Finding Bytes

[halomaster369]

When I search an address in cshell i dont find it. Im using ollydbg

[merp.]

https://screensnapr.com/e/k3Kom7.png
Look at the image above.

Let's say the address you're looking for is 0x377A6DA0. (The 2nd address in the picture)
You see the letters/words next to it? Those are your off-bytes.
so for 0x377A6DA0, the off-bytes are: F88F7D00. (<- that's 4 bytes long)
just separate them "properly", like so:
\xF8\x8F\x7D\x00
^
That's your off bytes! Now usually to find the on-bytes, you just NOP it. (Not always that way though)
NOP = No Operation, which is \x90.
Since there are 4 bytes, you would just NOP the 4 bytes to get your on-bytes:
\x90\x90\x90\x90
so for 0x377A6DA0
Off: \xF8\x8F\x7D\x00
On: \x90\x90\x90\x90

(The address isn't useful, I just got the pic from a different thread and cropped a few addresses out.)

Hope you learned something!

[Acea]

If you aren't finding anything when you search it's a bad dump....
Try using IDA, it's more new hack user friendly. Load up the dump, hit 'G' and enter your address and you're on your way.

[Shadow`]

Look at the "Tips and tricks" section in this thread for finding off bytes manually if that's the method you prefer.