Ollydbg and _Cshell Problem

[HazzaBud]

Hey, Im Having a Problem Finding the LTC with an unpacked CShell. I Didnt modify It or anything and followed lauwy's tutorials excatly the way he did it, step by step, but im always getting this error. this is when i search all referenced text strings, then search text> CursorCenter 0. I Get This Problem. any help would be appriciated, thankyou

when i search all referenced text strings it looks like this
[IMG]https://i1109.photobucke*****m/albums/h423/HazzaBud/OLLYDBG1.jpg[/IMG]

when i search "CursorCenter 0" in all referenced text strings and double click it
[IMG]https://i1109.photobucke*****m/albums/h423/HazzaBud/OLLYDBG2.jpg[/IMG]

Thanks for any help

[UltraPGNoob]

right click on "cursorcenter 0",0

and find reference -> selected address

you should get some address with push action

like that :

push _cshell.address | "CursorCenter 0"

then double click on one of them and u'll get the usual way to find LTC.

[UltraPGNoob]

/delete_message_#3_because_its_a_useless_msg
/thx

[HazzaBud]

right click on "cursorcenter 0",0

and find reference -> selected address

you should get some address with push action

like that :

push _cshell.address | "CursorCenter 0"

then double click on one of them and u'll get the usual way to find LTC.

Well, I Did That But When I Right Click-Find References To- Selected Address, It Comes Up With Nothing. Thanks For Your Reply Though

[UltraPGNoob]

np

maybe you should open crossfire.exe and inject cshell.dll and then open ollydbg to attach it to crossfire.exe

give it a try and tell me if it worked.

[258456]

I also have a problem, i wrote my own script that loads cshell, i went to olly and made a dump of the process of Cshell, but when i open the dumped dll, it shows me module ntdll, when i go to the executable modules tab cshell isn't even there, can you guys help me. i have to go to school in 30 minutes.

[UltraPGNoob]

i'm not unpacking it anymore because i can look into cshell easily.

why not trying to work with it even if its not unpacked?

[258456]

how do you plan to do that?

Crossfire doesn't allow you to attach a debugger, and it will just crash if you start it with olly so can you explain how you do that?

[258456]

thanks for you help guys. (sarcasm)

[[G]ermany]

i know that the PTC Method is patched, but cursorcenter and the other sh1t still works ?

[UltraPGNoob]

thanks for you help guys. (sarcasm)

did you forget to open crossfire.exe without anything like hgwc or xtrap?

and then inject cshell.dll?

crossfire alone cant detect debugger.

you should know that.

And you may find more than PTC.

[258456]

wow!!! how would you start cf without hgwc and xtrap? Are you talking about the patcher_cf? Sorry for being a pain and thanks for your help

[UltraPGNoob]

don't run from patcher_cf there's another executable called crossfire.

[258456]

Oh, so run the file "crossfire" then attatch debugger to it or open crossfire with debugger?

[UltraPGNoob]

open crossfire.exe
don't forget to use an injector to inject cshell.dll to crossfire.exe
then attach ollydbg

thats that easy to do.