NX Chams address/sig for CA Classic[10/11/2019]
CANA Classic
0x3745B9F0
-------------------------------------
use findpattern for below
"\xA1\xA8\xAD\x37\x38\x85\xC0\x74\x2A\x8B\x4C\x24\ x04\x8B\x90\xDC", "xxxxxxxxxxxxxxxx"
-------------------------------------
to find the address above:
1) dump cshell.dll
2) open on IDA or OllyDBG
3) search strings for "SkelModelStencil"
4) skim through spooky asm
5) voila
IDA should provide the following [incorrect] function prototype:
int __cdecl sub_3745B9F0(int, float)
0x3745B9F0
-------------------------------------
use findpattern for below
"\xA1\xA8\xAD\x37\x38\x85\xC0\x74\x2A\x8B\x4C\x24\ x04\x8B\x90\xDC", "xxxxxxxxxxxxxxxx"
-------------------------------------
to find the address above:
1) dump cshell.dll
2) open on IDA or OllyDBG
3) search strings for "SkelModelStencil"
4) skim through spooky asm
5) voila
IDA should provide the following [incorrect] function prototype:
int __cdecl sub_3745B9F0(int, float)
Originally Posted by supercarz1991
