CShell dumper [32 AND 64bit]

Hey guys...
Since so many people are failing and cant even dump a simple cshell, I decided to release my lil program Im using to dump CShell.
Just place it near engine.exe, open it and attach a program like PETools to dump CShell.
This program easily just uses LoadLibary API to decrypt the virtualized and packed CShell. However, have fun.

Virus scans:
- https://www.virustotal.com/file/bc75...is/1356604258/
- http://virusscan.jotti.org/de/scanre...8c0dd6888fcf9a

Credits:
- Flengo (For asking me)
- Me [Ch40zz-C0d3r] (For coding)

Please Thank, +rep or credit me for this if you use it!

LoadLib_mpgh.net.zip3 KB · 113 downloads Scanning…

Download & Thanks

Thanks for this

,looking forward to use it

Good job ..

Its like ..

The thing is HS hide some dll on list so all u need to do is inject Ehsvc ( if u want to dump ehsvc ) or CShell then it load on List

@Flengo @[SMA] Paradise` approve?
Wow. Finally thank you man.

Or you can use http://www.mpgh.net/forum/207-combat...le-dumper.html which has been around for a while... However, diversity is good and options are nice. Thanks.

I personally like to go to nexon and ask them for the dump. Saves me time.

Lol. Well this Dumper that master released has many glitches and I think it sucks. I like this better

Good Job Bro.

You should make a tutorial on Obtaining Addresses Manually. All i can remember is.. Dumping CShell.. and Opening it with OllyDB.. or something along them lines.. I'm stuck to SigScanners-.-

Originally Posted by TrixtSam

You should make a tutorial on Obtaining Addresses Manually. All i can remember is.. Dumping CShell.. and Opening it with OllyDB.. or something along them lines.. I'm stuck to SigScanners-.-

Using the bytes to find the address? (or you can use cheat engine, and search for them...)

Originally Posted by TrixtSam

You should make a tutorial on Obtaining Addresses Manually. All i can remember is.. Dumping CShell.. and Opening it with OllyDB.. or something along them lines.. I'm stuck to SigScanners-.-

Finding addys manually?
Its all about debugging and so on.
You need some experience in this if you want to manually find them.
For example get playermgr addy you need search for a playername string. Then what access this -> For drawing when your over the name -> breakpointed in a mov eax, [37524889] and theres your pointer lol

Addy isnt updated lol.

People think you can use the "bytes" to find the address.

You can't. That address wont be the only thing with those bytes. Plus you can't scan for them that way.

This is why we make pattern scans.

Originally Posted by Flengo

People think you can use the "bytes" to find the address.

You can't. That address wont be the only thing with those bytes. Plus you can't scan for them that way.

This is why we make pattern scans.

If someone wants to know how to make pattern, I could make a tutorial too

For sure WITHOUT plugin lol!

Originally Posted by Ch40zz-C0d3r

If someone wants to know how to make pattern, I could make a tutorial too

For sure WITHOUT plugin lol!

Well.. How would you find s2S etc?

Originally Posted by TrixtSam

Well.. How would you find s2S etc?

S2S is easy. Its an engine function, so search in engine module. Search for the string SendToServer which is used for debugging. Scroll up a bit until you find the start of the function, and you've got it. Thats the manual way.

CShell dumper [32 AND 64bit]

Similar Threads

Tags for this Thread