DIP ?

Posts 16 of 6 · Page 1 of 1
DIP ?
tell me where is the DIP Point address
Code:
004C9FC0   6A FF            PUSH -1
004C9FC2   68 680A6300      PUSH crossfir.00630A68
004C9FC7   64:A1 00000000   MOV EAX,DWORD PTR FS:[0]
004C9FCD   50               PUSH EAX
004C9FCE   51               PUSH ECX
004C9FCF   A1 50746A00      MOV EAX,DWORD PTR DS:[6A7450]
004C9FD4   33C4             XOR EAX,ESP
004C9FD6   50               PUSH EAX
004C9FD7   8D4424 08        LEA EAX,DWORD PTR SS:[ESP+8]
004C9FDB   64:A3 00000000   MOV DWORD PTR FS:[0],EAX
004C9FE1   68 405F6C00      PUSH crossfir.006C5F40
004C9FE6   8D4C24 08        LEA ECX,DWORD PTR SS:[ESP+8]
004C9FEA   E8 91E1F4FF      CALL crossfir.00418180
004C9FEF   C74424 10 000000>MOV DWORD PTR SS:[ESP+10],0
004C9FF7   A1 B85D6C00      MOV EAX,DWORD PTR DS:[6C5DB8]
004C9FFC   85C0             TEST EAX,EAX
004C9FFE   0F84 CB000000    JE crossfir.004CA0CF
004CA004   F64424 18 04     TEST BYTE PTR SS:[ESP+18],4
004CA009   74 0A            JE SHORT crossfir.004CA015
004CA00B   E8 4098FFFF      CALL crossfir.004C3850
004CA010   E9 A6000000      JMP crossfir.004CA0BB
004CA015   803D 4B836B00 00 CMP BYTE PTR DS:[6B834B],0
004CA01C   8B00             MOV EAX,DWORD PTR DS:[EAX]
004CA01E   8B08             MOV ECX,DWORD PTR DS:[EAX]
004CA020   6A 00            PUSH 0
004CA022   0F84 87000000    JE crossfir.004CA0AF
004CA028   803D 6C856B00 00 CMP BYTE PTR DS:[6B856C],0
004CA02F   74 7E            JE SHORT crossfir.004CA0AF
004CA031   8B15 007E6B00    MOV EDX,DWORD PTR DS:[6B7E00]
004CA037   52               PUSH EDX
004CA038   68 F07D6B00      PUSH crossfir.006B7DF0
004CA03D   68 F07D6B00      PUSH crossfir.006B7DF0
004CA042   50               PUSH EAX
004CA043   8B41 44          MOV EAX,DWORD PTR DS:[ECX+44]
004CA046   FFD0             CALL EAX
004CA048   8B0D B85D6C00    MOV ECX,DWORD PTR DS:[6C5DB8]
004CA04E   8B01             MOV EAX,DWORD PTR DS:[ECX]
004CA050   8B0D 007E6B00    MOV ECX,DWORD PTR DS:[6B7E00]
004CA056   8B10             MOV EDX,DWORD PTR DS:[EAX]
004CA058   8B52 44          MOV EDX,DWORD PTR DS:[EDX+44]
004CA05B   6A 00            PUSH 0
004CA05D   51               PUSH ECX
004CA05E   68 187E6B00      PUSH crossfir.006B7E18
004CA063   68 187E6B00      PUSH crossfir.006B7E18
004CA068   50               PUSH EAX
004CA069   FFD2             CALL EDX
004CA06B   8B15 007E6B00    MOV EDX,DWORD PTR DS:[6B7E00]
004CA071   A1 B85D6C00      MOV EAX,DWORD PTR DS:[6C5DB8]
004CA076   8B00             MOV EAX,DWORD PTR DS:[EAX]
004CA078   8B08             MOV ECX,DWORD PTR DS:[EAX]
004CA07A   6A 00            PUSH 0
004CA07C   52               PUSH EDX
004CA07D   68 2C7E6B00      PUSH crossfir.006B7E2C
004CA082   68 2C7E6B00      PUSH crossfir.006B7E2C
004CA087   50               PUSH EAX
004CA088   8B41 44          MOV EAX,DWORD PTR DS:[ECX+44]
004CA08B   FFD0             CALL EAX
004CA08D   8B0D B85D6C00    MOV ECX,DWORD PTR DS:[6C5DB8]
004CA093   8B01             MOV EAX,DWORD PTR DS:[ECX]
004CA095   8B0D 007E6B00    MOV ECX,DWORD PTR DS:[6B7E00]
004CA09B   8B10             MOV EDX,DWORD PTR DS:[EAX]
004CA09D   8B52 44          MOV EDX,DWORD PTR DS:[EDX+44]
004CA0A0   6A 00            PUSH 0
004CA0A2   51               PUSH ECX
004CA0A3   68 087E6B00      PUSH crossfir.006B7E08
004CA0A8   68 087E6B00      PUSH crossfir.006B7E08
004CA0AD   EB 09            JMP SHORT crossfir.004CA0B8
004CA0AF   8B51 44          MOV EDX,DWORD PTR DS:[ECX+44]
004CA0B2   6A 00            PUSH 0
004CA0B4   6A 00            PUSH 0
004CA0B6   6A 00            PUSH 0
004CA0B8   50               PUSH EAX
004CA0B9   FFD2             CALL EDX
004CA0BB   B8 B85D6C00      MOV EAX,crossfir.006C5DB8
004CA0C0   E8 DB6FF8FF      CALL crossfir.004510A0
004CA0C5   C705 80856B00 00>MOV DWORD PTR DS:[6B8580],0
004CA0CF   8D4C24 04        LEA ECX,DWORD PTR SS:[ESP+4]
004CA0D3   E8 C8E0F4FF      CALL crossfir.004181A0
004CA0D8   8B4C24 08        MOV ECX,DWORD PTR SS:[ESP+8]
004CA0DC   64:890D 00000000 MOV DWORD PTR FS:[0],ECX
004CA0E3   59               POP ECX
004CA0E4   83C4 10          ADD ESP,10
004CA0E7   C3               RETN
004CA0E8   CC               INT3
004CA0E9   CC               INT3
004CA0EA   CC               INT3
004CA0EB   CC               INT3
004CA0EC   CC               INT3
004CA0ED   CC               INT3
004CA0EE   CC               INT3
004CA0EF   CC               INT3
004CA0F0   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]
004CA0F4   8B40 0C          MOV EAX,DWORD PTR DS:[EAX+C]
004CA0F7   85C0             TEST EAX,EAX
004CA0F9   74 07            JE SHORT crossfir.004CA102
004CA0FB   8B48 2C          MOV ECX,DWORD PTR DS:[EAX+2C]
004CA0FE   8B41 28          MOV EAX,DWORD PTR DS:[ECX+28]
004CA101   C3               RETN
004CA102   33C0             XOR EAX,EAX
004CA104   C3               RETN
004CA105   CC               INT3
004CA106   CC               INT3
004CA107   CC               INT3
004CA108   CC               INT3
004CA109   CC               INT3
004CA10A   CC               INT3
004CA10B   CC               INT3
004CA10C   CC               INT3
004CA10D   CC               INT3
004CA10E   CC               INT3
004CA10F   CC               INT3
004CA110   837E 04 00       CMP DWORD PTR DS:[ESI+4],0
004CA114   C706 44826700    MOV DWORD PTR DS:[ESI],crossfir.00678244
004CA11A   74 33            JE SHORT crossfir.004CA14F
004CA11C   57               PUSH EDI
004CA11D   8D7E 0C          LEA EDI,DWORD PTR DS:[ESI+C]
004CA120   8BCF             MOV ECX,EDI
004CA122   E8 C936F5FF      CALL crossfir.0041D7F0
004CA127   8B46 04          MOV EAX,DWORD PTR DS:[ESI+4]
004CA12A   85C0             TEST EAX,EAX
004CA12C   74 17            JE SHORT crossfir.004CA145
004CA12E   50               PUSH EAX
004CA12F   A1 BC6E6A00      MOV EAX,DWORD PTR DS:[6A6EBC]
004CA134   8B50 08          MOV EDX,DWORD PTR DS:[EAX+8]
004CA137   B9 BC6E6A00      MOV ECX,crossfir.006A6EBC
004CA13C   FFD2             CALL EDX
004CA13E   C746 04 00000000 MOV DWORD PTR DS:[ESI+4],0
004CA145   6A 00            PUSH 0
004CA147   8BCF             MOV ECX,EDI
004CA149   E8 725CF4FF      CALL crossfir.0040FDC0
004CA14E   5F               POP EDI
004CA14F   C746 08 00000000 MOV DWORD PTR DS:[ESI+8],0
004CA156   C3               RETN
004CA157   CC               INT3
004CA158   CC               INT3
004CA159   CC               INT3
004CA15A   CC               INT3
004CA15B   CC               INT3
004CA15C   CC               INT3
004CA15D   CC               INT3
004CA15E   CC               INT3
004CA15F   CC               INT3
004CA160   56               PUSH ESI
004CA161   8B7424 08        MOV ESI,DWORD PTR SS:[ESP+8]
004CA165   6A 00            PUSH 0
004CA167   8BCE             MOV ECX,ESI
004CA169   E8 325CF4FF      CALL crossfir.0040FDA0
004CA16E   8BC6             MOV EAX,ESI
004CA170   5E               POP ESI
004CA171   C2 0400          RETN 4
004CA174   CC               INT3
004CA175   CC               INT3
004CA176   CC               INT3
004CA177   CC               INT3
004CA178   CC               INT3
004CA179   CC               INT3
004CA17A   CC               INT3
004CA17B   CC               INT3
004CA17C   CC               INT3
004CA17D   CC               INT3
004CA17E   CC               INT3
004CA17F   CC               INT3
004CA180   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]
004CA184   8B10             MOV EDX,DWORD PTR DS:[EAX]
004CA186   3B51 08          CMP EDX,DWORD PTR DS:[ECX+8]
004CA189   1BC0             SBB EAX,EAX
004CA18B   F7D8             NEG EAX
004CA18D   C2 0400          RETN 4
004CA190   8B5424 04        MOV EDX,DWORD PTR SS:[ESP+4]
004CA194   8B02             MOV EAX,DWORD PTR DS:[EDX]
004CA196   8B49 04          MOV ECX,DWORD PTR DS:[ECX+4]
004CA199   8D0C81           LEA ECX,DWORD PTR DS:[ECX+EAX*4]
004CA19C   83C0 01          ADD EAX,1
004CA19F   8902             MOV DWORD PTR DS:[EDX],EAX
004CA1A1   8B01             MOV EAX,DWORD PTR DS:[ECX]
004CA1A3   C2 0400          RETN 4
004CA1A6   CC               INT3
004CA1A7   CC               INT3
004CA1A8   CC               INT3
004CA1A9   CC               INT3
004CA1AA   CC               INT3
004CA1AB   CC               INT3
004CA1AC   CC               INT3
004CA1AD   CC               INT3
004CA1AE   CC               INT3
004CA1AF   CC               INT3
004CA1B0   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]
004CA1B4   8B10             MOV EDX,DWORD PTR DS:[EAX]
004CA1B6   8B41 04          MOV EAX,DWORD PTR DS:[ECX+4]
004CA1B9   8B0490           MOV EAX,DWORD PTR DS:[EAX+EDX*4]
004CA1BC   C2 0400          RETN 4
004CA1BF   CC               INT3
004CA1C0   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]
004CA1C4   56               PUSH ESI
004CA1C5   57               PUSH EDI
004CA1C6   8B79 08          MOV EDI,DWORD PTR DS:[ECX+8]
004CA1C9   50               PUSH EAX
004CA1CA   8BF1             MOV ESI,ECX
004CA1CC   E8 1F040000      CALL crossfir.004CA5F0
004CA1D1   5F               POP EDI
004CA1D2   5E               POP ESI
004CA1D3   C2 0400          RETN 4
004CA1D6   CC               INT3
004CA1D7   CC               INT3
004CA1D8   CC               INT3
004CA1D9   CC               INT3
004CA1DA   CC               INT3
004CA1DB   CC               INT3
004CA1DC   CC               INT3
004CA1DD   CC               INT3
004CA1DE   CC               INT3
004CA1DF   CC               INT3
004CA1E0   8B4424 04        MOV EAX,DWORD PTR SS:[ESP+4]
004CA1E4   56               PUSH ESI
004CA1E5   50               PUSH EAX
004CA1E6   8BF1             MOV ESI,ECX
004CA1E8   E8 23050000      CALL crossfir.004CA710
004CA1ED   5E               POP ESI
004CA1EE   C2 0800          RETN 8
004CA1F1   CC               INT3
004CA1F2   CC               INT3
004CA1F3   CC               INT3
004CA1F4   CC               INT3
004CA1F5   CC               INT3
004CA1F6   CC               INT3
004CA1F7   CC               INT3
004CA1F8   CC               INT3
004CA1F9   CC               INT3
004CA1FA   CC               INT3
004CA1FB   CC               INT3
004CA1FC   CC               INT3
004CA1FD   CC               INT3
004CA1FE   CC               INT3
004CA1FF   CC               INT3
004C9FC0
Quote Originally Posted by [mi5 View Post
004C9FC0
Wrong !!!!
@dmx66_96 It's simple.. Just use pattern scan or binary scan at olly. I hope you'll understand what I'm saying.
its PRESENT ENGINE bro!!! and the address is 0x004CA0AF good luck!!!
and how to look for this tutorial DIP Mozhna
а как искать этот ДИП туториал можна
Posts 16 of 6 · Page 1 of 1

Post a Reply

Similar Threads

Tags for this Thread

None

Need help?