Thumbs upAddy logger

Posts 1–6 of 6 · Page 1 of 1
Addy logger
PLAYERPOINTER 0X9E544C






00409FFE |. 8B0D 4C549E00 |MOV ECX,DWORD PTR DS:[9E544C]
0040A004 |. 8B89 64010000 |MOV ECX,DWORD PTR DS:[ECX+164]
0040A00A |. 3BCB |CMP ECX,EBX
0040A00C |. 74 06 |JE SHORT WarRock-.0040A014
0040A00E |. 51 |PUSH ECX ; /Arg1
0040A00F |. E8 4C222400 |CALL WarRock-.0064C260 ; \WarRock-.0064C260
0040A014 |> A1 AC31B000 |MOV EAX,DWORD PTR DS:[B031AC]
0040A019 |. 2B05 A831B000 |SUB EAX,DWORD PTR DS:[B031A8]
0040A01F |. 46 |INC ESI
0040A020 |. C1F8 02 |SAR EAX,2
0040A023 |. 3BF0 |CMP ESI,EAX
0040A025 |.^72 CC \JB SHORT WarRock-.00409FF3
0040A027 |> 391D B4539E00 CMP DWORD PTR DS:[9E53B4],EBX
0040A02D |. 74 05 JE SHORT WarRock-.0040A034
0040A02F |. E8 10FD0000 CALL WarRock-.00419D44
0040A034 |> 391D B8539E00 CMP DWORD PTR DS:[9E53B8],EBX
0040A03A |. 74 05 JE SHORT WarRock-.0040A041
0040A03C |. E8 3B420300 CALL WarRock-.0043E27C
0040A041 |> 5F POP EDI
0040A042 |. 5E POP ESI
0040A043 |. 33C0 XOR EAX,EAX
0040A045 |. 5D POP EBP
0040A046 |. 881D 43539E00 MOV BYTE PTR DS:[9E5343],BL





PLAYERPOINTER 0X9E544C

How to find this pattern ? Could you explain pls

FindPattern((PBYTE)"\x8B\x0D\x00\x00\x00\x00\x66\x83\xB9};", "xx????xxx", 2, true);
\x8B\x0D\x00\x00\x00\x00\x66\x83\xB9 are the bytes of your adress
where is the byte adresss ? show me pls

where we find this byte
x66\x83\xB9

00409FFE |. 8B0D 4C549E00 |MOV ECX,DWORD PTR DS:[9E544C]
0040A004 |. 8B89 64010000 |MOV ECX,DWORD PTR DS:[ECX+164]
0040A00A |. 3BCB |CMP ECX,EBX
0040A00C |. 74 06 |JE SHORT WarRock-.0040A014
0040A00E |. 51 |PUSH ECX ; /Arg1
0040A00F |. E8 4C222400 |CALL WarRock-.0064C260 ; \WarRock-.0064C260
0040A014 |> A1 AC31B000 |MOV EAX,DWORD PTR DS:[B031AC]
0040A019 |. 2B05 A831B000 |SUB EAX,DWORD PTR DS:[B031A8]
0040A01F |. 46 |INC ESI
0040A020 |. C1F8 02 |SAR EAX,2
0040A023 |. 3BF0 |CMP ESI,EAX
0040A025 |.^72 CC \JB SHORT WarRock-.00409FF3
0040A027 |> 391D B4539E00 CMP DWORD PTR DS:[9E53B4],EBX
0040A02D |. 74 05 JE SHORT WarRock-.0040A034
0040A02F |. E8 10FD0000 CALL WarRock-.00419D44
0040A034 |> 391D B8539E00 CMP DWORD PTR DS:[9E53B8],EBX
0040A03A |. 74 05 JE SHORT WarRock-.0040A041
0040A03C |. E8 3B420300 CALL WarRock-.0043E27C
0040A041 |> 5F POP EDI
0040A042 |. 5E POP ESI
0040A043 |. 33C0 XOR EAX,EAX
0040A045 |. 5D POP EBP
0040A046 |. 881D 43539E00 MOV BYTE PTR DS:[9E5343],
Quote Originally Posted by vkt78 View Post
where is the byte adresss ? show me pls

where we find this byte
x66\x83\xB9

00409FFE |. 8B0D 4C549E00 |MOV ECX,DWORD PTR DS:[9E544C]
0040A004 |. 8B89 64010000 |MOV ECX,DWORD PTR DS:[ECX+164]
0040A00A |. 3BCB |CMP ECX,EBX
0040A00C |. 74 06 |JE SHORT WarRock-.0040A014
0040A00E |. 51 |PUSH ECX ; /Arg1
0040A00F |. E8 4C222400 |CALL WarRock-.0064C260 ; \WarRock-.0064C260
0040A014 |> A1 AC31B000 |MOV EAX,DWORD PTR DS:[B031AC]
0040A019 |. 2B05 A831B000 |SUB EAX,DWORD PTR DS:[B031A8]
0040A01F |. 46 |INC ESI
0040A020 |. C1F8 02 |SAR EAX,2
0040A023 |. 3BF0 |CMP ESI,EAX
0040A025 |.^72 CC \JB SHORT WarRock-.00409FF3
0040A027 |> 391D B4539E00 CMP DWORD PTR DS:[9E53B4],EBX
0040A02D |. 74 05 JE SHORT WarRock-.0040A034
0040A02F |. E8 10FD0000 CALL WarRock-.00419D44
0040A034 |> 391D B8539E00 CMP DWORD PTR DS:[9E53B8],EBX
0040A03A |. 74 05 JE SHORT WarRock-.0040A041
0040A03C |. E8 3B420300 CALL WarRock-.0043E27C
0040A041 |> 5F POP EDI
0040A042 |. 5E POP ESI
0040A043 |. 33C0 XOR EAX,EAX
0040A045 |. 5D POP EBP
0040A046 |. 881D 43539E00 MOV BYTE PTR DS:[9E5343],
i Guess ur using Olly ... i prefer ida -> Hex View
Yes I use ollydbg. I download ida pro. And ı find this adress






\x8B\x0D\x00\x00\x00\x00\ ı see but ı dont find \x66\x83\xB9 where is it.
Posts 1–6 of 6 · Page 1 of 1
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Talk with us