Quote:
Originally Posted by iPhone 4
d.h?
|
also hier ein part aus dem neuen ding vom Unfairgamers
Code:
74631A30 /$ A1 C42A6574 MOV EAX,DWORD PTR DS:[74652AC4]
74631A35 |. 56 PUSH ESI
74631A36 |. 57 PUSH EDI
74631A37 |. 85C0 TEST EAX,EAX
74631A39 |. 75 25 JNZ SHORT [UG][DEM.74631A60
74631A3B |. 8B35 04906374 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetModuleHandl>; kernel32.GetModuleHandleA
74631A41 |. 8B3D 00906374 MOV EDI,DWORD PTR DS:[<&KERNEL32.Sleep>] ; kernel32.Sleep
74631A47 |> 68 00926374 /PUSH [UG][DEM.74639200 ; ASCII "EhSvc.dll"
74631A4C |. FFD6 |CALL ESI
74631A4E |. 6A 64 |PUSH 64
74631A50 |. A3 C42A6574 |MOV DWORD PTR DS:[74652AC4],EAX
74631A55 |. FFD7 |CALL EDI
74631A57 |. A1 C42A6574 |MOV EAX,DWORD PTR DS:[74652AC4]
74631A5C |. 85C0 |TEST EAX,EAX
74631A5E |.^ 74 E7 \JE SHORT [UG][DEM.74631A47
74631A60 |> 8B35 08906374 MOV ESI,DWORD PTR DS:[<&KERNEL32.VirtualProtect>; kernel32.VirtualProtect
74631A66 |. 68 C02A6574 PUSH [UG][DEM.74652AC0 ; /pOldProtect = [UG][DEM.74652AC0
74631A6B |. 6A 40 PUSH 40 ; |NewProtect = PAGE_EXECUTE_READWRITE
74631A6D |. 6A 06 PUSH 6 ; |Size = 6
74631A6F |. 05 C4550D00 ADD EAX,0D55C4 ; |
74631A74 |. 50 PUSH EAX ; |Address = NULL
74631A75 |. FFD6 CALL ESI ; \VirtualProtect
74631A77 |. A1 C42A6574 MOV EAX,DWORD PTR DS:[74652AC4]
74631A7C |. 68 C02A6574 PUSH [UG][DEM.74652AC0 ; /pOldProtect = [UG][DEM.74652AC0
74631A81 |. 6A 40 PUSH 40 ; |NewProtect = PAGE_EXECUTE_READWRITE
74631A83 |. BF 04000000 MOV EDI,4 ; |
74631A88 |. 89B8 C4550D00 MOV DWORD PTR DS:[EAX+D55C4],EDI ; |
74631A8E |. 6A 06 PUSH 6 ; |Size = 6
74631A90 |. 05 34540D00 ADD EAX,0D5434 ; |
74631A95 |. 50 PUSH EAX ; |Address = NULL
74631A96 |. FFD6 CALL ESI ; \VirtualProtect
74631A98 |. A1 C42A6574 MOV EAX,DWORD PTR DS:[74652AC4]
74631A9D |. 68 C02A6574 PUSH [UG][DEM.74652AC0 ; /pOldProtect = [UG][DEM.74652AC0
74631AA2 |. 6A 40 PUSH 40 ; |NewProtect = PAGE_EXECUTE_READWRITE
74631AA4 |. 89B8 34540D00 MOV DWORD PTR DS:[EAX+D5434],EDI ; |
74631AAA |. 6A 06 PUSH 6 ; |Size = 6
74631AAC |. 05 0C550D00 ADD EAX,0D550C ; |
74631AB1 |. 50 PUSH EAX ; |Address = NULL
74631AB2 |. FFD6 CALL ESI ; \VirtualProtect
74631AB4 |. A1 C42A6574 MOV EAX,DWORD PTR DS:[74652AC4]
74631AB9 |. 68 C02A6574 PUSH [UG][DEM.74652AC0 ; /pOldProtect = [UG][DEM.74652AC0
74631ABE |. 6A 40 PUSH 40 ; |NewProtect = PAGE_EXECUTE_READWRITE
74631AC0 |. 89B8 0C550D00 MOV DWORD PTR DS:[EAX+D550C],EDI ; |
74631AC6 |. 6A 06 PUSH 6 ; |Size = 6
74631AC8 |. 05 8C540D00 ADD EAX,0D548C ; |
74631ACD |. 50 PUSH EAX ; |Address = NULL
74631ACE |. FFD6 CALL ESI ; \VirtualProtect
74631AD0 |. A1 C42A6574 MOV EAX,DWORD PTR DS:[74652AC4]
74631AD5 |. 68 C02A6574 PUSH [UG][DEM.74652AC0 ; /pOldProtect = [UG][DEM.74652AC0
74631ADA |. 6A 40 PUSH 40 ; |NewProtect = PAGE_EXECUTE_READWRITE
74631ADC |. 89B8 8C540D00 MOV DWORD PTR DS:[EAX+D548C],EDI ; |
74631AE2 |. 6A 06 PUSH 6 ; |Size = 6
74631AE4 |. 05 98540D00 ADD EAX,0D5498 ; |
74631AE9 |. 50 PUSH EAX ; |Address = NULL
74631AEA |. FFD6 CALL ESI ; \VirtualProtect
74631AEC |. A1 C42A6574 MOV EAX,DWORD PTR DS:[74652AC4]
74631AF1 |. 68 C02A6574 PUSH [UG][DEM.74652AC0 ; /pOldProtect = [UG][DEM.74652AC0
74631AF6 |. 6A 40 PUSH 40 ; |NewProtect = PAGE_EXECUTE_READWRITE
74631AF8 |. 89B8 98540D00 MOV DWORD PTR DS:[EAX+D5498],EDI ; |
74631AFE |. 6A 06 PUSH 6 ; |Size = 6
74631B00 |. 05 5C540D00 ADD EAX,0D545C ; |
74631B05 |. 50 PUSH EAX ; |Address = NULL
74631B06 |. FFD6 CALL ESI ; \VirtualProtect
74631B08 |. A1 C42A6574 MOV EAX,DWORD PTR DS:[74652AC4]
74631B0D |. 89B8 5C540D00 MOV DWORD PTR DS:[EAX+D545C],EDI
74631B13 |. 5F POP EDI ; ntdll.770C97A0
74631B14 |. 5E POP ESI ; ntdll.770C97A0
74631B15 \. C3 RETN
ich hoffe du kannst damit was anfangen
oder du suchst dir selber alles aus dem geknackten client