December 2012 CShell

[Acea]

https://www.virustotal.com/file/27dc...is/1356564581/
https://virusscan.jotti.org/en/scanre...3b1f5e9c963e79

[[MPGH]Flengo]

Thanks for contributing. I needed this myself.

Approved.

Jotti Scan

[Acea]

Aww you removed my Turkey D:

[[MPGH]Flengo]

Aww you removed my Turkey D:

I didn't think I did

Well you put it back now anyway.

[JohnFame]

@Flengo
congrats on Minion. I'm about to be wiki editor and donater lol. And thanks for this do you have a 32 bit or 64 bit pc?

[ZinisterCoder]

@JohnFame
It's obviously 32-Bit for Kernal Detector , or he's using master131's Module Dumper which can allow you to dump cshell.dll on 64-Bit than using LordPE to rebuild it and therefore removing the .dmp extension and opening it in either IDA or Olly and looking for bytes & addresses.

@Flengo
congrats on Minion. I'm about to be wiki editor and donater lol. And thanks for this do you have a 32 bit or 64 bit pc?

[Acea]

@JohnFame
It's obviously 32-Bit for Kernal Detector , or he's using master131's Module Dumper which can allow you to dump cshell.dll on 64-Bit than using LordPE to rebuild it and therefore removing the .dmp extension and opening it in either IDA or Olly and looking for bytes & addresses.

Actually those are both incorrect, I unlocked my windows 7 64-bit, I use kernel detective.

[[MPGH]Flengo]

Actually those are both incorrect, I unlocked my windows 7 64-bit, I use kernel detective.

Someone could easily create a way to load the library on your own and go along from there. With minimal effort. For those who complain about being on 64-Bit OS's.
@Ch40zz-C0d3r is the one that keeps telling everyone to do so

[JohnFame]

Okay, but I dont think Module Dumper works, because I tried it many times and it failed to give me the fully dumped cshell and just gave me the original file from the ca folder for some reason.

[Skaterforeva1]

I love you for this... Thanks soo much i needed it!

[JohnFame]

Pmed you ACEA