|
Cleaned. Please keep on topic.
Relevant to this post... I'm assuming you mean the addresses. You can find the address of the send loop by finding the binary string "55 8D AC 24 FC DF FF FF B8 04 20 00 00". The expected command should be $55 PUSH EBP, after the RETN, CALL, and MOV. You can find the recv address by finding the referenced text string "catch error in process msg:%u.", then by tracing back to the first "TEST EAX, EAX". Following that will be "JNZ SHORT <Address>". That "Address" is the address of the recv function. Good luck.
|