[Source]Making AddieLogger

[R3d_L1n3]

This tut was made on WarRock dump , nothing diffrent on ca just follow the steps , oh i already released this on my forum while ago so what about we quit flame :P

Let me first explain to you how to make patterns ..

Programs needed Are :

1 ) Brain.exe

2 ) Debugger (OllyBg / Ida)

3 ) NotePad

Lets start ..

First Step !

* The Addie am using is PlayerPointer !! its just example

1 ) Run Ida pro and include old warrock dump on it befor the last update and wait until loading is finish .. ( should be like this )



2 ) Search for the addie u want to make patern for



3 ) Put the addie and click oK



4 ) Should be like this for example



5 ) Click at HexView



6 ) The lined bytes line is the bytes we need to make pattern



So for now our bytes of old addie are ' A1 E8 17 A0 00 3B C3 74 16 33 C9 41 89 98 B4 02 '

Second Step :

After we found the bytes for playerpointer addie on the old dump do the same steps u did on new dump ( make sure u use updated addie of player pointer )

At end after you do same as u did on step 1 you will get this bytes ' A1 50 EE A4 00 3B C3 74 16 33 C9 41 89 98 C8 02 '

Third Step :

We have the bytes of old dump and new dump so what now ?

Here come the last step witch is compile

The New bytes are :

A1 50 EE A4 00 3B C3 74 16 33 C9 41 89 98 C8 02

The old Bytes are :

A1 E8 17 A0 00 3B C3 74 16 33 C9 41 89 98 B4 02

Now what u do is look at the bytes they both are made of 16 byte so the thing is u replace the diffrent byte with ' ? ' and correct byte with ' x '

so lets start ..

A1 50 EE A4 00 3B C3 74 16 33 C9 41 89 98 C8 02

A1 E8 17 A0 00 3B C3 74 16 33 C9 41 89 98 B4 02

X ? ? ? X X X X X X X X X X ? X << This is our mask ! so as u see A1 Still A1 So we replaced with ' X ' , 50 Changed to E8 so we replaced with ' ? ' and so on

The Last Step :

We found the mast , old bytes , new bytes now we need to make the correct pattern its not much diffrent than step 3 but this time if there diffrent byte u replace it with 0x00 ..

Example ! :

A1 50 EE A4 00 3B C3 74 16 33 C9 41 89 98 C8 02 << new byte

A1 E8 17 A0 00 3B C3 74 16 33 C9 41 89 98 B4 02 << old byte

xA1\x00\x00\x00\x00\x3B\xC3\x74\x16\x33\xC9\x41\x8 9\x98\x00\x02 = THE Pattern were gona use to get the addie , As u see A1 / A1 Didnt change at first of the two patterns so we keep it A1 but second byte of new pattern was 50 and the old one was E8 so we replaced with 0x00

So the finaly code will be

DWORD PlayerPointer = FindPattern((PBYTE)"\xA1\x00\x00\x00\x00\x3B\xC3\x 74\x16\x33\xC9\x41\x89\x98\x00\x02", "x???xxxxxxxxxx?x", 1, true );

There something i didnt explain witch is how to get this

FindPattern((PBYTE)"\xA1\x00\x00\x00\x00\x3B\xC3\x 74\x16\x33\xC9\x41\x89\x98\x00\x02", "x???xxxxxxxxxx?x", 1, true );

its diffrent from addie to other usually its 1 or 2 i cant explain how know if its 1 or 2 u gota find ur self

Tut is over thanks for reading ..


Credits :
R3d_L!n3
UnknownPk
NoName

[Skaterforeva1]

This makes much more since then the other tut. Very nice!

[[H]aaBX]

It's much easier to use SigMaker

[GoldWhite]

It's much easier to use SigMaker

Can you give me sigmaker?

[Skaterforeva1]

Can you give me sigmaker?

just Google it? Why does everyone have to do your work for you?

[R3d_L1n3]

It's much easier to use SigMaker

Like i dont know ? lol this topic explain how it works , its not my job to make it easy on who want to learn

[[MPGH]Flengo]

Not the greatest explanation. Could be a lot better.

Need to be more detailed and organized. This is just for me.

Still recommending @Ch40zz-C0d3r's tutorial. You end up getting better signature scans also. The method in your example will either not work or die quickly.

His tutorial was for bette, longer lasting signatures. Although his used OllyDBG and you're using IDA.

This should be good for beginners though who need to learn how signature scans work

Thanks for sharing.

[R3d_L1n3]

Not the greatest explanation. Could be a lot better.

Need to be more detailed and organized. This is just for me.

Still recommending @Ch40zz-C0d3r's tutorial. You end up getting better signature scans also. The method in your example will either not work or die quickly.

His tutorial was for bette, longer lasting signatures. Although his used OllyDBG and you're using IDA.

This should be good for beginners though who need to learn how signature scans work

Thanks for sharing.

1 ) Could be alot better -- You cant just tell everything and this explain enough trust me

2 ) I made collors just to help understanding :P

3 ) I didnt ask for pin :P , just sow on forum that when sigs are posted members be like wow 'Pro' while its so easy .

4 ) Sorry i didnt sow ch4os thread will ..

5 ) Ehm ur way wrong u cant just say it wont work befor u check it :s , i use it for 3 month , never gaved me false addie

6 ) Olly / ida that is opinion for me i prefer Olly for reversing , IDA other things

[[MPGH]Flengo]

6 ) Olly / ida that is opinion for me i prefer Olly for reversing , IDA other things

Oh nonono it'll work. But just not for everything

But its good for others newer coders, avoiding sig maker and explaining it to them how it works

[R3d_L1n3]

Oh nonono it'll work. But just not for everything

But its good for others newer coders, avoiding sig maker and explaining it to them how it works

i still dont use this xd calculating is better XD , but ya sig maker make life easy

[Ch40zz-C0d3r]

The thing is, the addresses we are using get changed often.
Thats why you get a reference pointing to out address, like MOV ECX, 0xADDY
These code sections wont chnage as often, also you can make 3 sigscans or so.
I made 3 sigscans for all and return the one which is valid. For example:
Sig1 = your sigscan
Sig2 = my method
Sig3 = my method (another codesection)

Now I compare your sig with my both and so on

Heres the link to my tutorial: https://www.mpgh.net/forum/207-combat...ignatures.html
Also please read the LAST post made by me on last page!!

[R3d_L1n3]

The thing is, the addresses we are using get changed often.
Thats why you get a reference pointing to out address, like MOV ECX, 0xADDY
These code sections wont chnage as often, also you can make 3 sigscans or so.
I made 3 sigscans for all and return the one which is valid. For example:
Sig1 = your sigscan
Sig2 = my method
Sig3 = my method (another codesection)

Now I compare your sig with my both and so on

Heres the link to my tutorial: https://www.mpgh.net/forum/207-combat...ignatures.html
Also please read the LAST post made by me on last page!!

Ya ofc i do that on my logger and choose valid :P , ill check it now btw ..

Edit : ahh i see lol nice tut i didnt read everything cuz am on phone atm when i back home ill

[RobinC]

For me, this is the best tutorial.
Thanx dude .

[merp.]

This is great. I was able to understand everything <- (coming from a noob)

[GoldWhite]

can anyone give me pattern of dip engine?