Hi all......!!!!
Now i tell u how to make a nice addy logger.....so u dont have to re-search the addy, each update....!!!!
This save u a lot of time
Let's Start......
-------------------------------------------------------------------------------------------------
PROGRAMS & REQUIREMENTS:
Visual C++ ( i use 6.0 )
Brain
Some basics C++ knowledge
Some minutes...
--------------------------------------------------------------------------------------------------
Now open a new project "Win32 Dynamic-Link Library", call it with the name u want
Now add some globals:
Code:
Code:
#include <windows.h>
#include <fstream>
#include <stdio.h>
using namespace std; //need for the logging func
ofstream ofile; //need for the logging func
#define WIN32_LEAN_AND_MEAN
char *GetDirectoryFile(char *filename); //getdirfile for the logging func
void __cdecl add_log (const char * fmt, ...); //the logging func
void thethread(); //the main function
char dlldir[320];
In our DllMain(HMODULE hMod, DWORD dwReason, PVOID pvReserved):
Code:
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)thethread, 0, 0, 0);
GetModuleFileName(hMod, dlldir, 512);
for(int i = strlen(dlldir); i > 0; i--) { if(dlldir[i] == '\\') { dlldir[i+1] = 0; break;}}
ofile.open(GetDirectoryFile("WooWMyLog.txt"), ios::app);
MessageBox(NULL, " Logger", "Let's log some addy", MB_OK); //not really needed
We have to add these 2 function to let the logger work correctly:
Code:
Code:
char *GetDirectoryFile(char *filename)//get the directory of the dll
{
static char path[320];
strcpy(path, dlldir);
strcat(path, filename);
return path;
}
void __cdecl add_log (const char *fmt, ...)//the add log func
{
if(ofile != NULL)
{
if(!fmt) { return; }
va_list va_alist;
char logbuf[256] = {0};
va_start (va_alist, fmt);
_vsnprintf (logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), fmt, va_alist);
va_end (va_alist);
ofile << logbuf << endl;
}
}
Now we have to add another 2 functions, 2 important function that search the address:
Code:
Code:
bool Match(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
if(*szMask=='x' && *pData!=*bMask )
return false;
return (*szMask) == NULL;
}
DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
for(DWORD i=0; i < dwLen; i++)
if( Match( (BYTE*)( dwAddress+i ),bMask,szMask) )
return (DWORD)(dwAddress+i);
return 0;
}
After this we have to put the last function, "thethread":
Code:
Code:
void thethread()
{
//Code Here
}
--------------------------------------------------------------------------------------------------
Now the base it's finished, but a very interesting question is:
"How i can add an address???"
Let's say that once u have understand the method is simply add an address......
u need:
1) A sequence of bytes of the addy (generally the first 10/15 bytes), this is called "Array of Bytes"
2)A Mask (tells the search functions what bytes change and what bytes are static)
An Example is:
Code:
Code:
DWORD m_dwaddy = FindPattern(0x400000, 0x01400000,(unsigned char*)"\xB9\x00\x00\x00\x00\xF3\xA5\x00","x????xxx");
add_log("\nFunction %\nAddress : 0x%.6X\n",m_dwaddy);
This logs something like this:
Code:
Code:
Function
Address : 0x000000
--------------------------------------------------------------------------------------------------
But what this numbers mean?
0x400000 : the start address of ur research
0x01400000 : the end address of ur research
\xB9\x00\x00\x00\x00\xF3\xA5\x00 : the Array of Bytes
x????xxx : the Mask
x : static byte
? : not static byte
So the first byte is static ( with x ), \x00\x00\x00\x00 bytes aren't statics (with ? ), the last 3 bytes are static ( with x ).
the static bytes dont change ( dont change after an update )
the not static bytes change after an update
--------------------------------------------------------------------------------------------------
Where/How can i search for bytes???
U can search for bytes in OllyDbg, in IDA Pro or with ur favourite program.
How can i understand what bytes are static and what arent?
easy, copy an array of a selected addy.
then wait until there is an update, and research the new addy with the same asm code as the old (attention: u DONT have to search for the OLD addy after an update,or it will be wrong)
then compare the 2 array.....!!!!!
END of TUT
If u dont want to do it, there is a plugin for OllyDbg that do it automatically....
I think i helped u...
Credits: Me and people that made some functions
Originally Posted by Flengo
