[TUT] Defining + Searching DUMP
Today i gonna explain defining.
More can be learned on: How to find addies in WarRock - by PAGN
Sorry, Wrong section please move it <->
/*
Needed items:
Ollydbg
Dumbed WarRock.exe & EHSvc.dll
*/
#define WaterCollor1
#define WaterCollor2
#define WaterCollor3
/*
#define = Defining our Function
WaterCollor = our AdressName.
*/
Now we have to find Collors
we need Ollydbg
Then open Unpacked WarRock.exe in Ollydbg
Go -> Debug -> Run (Press F9 shortcut)
Then RightClick -> Search -> All referenced Text Strings

Search for -> Water > Untill you find Water.ShallowCollor
extra: Put Case Sensetivity off!

Then press enter if you found it!
then go down & search for the "PUSH"

Copy them to your clipboard.
you will get this dumb:
Then we got our defining Functions:
#define WaterCollor1 0x004CBA1E
#define WaterCollor2 0x004CBA23
#define WaterCollor3 0x004CBA28
/*
0x is not nessecary
Thanks me if you like it
INFO: Old Dump has been used, addies may be wrong. Easy to update;
Credits to: ME ofcourse
*/
More can be learned on: How to find addies in WarRock - by PAGN
Sorry, Wrong section please move it <->
/*
Needed items:
Ollydbg
Dumbed WarRock.exe & EHSvc.dll
*/
#define WaterCollor1
#define WaterCollor2
#define WaterCollor3
/*
#define = Defining our Function
WaterCollor = our AdressName.
*/
Now we have to find Collors
we need Ollydbg
Then open Unpacked WarRock.exe in Ollydbg
Go -> Debug -> Run (Press F9 shortcut)
Then RightClick -> Search -> All referenced Text Strings

Search for -> Water > Untill you find Water.ShallowCollor
extra: Put Case Sensetivity off!

Then press enter if you found it!
then go down & search for the "PUSH"

Copy them to your clipboard.
you will get this dumb:
Code:
004CBA1E 68 B4DD8100 PUSH WarRock_.0081DDB4 004CBA23 68 B0DD8100 PUSH WarRock_.0081DDB0 004CBA28 68 ACDD8100 PUSH WarRock_.0081DDAC
#define WaterCollor1 0x004CBA1E
#define WaterCollor2 0x004CBA23
#define WaterCollor3 0x004CBA28
/*
0x is not nessecary

Thanks me if you like it

INFO: Old Dump has been used, addies may be wrong. Easy to update;
Credits to: ME ofcourse

*/
Code:
/* //New dump - 22/08/2010 004A6A4A 68 44FF7C00 PUSH Dumped_W.007CFF44 004A6A4F 68 40FF7C00 PUSH Dumped_W.007CFF40 004A6A54 68 3CFF7C00 PUSH Dumped_W.007CFF3C */
