Originally Posted by dreek1
Originally Posted by ComboDance
Originally Posted by Astr3Lune
, i try C.E and ollydbg but not showed 
\xE8\x00\x00\x00\x00\x8B\xF0\x83\xC4\x04\x85\xF6\x0F\x84\x00\x00\x00\x00\xD9\x86\x00\x00\x00\x00
x????xxxxxxxxx????xx????
E8 ?? ?? ?? ?? 8B F0 83 C4 04 85 F6 0F 84 ?? ?? ?? ?? D9 86 ?? ?? ?? ??
103A4175 . E8 B6B0E8FF CALL csheelll.1022F230 103A417A . 8BF0 MOV ESI,EAX 103A417C . 83C4 04 ADD ESP,4 103A417F . 85F6 TEST ESI,ESI 103A4181 . 0F84 E2010000 JE csheelll.103A4369 103A4187 . D986 3C0C0000 FLD DWORD PTR DS:[ESI+C3C] 0x3A4175
public static unsafe uint FindBypass(uint CShell)
{
uint ByPass = FindPattern((int)CShell, 0xFFFFFF, @"\xE8\xF6\x06\xE9\xFF\x8B\xF0\x83\xC4\x04\x85\xF6\x0F\x84\xE2\x01\x00\x00\xD9\x86\x3C\x0C\x00\x00\x0F\xB6\x86\x6C\x08\x00\x00\xD9\x5C\x24\x08\x89\x44\x24\x04\xD9\x86\x40\x0C\x00\x00\x57", "x????xxxx?xxxx????xx????xxx????xxx?xxx?xx????x");
return ByPass - CShell;
}