Hey guys,
I am having a slight issue, and I don't know if it's user error, or if it's an error on the program's fault.
But...
Everytime I load CShell.dll into OllyDBG, it shows the addresses starting from:
Code:
771F0000
and ending at:
Code:
772C5FFF
This is not correct, since CShell starts at:
Code:
37101000
and ends at:
Code:
37AD106C
Could someone explain to me either:
How to fix this issue.
If it's something wrong with me, or OllyDBG.
Here's a SS of what I mean:
Posts 1–5 of 5 · Page 1 of 1
Post a Reply
Tags for this Thread
None
D-VID did you attach to Cshell? can you take a screen shot of the title bar so we can see what module your in, looks like your in ntdll module
Originally Posted by Departure
D-VID did you attach to Cshell? can you take a screen shot of the title bar so we can see what module your in, looks like your in ntdll module
Yeah, I will attach the SS in a sec, but that's what I am trying to figure out also.
It shows as ntdll.[addresshere]
but yet, it IS attached to CShell.dll
SS:
Holy shit.
I really feel dumb right now.
Sorry guys, I just smoked a FAT bowl of some dank ass weed, and I just realized by fucking around with it and telling it to run like 3 different times, that it is in fact user error. :P
It's loaded up in CShell module now.
SS PROOF:
I don't think you got a full version of the file. Might have been a half-successful dump lol