byte finding

I need to update my bypass.

I dumped EHSvc.dll and opened in IDA Pro.
I searched the addy then looked at it in hex view.
How do I know what is the bytes?

The guy is just trying to code. If you can't help him dont flame his threads.

Originally Posted by barcoder

I need to update my bypass.

I dumped EHSvc.dll and opened in IDA Pro.
I searched the addy then looked at it in hex view.
How do I know what is the bytes?

if you mark an addy > go to hex view > thats the off byte
but since EHSvc is mostly asm it will work with the offbyte & onbyte

aeroman explains everything

and he explains it wrong..

everything is asm when viewed in ollydbg or ida..

its the closest thing to machine language(0 and 1)..

Plus, why help this dude updating his leeched bypass. Because if HE made it, he knows how to use ida/ollydgb and so knows how to work with bytes..

Originally Posted by Chuck Norris

and he explains it wrong..

everything is asm when viewed in ollydbg or ida..

its the closest thing to machine language(0 and 1)..

Plus, why help this dude updating his leeched bypass. Because if HE made it, he knows how to use ida/ollydgb and so knows how to work with bytes..

about the mostly asm part?
i meant this

Code:

___:0049F82B                 call    sub_49F5C3

0049F82B is the asm addie

Originally Posted by AeroMan

about the mostly asm part?
i meant this

Code:

___:0049F82B                 call    sub_49F5C3

0049F82B is the asm addie

sub_49F5C3 is also an addie. Its an addie(pointer) to a function

the function is on 0x0049F5C3..

And i know im not helping, but did you realy make the bypass yourself? That would be good work since you dont even know how bytes work..

Originally Posted by Chuck Norris

sub_49F5C3 is also an addie. Its an addie(pointer) to a function

the function is on 0x0049F5C3..

And i know im not helping, but did you realy make the bypass yourself? That would be good work since you dont even know how bytes work..

i did not?

Originally Posted by AeroMan

i did not?

i was talking abou the OP/TS..

Chuck = No Help

Lmao you wouldn't need the off bytes in a bypass unless you're planning on disabling it in which case whats the point of having it? xD To get the correct bytes find the pointers that call detection functions, look at the actual function and choose the best opcodes to counter it. In turn, disabling the function. You might want to look up assembler opcodes lol. Most addies posted or found can just be NOP'ed or Jmp'ed or Returned.

Originally Posted by Zithium

Lmao you wouldn't need the off bytes in a bypass unless you're planning on disabling it in which case whats the point of having it? xD To get the correct bytes find the pointers that call detection functions, look at the actual function and choose the best opcodes to counter it. In turn, disabling the function. You might want to look up assembler opcodes lol. Most addies posted or found can just be NOP'ed or Jmp'ed or Returned.

Correct but it still not simple some addies need call and others mov and jump you know ther is more than 2 way for evryone of them .

Originally Posted by Zithium

Lmao you wouldn't need the off bytes in a bypass unless you're planning on disabling it in which case whats the point of having it? xD To get the correct bytes find the pointers that call detection functions, look at the actual function and choose the best opcodes to counter it. In turn, disabling the function. You might want to look up assembler opcodes lol. Most addies posted or found can just be NOP'ed or Jmp'ed or Returned.

agreed, no point in off bytes for a bypass

He need help not people flaming each other o_0

Originally Posted by nielshetschaap

He need help not people flaming each other o_0

He is a noob..
No one can help him

byte finding

Similar Threads

Tags for this Thread