i need no water and no delay findpattern for ph warrock

03/17/2013 07:24 angelai#1
hellow good coders,

im newbie, and i need ur help,

i need no water and no delay FindPattern for PH WarRock for my addy logger, thanks to all good coders.
03/17/2013 08:26 alinin2nD#2
so 'ur newbie but you need paterns nad you have addylogger ? :o
03/18/2013 08:00 st3adcaptain#3
Lol WarRock PH And WarRock EU/INT have different pattern

Magtyaga ka mag hanap sa IDA
03/19/2013 09:51 Lucky Strike™#4
I can't help you much with the patterns, but if you're still searching for a way on how to get the NoWater-Address:

Dump the WarRock.exe process into a file, e.g. using KernelDetective or ChimpRec.
There are tutorials on this, you can find them by googling.

Open the dumped warrock.exe with ollydbg or any disassembler of your choice.
Run it. Go to main module. Set "search for all text strings" (or something like that)
Search for ASCII text-string "water.enable" .

Now go down, til you see "%s", and there's your address.

You can alternatively do this with the waterheight addresses too, there is public information on how to find them. Quite easy.

The difference is:

ADR_NoWater set to 0 actually is no water. Set it back to 1 and you have it back.
ADR_WaterHeight has to be set to -10000, to remove water, if i remember right.