Quote:
Originally Posted by westernnoob
lol i firgured out the music when u start co now i want to get rid of the gay site when u exit co plz help >_< im stupid with this stuff xD
|
Alright well, Do you want a how to? read the Ollydbg guide in this section it show how to do it, but anyway I'll tell u how to do it, and I'll give u the addresses too.
First the how to, alright..
Open up Olly and load Conquer.exe right click -> hover over Search for -> click All referenced text strings.
A new window pops up, now scroll up and select the first line and right click -> press Search for text and enter co.91 and double click it you'll see this:
Code:
00495491 68 38935C00 PUSH Conquer.005C9338 ; ASCII "http://co.91.com/signout/"
now the line under it jumps to some code that opens ur internet explorer,
So when u take that jump you'll end here:
Code:
00495571 68 F4925C00 PUSH Conquer.005C92F4 ; ASCII "http://conquista.91.com/signout/"
00495576 53 PUSH EBX
00495577 FF76 20 PUSH DWORD PTR DS:[ESI+20]
0049557A FF15 30875700 CALL DWORD PTR DS:[<&SHELL32.ShellExecuteA>] ; SHELL32.ShellExecuteA
00495580 EB 02 JMP SHORT Conquer.00495584
Now just adjust that jump to jump to that last line in my code block.
when you did that go back to searchin for another co.91 string and do the same.
Now ill give u the exact 2 lines that needs to be changed and into what:
Code:
00495496 /E9 E5000000 JMP Conquer.00495580
004959E4 /E9 E5000000 JMP Conquer.00495ACE
That should do.
any questions????
