Unpack CShell.DLL and finding Addyes

We are going to unpack cshell.dll

First of al we need to load cshell.dll in to an other proces.
We do this becouse the we don't need to unpack it manualy, and this is an easy way.

So we need to make a script that loads cshell.dll we can do that easy with c++:

Code:

#include "windows.h"
#include <iostream>

int main()
{
	DWORD err;
	HINSTANCE hDLL = LoadLibrary("CShell.dll");               // Handle to DLL
	if(hDLL != NULL) {
		printf("Library has been loaded\n");
        }
	else 	{
        err = GetLastError();
		printf("Couldn't load dll\n");
	}
	system("pause");
	return 0;
}

Complire and put it in your crossfire map.

Add OllyDbg PE Dumper to Ollydbg (Or download ollydbg below (in the file.rar))

Open the script.
If you see that it is loaded open ollydbg.

Klik on file, attach. Go to the procces from the program you made.

Go to plugin and click on Olly PE Dumper, make a Dump of proces.

In the drop down menu click on cshell.
Click on Dump.

Save it as a .dll
Close your program to load cshell.dll
open the .dll you dumpt. And that is your unpackt dll

If you don't know how to do this, watch the video.

How to Get The "Plugins" Tab in OllyDbg:
Go to Options> Appereance.
Then in the Directories Tab Select in the 1st box the /.../.../OllyDbg/UDD and in the Second box
put the OllyDbg Folder

Video:

Lawly:

Mine:

(Watch in HD please)

VirusScanns: (Not necessary but...) -.-
[x]
[x]

All False Positive...

Credits:
- (for all other)
-Me (for second video)

I did this video.. casue lots of ppl are asking now... and the lawlys tut was quite old so I made a video showing well and with 1 Addy so Have Fun. Press Thanks

Files.zip6.3 MB · 1,357 downloads 21/56 malicious

Download & Thanks

1st post i guess works let me try and go us some more source code

Approved .

Thanks @Ghost

@Ghost it was a repost -.-

I know Cody but so many ppl saying and they no using Search.... so I jsut post it and made a video... then I added somehting to thread... =D

Do you really understand the concepts you're teaching? Or are you just taking a previous post and making it mainstream with a video. You can't teach if you don't know the material yourself.

Just saying.

lol @NoJustice ur not only one that knows how...

Originally Posted by SteamAss

lol @NoJustice ur not only one that knows how...

I never said anything that you just said. I asked you if you really knew the concepts enough to teach? You seem to be asking me a lot on msn on how to do it.

i thanked u because it works going to do my own

@SteamAss
Dude, I needed like 5 more steps to get addy but I couldnt cuz the oddy doesnt have "Plugin" how does urs have plugin?

Edit: Gives this erro when opening program

Well if the loader will show an Error.. Just write (L"Cshell.dll");

Hmmm...
Already Knew This And Saw Those No Recoil Addies Myself.

Nice tut

will be helpfull for most people

Isnt it "LoadLibraryA"

Unpack CShell.DLL and finding Addyes

Tags for this Thread