Cshell Dumped 9/19/12

Bleh, took me 30 seconds to dump this, Have fun!

Virus Scan 1

Virus Scan 2

/Approve attachment? @.REZ @Drake

cshell_dumped_mpgh.net.rar3.5 MB · 103 downloads 4/43 malicious

Download & Thanks

I might look into this just for fun

Wonder what I can find.

Good work
/approved

Can someone tell me how to open this properly? It seems like I'm the only one who isn't getting it....

Code:

ADR_NameTags1			0x37255A7F
CShellOffset                        0x37100000
Offset Address                     0x00155A7F


Address   Hex dump          Command                                  Comments
00155A7B    BB 01000000     MOV EBX,1
00155A80    A1 70858037     MOV EAX,DWORD PTR DS:[37808570]
00155A85    8D5424 1C       LEA EDX,[ESP+1C]
00155A89    C74424 1C 00000 MOV DWORD PTR SS:[ESP+1C],0
00155A91    8B88 84000000   MOV ECX,DWORD PTR DS:[EAX+84]
00155A97    52              PUSH EDX

It's just not coming up right for me...

Originally Posted by Avery17

Can someone tell me how to open this properly? It seems like I'm the only one who isn't getting it....

Code:

ADR_NameTags1			0x37255A7F
CShellOffset                        0x37100000
Offset Address                     0x00155A7F


Address   Hex dump          Command                                  Comments
00155A7B    BB 01000000     MOV EBX,1
00155A80    A1 70858037     MOV EAX,DWORD PTR DS:[37808570]
00155A85    8D5424 1C       LEA EDX,[ESP+1C]
00155A89    C74424 1C 00000 MOV DWORD PTR SS:[ESP+1C],0
00155A91    8B88 84000000   MOV ECX,DWORD PTR DS:[EAX+84]
00155A97    52              PUSH EDX

It's just not coming up right for me...

You need a disassembler, preferably IDA. Look up on google or youtube how to use IDA or learn the basics.

Originally Posted by arun823

You need a disassembler, preferably IDA. Look up on google or youtube how to use IDA or learn the basics.

I've tried IDA but I still have the same issues... I'm not sure what I should set all the settings to for this either.

Originally Posted by Avery17

I've tried IDA but I still have the same issues... I'm not sure what I should set all the settings to for this either.

I don't even understand what your issue is, Enlighten me?

Refer to previous post explaining the issue...

I go to an address, expecting certain Assembly code and it's obviously the wrong assembly code. Meaning the file is offset incorrectly, however when I reset the file to have the correct offset it only lines up certain addresses correctly and other addresses are still misaligned.

Cshell Dumped 9/19/12

Similar Threads

Tags for this Thread