CrossfireEU-Cshell Unpack 15-12-2012

Posts 1–14 of 14 · Page 1 of 1

CFEU Unpack Cshell
Virus sc.
CrossfireEU Unpack15-12-2012
https://www.virustotal.com/file/4a4b...is/1355612128/
CrossfireEU Unpack15-12-2012.zip MD5:ae1089520b6172a926d2ead11fd5d8e6 - VirSCAN.org 3% Scanner(s) (1/37) found malware!
Cshell Unpack15-12-2012
Cshell Unpack15-12-2012.zip - Jotti's malware scan
https://www.virustotal.com/file/a251...is/1355612462/

Work for me
some addys i find
WeaponMgr 0xD48844
FallMgr 0xD48824
Playerpoiter (0x46D2A0+0x54)
WallMgr 0xD4882C (*0x574)
press tnx if i help

CrossfireEU Unpack15-12-2012_mpgh.net.zip1.5 MB · 119 downloads 1/45 malicious

Download & Thanks

Cshell Unpack15-12-2012_mpgh.net.zip2.3 MB · 83 downloads 2/46 malicious

Download & Thanks

good
man ☺☺☻☻☻♥♣

Approved!!!

Pls Release all Addys i can't load the Unpacked CShell with LoadLib pls do it like Haabx and Post a list of Addys

Originally Posted by vinke2013

Pls Release all Addys i can't load the Unpacked CShell with LoadLib pls do it like Haabx and Post a list of Addys

way you cant
1 put 2 files in CFEU fored (Unpack cshell and crossfire)
2 ran Ollydbg
3 in Ollydbg open file _CShell (F3 and select file _CShell--> in yor CFEU fored)
4 ran Debug (F9)
5 Search for all referenced text string
Search for
WeaponMgr: ReloadAnimRatio
WallMgr: EdgeShotEnabled
FallMgr: DamagePerMeter
BasicPlayerInfo: BasicPlayerInfo
InjectionMsg: Vertex lock failed
NoBugDamage/DamageZone: DamageZone
LTClient: FogEnable
Norecoil1: PerturbMin%d_%s
Norecoil2: PerturbMax%d_%s
Norecoil3: BulletOffset(second one)
Norecoil4: ShotReactPitch%d_%d
Norecoil5: DetailPerturbShot%d_%s
Norecoil6: DetailReactPitchShot%d_%s
Norecoil7: DetailReactYawShot%d_%s
Noreload: ReloadAnimRatio
NoWeaponWeight: MoveSpeedPenalty
NoGrenadeDmg: AmmoDamage
NoWeaponChangeDelay: ChangeWeaponAnimRatio
NoKnockBack: KnockBack
NoScope: HalfZomeNoImage
FastKnife1: KnifeNormalAniRate
FastKnife2: KnifeBigShotAniRate
KnifeOHK1: KnifeNormalAmmoDamage
KnifeOHK2: KnifeBigShotAmmoDamage
SeeGhosts1: CharacterHiddenAlpha
SeeGhosts2: CharacterHiddenWalkAlpha
SeeGhosts3: CharacterHuddenRunAlpha
RepeatFire: RepeatFire
CrouchSpeed: MovementDuckWalkRate
ShotGunSpread: ShotsPerAmmo

Ohhh.. I Need a list not how to look for Addys i need the Addys

@vinke2013 If it's an unpacked CShell you dont need to load it with Loadlib

Originally Posted by [H]aaBX

@vinke2013 If it's an unpacked CShell you dont need to load it with Loadlib

But where here :
101AD84F . 68 40A23E10 PUSH _CShell.103EA240 ; ASCII "DamagePerMeter"
101AD854 . 50 PUSH EAX
101AD855 . E8 66D41D00 CALL _CShell.1038ACC0
101AD85A . 83C4 08 ADD ESP,8
101AD85D . 3BC7 CMP EAX,EDI
101AD85F . 74 1B JE SHORT _CShell.101AD87C
101AD861 . 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
101AD864 . 8B51 04 MOV EDX,DWORD PTR DS:[ECX+4]
101AD867 . 8B42 04 MOV EAX,DWORD PTR DS:[EDX+4]
101AD86A . 50 PUSH EAX
101AD86B . 90 NOP
101AD86C E8 DB E8
101AD86D . 04 45 ADD AL,45
101AD86F . 92 XCHG EAX,EDX
101AD870 . 62A1 2488D410 BOUND ESP,QWORD PTR DS:[ECX+10D48824]
101AD876 . D958 04 FSTP DWORD PTR DS:[EAX+4]
101AD879 . 83C4 04 ADD ESP,4
101AD87C > 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+2C]
101AD880 . 3BCF CMP ECX,EDI
101AD882 . 74 0D JE SHORT _CShell.101AD891
101AD884 . 8B4424 30 MOV EAX,DWORD PTR SS:[ESP+30]
101AD888 . 2BC1 SUB EAX,ECX
101AD88A . C1F8 02 SAR EAX,2
101AD88D . 3BE8 CMP EBP,EAX
101AD88F . 72 0A JB SHORT _CShell.101AD89B
101AD891 > 90 NOP
101AD892 E8 DB E8
101AD893 FD DB FD
101AD894 B1 DB B1
101AD895 90 NOP
101AD896 62 DB 62 ; CHAR 'b'
101AD897 . 8B4C24 2C MOV ECX,DWORD PTR SS:[ESP+2C]
101AD89B > 8B0CA9 MOV ECX,DWORD PTR DS:[ECX+EBP*4]

ist the FallDmg Addy ? pls Habbx send a List of the most of addys pls

No I won't ..

this work 101AD870 . 62A1 2488D410 BOUND ESP,QWORD PTR DS:[ECX+10D48824]
so 0xD48824 ----> FallMgr
and
DistFallDamageStartFrom is 0x4
10XXXXXX ----> 0xXXXXXX

Originally Posted by thryebac

this work 101AD870 . 62A1 2488D410 BOUND ESP,QWORD PTR DS:[ECX+10D48824]
so 0xD48824 ----> FallMgr
and
DistFallDamageStartFrom is 0x4
10XXXXXX ----> 0xXXXXXX

Pls i need a List pls help me i need a list of Addys i need : BasicPlayerInfo ...

Originally Posted by vinke2013

Pls i need a List pls help me i need a list of Addys i need : BasicPlayerInfo ...

ye i dont have BPinfo sry i working on logger now will see

Pls send me a List of all Addys do you have

Dunno if it's still needed but anyway here is what my logger said:

Code:


WeaponMgr:                           0xD48844
    ReloadAnimRatio:                 0xC38
    ChangeWeaponAnimRatio:           0xC3C
    MoveSpeedPenalty:                0xB10
    ZoomInMoveSpeedPenalty:          0x3948
    MovePenaltyForDelayFire:         0x394C
    AmmoDamage:                      0x81C
    RepeatFire:                      0xAE8
    Range:                           0x80C
    Knockback:                       0x3CCC
    FireAnimMultiplier:              0x1348
    PrefireAnimMultiplier:           0x3954
    ZoomInFireAnimMultiplier:        0x3958
    DetailReactYawShot:              0x11C8
    DetailReactPitchShot:            0x1060
    DetailPerturbShot:               0xEF8
    ShotReactPitch:                  0x3708
    28_3 bypass:                     0x3044B5

 BasicPlayerInfo:                    0xCE1710
    MovementWalkRate:                0x8
    MovementDuckWalkRate:            0xC
    C4DefuseTime:                    0x80
    CharacterHiddenAlpha:            0x88
    CharacterHiddenWalkAlpha:        0x8C
    CharacterHiddenRunAlpha:         0x90

 FallMgr:                            0xD48824
    DistFallDamageStartFrom:         0x4

 LTClient:                           0x45F4CC
    LTClientShell:                   0x45F4D8
    LTClient offset:                 0x200

 WallMgr:                            0xD4882C
    EdgeShotEnabled:                 0x568
    WallShotEnabled:                 0x56C
    PerfectWallShotEnabled:          0x570
    TextureType:                     0x574

 Wallhack:                           0x6DDD94
 DamageZone:                         0x3F91FC
 Font base:                          0xD542A8
 PlayerPointer:                      0x46D2A0 + 0x54 (0x46D2F4)