WTW Pattern:
Bytes:
Mask:Code:\x68\x00\x00\x00\x00\x8D\x4C\x24\x2D
Code:x????xxxx
0x64C is addy Fly.
0X1FF is addy WTW
0x 299 is addy Jump.
i need Patren or binary string it.
someone help me!!
WTW Pattern:
Bytes:
Mask:Code:\x68\x00\x00\x00\x00\x8D\x4C\x24\x2D
Code:x????xxxx
Only for German Guys...
Fly
Code:\xD9\x86\x00\x00\x00\x00\xDC\x0D\x00\x00\x00\x00\xD8\x8C\x24\x00\x00\x00\x00 //PatternCode:xx????xx????xxx???? //Mask
[IMG]https://i210.photobucke*****m/albums/bb266/Alalee/mpghLogoSteel-1.png[/IMG]
oh thanks very Much.
But my problem in Logger wrong pointer.
1.CLient Sheell
2.WallMgr
ClientShell In OllyDbg:
10044587 8B15 E0795F10 MOV EDX,DWORD PTR DS:[105F79E0] ; CShell.1060EBA0
1004458D 8BCA MOV ECX,EDX
==========================================//===========================
My Patren :
DWORD ClientShel = FindPattern((DWORD)GetModuleHandleA("CShell.dll"), 0xFC7000, (PBYTE)"\xC6\x01\x01\x8B\x15\x00\x00\x00\x00\x8B\x 82\x00\x00\x00\x00\x8B", "xxxxx????xx????x");
if(ClientShel != NULL)
{
ClientShel = *(DWORD*)(ClientShel + 5) - CShell;
==========================================//===========================
After Log
#define CLientShell 0x5F79E0 ===>Wrong. but this is 0x60EBA0
help please.
ClientShell & WallMgr Patren