How to dump Engine/Cshell (With Pics)

Ok guys this is how you dump engine/cshell to get commands and addies

1 Get and run kernel detective as admin.

2 start ca and go to the login page

3 alt tab back to kernel and find engine.exe on process list



4 right click and choose, dump to file

5. Get and run ollyICE as admin and open up the dumped file



6. Right click and search for "all reference strings"



7 Now you can search for what ever you want (addies/commands)

Dont forget to give me credits!!!

Enjoy, this tut was made by zmansquared


If you use this TUT, press thanks and plus rep (the medal at bottom) please

This is pretty useful, to whoever that does not know how to dump Cshell.dll

i didn't know how, and apparently this is kinda useless to me anyway since it doesn't work on Win7 >_<

Great Job dude. Thanked

hey zman, supposedly Kernel detective 1.3.1 is supposed to work with win 7...i'm still gettin that error though...

could it be that i'm 64 bit?

Can you post or OllyIce i get APCI error...

Idk why you guys are having problems with this, it's so easy.

Lol im stuck at 77.7% when loading CShell.dll.
ZOMG >.<

Nvm worked.

How do you search for bytes?