Need Crossfire.exe !! [Dumped/Unpacked]

[I2espect]

Title Said All !!! Anyone Upload it plz !?

[giniyat101]

Here you go
https://www.virustotal.com/en/file/8...is/1385207202/
crossfire__.rar - Jotti's malware scan

[[MPGH]BACKD00R]

^Approved!!!

[I2espect]

Here you go
https://www.virustotal.com/en/file/8...is/1385207202/
crossfire__.rar - Jotti's malware scan

thx @giniyat but i want to ask u a question : are the strings in the cfexe are editable .. i tried but i failed to get a pointer !
and there is some string looks like that in Cshell but with [_] before !!
i try something like that string [DamagePerPoint]
so i am doing it like :

DWORD NanoCfexe = *(DWORD*)(0x68F608);
CfexeNano* Class = (CfexeNano*)(NanoCfexe + (0x54*0));
Log<< "DamagePerPoint" << Class->DamagePerPoint << endl;

the debugged part is like that :
i tried to trigger the ESI ,,, as it [ESI + MyOffset]
And I tried to use that as pointer ! "0x68F608"
i may be bad at asm ! :|

0053BCBA   . C700 08F66800  MOV DWORD PTR DS:[EAX],crossfir.0068F608
0053BCC0   . 8BF0           MOV ESI,EAX
0053BCC2   . EB 02          JMP SHORT crossfir.0053BCC6
0053BCC4   > 33F6           XOR ESI,ESI
//Some Code...
0053BD23   . 68 8CF76800    PUSH crossfir.0068F78C                         ;  ASCII "_DamagePerPoint"
0053BD28   . 57             PUSH EDI
0053BD29   . 8D4C24 44      LEA ECX,DWORD PTR SS:[ESP+0x44]
0053BD2D   . 8946 14        MOV DWORD PTR DS:[ESI+0x14],EAX

can u help me in that ,, i think that u got what i mean !!

[giniyat101]

thx @giniyat but i want to ask u a question : are the strings in the cfexe are editable .. i tried but i failed to get a pointer !
and there is some string looks like that in Cshell but with [_] before !!
i try something like that string [DamagePerPoint]
so i am doing it like :

DWORD NanoCfexe = *(DWORD*)(0x68F608);
CfexeNano* Class = (CfexeNano*)(NanoCfexe + (0x54*0));
Log<< "DamagePerPoint" << Class->DamagePerPoint << endl;

the debugged part is like that :
i tried to trigger the ESI ,,, as it [ESI + MyOffset]
And I tried to use that as pointer ! "0x68F608"
i may be bad at asm ! :|

0053BCBA   . C700 08F66800  MOV DWORD PTR DS:[EAX],crossfir.0068F608
0053BCC0   . 8BF0           MOV ESI,EAX
0053BCC2   . EB 02          JMP SHORT crossfir.0053BCC6
0053BCC4   > 33F6           XOR ESI,ESI
//Some Code...
0053BD23   . 68 8CF76800    PUSH crossfir.0068F78C                         ;  ASCII "_DamagePerPoint"
0053BD28   . 57             PUSH EDI
0053BD29   . 8D4C24 44      LEA ECX,DWORD PTR SS:[ESP+0x44]
0053BD2D   . 8946 14        MOV DWORD PTR DS:[ESI+0x14],EAX

can u help me in that ,, i think that u got what i mean !!

well, you came very late bro, crossfire updated today and therefore new a crossfire.exe shipped with the latest update :P

[I2espect]

well, you came very late bro, crossfire updated today and therefore new a crossfire.exe shipped with the latest update :P

no i tried it before the update i know what i am saying . i tried it but didn't work before the update !!

[I2espect]

req2close /solved