CA address logger

neytiri · 2011-05-19T21:00:49.000Z

well i was gunna be a noob and use a CA addy logger for PBlackout but flame informed me i cant do that cause of "crossgame" so ima learn CA first and worry about PBlackout later but i need a addy logger if anyone could post theirs or one they know of that would be helpfull, of course i know most people probly wont post one but instead flame on this thread calling me names but what ever i just want to better myself and actually be helpfullbobobobo:D:Dbobobobo

Originally Posted by Geecko

Hi all......!!!!

Now i tell u how to make a nice addy logger.....so u dont have to re-search the addy, each update....!!!!

This save u a lot of time

Let's Start......

-------------------------------------------------------------------------------------------------

PROGRAMS & REQUIREMENTS:

Visual C++ ( i use 6.0 )
Brain
Some basics C++ knowledge
Some minutes...

--------------------------------------------------------------------------------------------------

Now open a new project "Win32 Dynamic-Link Library", call it with the name u want

Now add some globals:
Code:

Code:

#include <windows.h>
#include <fstream>
#include <stdio.h>
using namespace std;                                       //need for the logging func
ofstream ofile;                                                  //need for the logging func
#define WIN32_LEAN_AND_MEAN
char *GetDirectoryFile(char *filename);         //getdirfile for the logging func
void __cdecl add_log (const char * fmt, ...); //the logging func
void thethread(); //the main function
char dlldir[320];
In our DllMain(HMODULE hMod, DWORD dwReason, PVOID pvReserved):
Code:
 CreateThread(0, 0, (LPTHREAD_START_ROUTINE)thethread, 0, 0, 0);
 GetModuleFileName(hMod, dlldir, 512);
 for(int i = strlen(dlldir); i > 0; i--) { if(dlldir[i] == '\\') { dlldir[i+1] = 0; break;}}

ofile.open(GetDirectoryFile("WooWMyLog.txt"), ios::app);

        
MessageBox(NULL, " Logger", "Let's log some addy", MB_OK); //not really needed

We have to add these 2 function to let the logger work correctly:

Code:

Code:

char *GetDirectoryFile(char *filename)//get the directory of the dll
{
    static char path[320];
    strcpy(path, dlldir);
    strcat(path, filename);
    return path;
}


void __cdecl add_log (const char *fmt, ...)//the add log func
{
    if(ofile != NULL)
    {
        if(!fmt) { return; }

        va_list va_alist;
        char logbuf[256] = {0};

        va_start (va_alist, fmt);
        _vsnprintf (logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), fmt, va_alist);
        va_end (va_alist);

        ofile << logbuf << endl;
    }
}

Now we have to add another 2 functions, 2 important function that search the address:

Code:

Code:

bool Match(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
    for(;*szMask;++szMask,++pData,++bMask)
        if(*szMask=='x' && *pData!=*bMask ) 
            return false;
    return (*szMask) == NULL;
}


DWORD FindPattern(DWORD dwAddress,DWORD dwLen,BYTE *bMask,char * szMask)
{
    for(DWORD i=0; i < dwLen; i++)
        if( Match( (BYTE*)( dwAddress+i ),bMask,szMask) )
            return (DWORD)(dwAddress+i);

    return 0;
}

After this we have to put the last function, "thethread":

Code:

Code:

void thethread()
{

//Code Here

}

--------------------------------------------------------------------------------------------------

Now the base it's finished, but a very interesting question is:

"How i can add an address???"

Let's say that once u have understand the method is simply add an address......

u need:

1) A sequence of bytes of the addy (generally the first 10/15 bytes), this is called "Array of Bytes"

2)A Mask (tells the search functions what bytes change and what bytes are static)

An Example is:

Code:

Code:

DWORD  m_dwaddy  = FindPattern(0x400000, 0x01400000,(unsigned char*)"\xB9\x00\x00\x00\x00\xF3\xA5\x00","x????xxx");

add_log("\nFunction %\nAddress :  0x%.6X\n",m_dwaddy);

This logs something like this:

Code:

Code:

Function
Address :  0x000000

--------------------------------------------------------------------------------------------------

But what this numbers mean?

0x400000 : the start address of ur research
0x01400000 : the end address of ur research
\xB9\x00\x00\x00\x00\xF3\xA5\x00 : the Array of Bytes
x????xxx : the Mask

x : static byte
? : not static byte

So the first byte is static ( with x ), \x00\x00\x00\x00 bytes aren't statics (with ? ), the last 3 bytes are static ( with x ).

the static bytes dont change ( dont change after an update )
the not static bytes change after an update

--------------------------------------------------------------------------------------------------

Where/How can i search for bytes???

U can search for bytes in OllyDbg, in IDA Pro or with ur favourite program.

How can i understand what bytes are static and what arent?

easy, copy an array of a selected addy.
then wait until there is an update, and research the new addy with the same asm code as the old (attention: u DONT have to search for the OLD addy after an update,or it will be wrong)
then compare the 2 array.....!!!!!

END of TUT

If u dont want to do it, there is a plugin for OllyDbg that do it automatically....

I think i helped u...

Credits: Me and people that made some functions

from UC.

CA address logger

Post a Reply

Tags for this Thread