxx

Credits:
• R4v0r AKA xImmortal

nice i guess... but why post?

[coderstrikeagain]

Can you remove the sendtoserver pattern from there and leave the others because all noobs that don't know where s2s addie is are idots and should manually update it. Do you want leechers to release s2s hacks again and again and make them think they good?

[R4v0r]

nice i guess... but why post?

Why not? Sharing = Caring thats how I see it.

[coderstrikeagain]

Thanks man! @iamspeedforyou remove your quote.

[zdacom]

Thatz funny :)) S2S function easy to find just open Engine dump and search for SendToServer string move your pointer above and you'll see the entry of function!
But funny not that, funny thing in that post where u quotted S2S pattern and it still available for noobs in reply with qoute. Anyway, thanx!

[R4v0r]

Thatz funny ) S2S function easy to find just open Engine dump and search for SendToServer string move your pointer above and you'll see the entry of function!
But funny not that, funny thing in that post where u quotted S2S pattern and it still available for noobs in reply with qoute. Anyway, thanx!

Yeah saw it too, thats was a very dumb thing to do ;p

[iamspeedforyou]

Yeah saw it too, thats was a very dumb thing to do ;p

well i removed it now, not many people saw it..

[R4v0r]

well i removed it now, not many people saw it..

Great thanks, I really appriciate it

[iamspeedforyou]

yep sure, anytime

[[H]aaBX]

That's the byte pattern for the Send2Server Address (it's in Engine.exe)
You easily can make a signature scan with it if you know how - noobs won't know how

6A FF 68  ??  ??  ??  ?? 64 A1  ??  ??  ??  ?? 50 83 EC 2C 53 55 56 57 A1  ??  ??  ??  ?? 33 C4 50 8D 44 24 40 64 A3  ??  ??  ??  ?? 8B 74 24 50 33 DB

Credits: R4v0r & me

[Saltine]

Why do people have an issue with posting the send to server pattern/mask...? I see no reason why it shouldn't be public.

[Departure]

I agree @Saltine, if they are so noob like people claim they wont know what to do with the address anyway...

[[MPGH]Flengo]

Its already public

https://www.mpgh.net/forum/207-combat...-sig-addy.html

[R4v0r]

@Flengo yup that's it. If y'all are making a big deal out of it, well here:

SendToServer: \x6A\xFF\x68\x00\x00\x00\x00\x64\xA1\x00\x00\x00\x00\x50\x83\xEC\x2C\x53\x55\x56\x57\xA1\x00\x00\x00\x00\x33\xC4\x50\x8D\x44\x24\x40\x64\xA3\x00\x00\x00\x00\x8B\x74\x24\x50\x33\xDB\x89\x74\x24\x14 xxx????xx????xxxxxxxxx????xxxxxxxxx????xxxxxxxxxx

[COLOR="Silver"]

---------- Post added at 10:08 AM ---------- Previous post was at 10:07 AM ----------

[/COLOR @Flengo yup that's it. If y'all are making a big deal out of it, well here:

SendToServer: \x6A\xFF\x68\x00\x00\x00\x00\x64\xA1\x00\x00\x00\x00\x50\x83\xEC\x2C\x53\x55\x56\x57\xA1\x00\x00\x00\x00\x33\xC4\x50\x8D\x44\x24\x40\x64\xA3\x00\x00\x00\x00\x8B\x74\x24\x50\x33\xDB\x89\x74\x24\x14 xxx????xx????xxxxxxxxx????xxxxxxxxx????xxxxxxxxxx