[Help] How to dump CShell and crossfire.exe

How to dump CShell and crossfire.exe

How to dump CShell and crossfire.exe (Z8games)?

Originally Posted by s0l3x

How to dump CShell and crossfire.exe (Z8games)?

Using LoadLibrary For Select CShell.dll
And Open PEE Tools For Dumped

Crossfire.exe Using Scylla v0.9.7c

Does someone has updated GetNodeTransform binary pattern?

Clarification

Originally Posted by Anger5K

Clarification

There is engine function (crossfire.exe) GetNodeTransform similar to GetObjectPos, but without text string representation. It's located in ILTModel interface. I sticked to use ILTModel interface (which is in exe), (there is also one which is in CShell, but I use CShell only to calculate function offset, I don't use CShell for anything), but I forgot the string and pattern I used to update ILTModel interface in crossfire.exe. I remember there was a string like ILTModel.default.

Old pattern doesn't work.

Code:

#define Patt_Routine_GetNodeTransform				"\x55\x8B\xEC\x83\xEC\x08\x89\x4D\xF8\x83\x7D\x08\x00\x74\x0F\x8B\x45\x08\x0F\xB6\x88\xAC\x00\x00\x00\x83\xF9\x01\x74\x39\x6A\x3C\xE8\x00\x00\x00\x00\x83\xC4\x04\x83\x3D\x00\x00\x00\x00\x00\x7C\x1F\x68\x00\x00\x00\x00\x68\x00\x00\x00\x00\x8B\x15\x00\x00\x00\x00\x52\xA1\x00\x00\x00\x00\x50\xE8\x00\x00\x00\x00\x83\xC4\x10\xB8\x00\x00\x00\x00\xEB\x2C\x8B\x4D\x08\x89\x4D\xFC\x8A\x55\x14"
#define Mask_Routine_GetNodeTransform				"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx????xxxxx?????xxx????x????xx????xx????xx????xxxx????xxxxxxxxxxx"

I think you can dump cshell with ollydbg

I can't dump/unpack crossfire.exe. Please help.

Originally Posted by s0l3x

I can't dump/unpack crossfire.exe. Please help.

use ChimpRec

Doesn't work either.

HelpHow to dump CShell and crossfire.exe

Post a Reply

Similar Threads

Tags for this Thread