I guess this is not the end, i'm not used to sigscanning bytes. Thankfully i've found sigmaker and comparing both the old and new binary i believe i've found EntityFactoryDictionnary in the new binary, but i'm still getting errors as i use the new sig i found, what i'm doing wrong?
IDA function i found :
Code:
.text:00433510 sub_433510 proc near ; CODE XREF: .text:loc_4335C8p
.text:00433510 55 push ebp
.text:00433511 89 E5 mov ebp, esp
.text:00433513 83 EC 28 sub esp, 28h
.text:00433516 80 3D 38 83 37 01 00 cmp ds:byte_1378338, 0
.text:0043351D 74 11 jz short loc_433530
.text:0043351F
.text:0043351F locret_43351F: ; CODE XREF: sub_433510+2Ej
.text:0043351F C9 leave
.text:00433520 B8 40 83 37 01 mov eax, offset unk_1378340
.text:00433525 C3 retn
.text:00433525 ; ---------------------------------------------------------------------------
.text:00433526 8D 76 00 8D BC 27 00 00 00 00 align 10h
.text:00433530
.text:00433530 loc_433530: ; CODE XREF: sub_433510+Dj
.text:00433530 C7 04 24 38 83 37 01 mov dword ptr [esp], offset byte_1378338
.text:00433537 E8 98 89 9D 00 call sub_E0BED4
.text:0043353C 85 C0 test eax, eax
.text:0043353E 74 DF jz short locret_43351F
.text:00433540 C7 44 24 0C 00 00 00 00 mov dword ptr [esp+0Ch], 0
.text:00433548 C7 44 24 08 00 00 00 00 mov dword ptr [esp+8], 0
.text:00433550 C7 44 24 04 01 00 00 00 mov dword ptr [esp+4], 1
.text:00433558 C7 04 24 40 83 37 01 mov dword ptr [esp], offset unk_1378340
.text:0043355F E8 9C 11 00 00 call sub_434700
.text:00433564 C7 04 24 38 83 37 01 mov dword ptr [esp], offset byte_1378338
.text:0043356B E8 6C 8A 9D 00 call sub_E0BFDC
.text:00433570 C7 44 24 08 40 45 30 01 mov dword ptr [esp+8], offset off_1304540
.text:00433578 C7 44 24 04 40 83 37 01 mov dword ptr [esp+4], offset unk_1378340
.text:00433580 C7 04 24 10 4E 43 00 mov dword ptr [esp], offset sub_434E10
.text:00433587 E8 2C 62 0C 01 call __cxa_atexit
.text:0043358C B8 40 83 37 01 mov eax, offset unk_1378340
.text:00433591 C9 leave
.text:00433592 C3 retn
.text:00433592 sub_433510 endp
and sig i've got out of it :
Code:
\x55\x89\xE5\x83\xEC\x00\x80\x3D\x00\x00\x00\x00\x00\x74\x00\xC9\xB8\x00\x00\x00\x00\xC3\x8D\x76\x00\xC7\x04\x24\x00\x00\x00\x00
\xE8\x00\x00\x00\x00\x85\xC0\x74\x00\xC7\x44\x24\x00\x00\x00\x00\x00\xC7\x44\x24\x00\x00\x00\x00\x00\xC7\x44\x24
\x00\x00\x00\x00\x00\xC7\x04\x24\x00\x00\x00\x00\xE8\x00\x00\x00\x00\xC7\x04\x24\x00\x00\x00\x00\xE8\x00\x00\x00\x00\xC7\x44\x24
\x00\x00\x00\x00\x00\xC7\x44\x24\x00\x00\x00\x00\x00\xC7\x04\x24\x00\x00\x00\x00\xE8\x00\x00\x00\x00\xB8\x00\x00\x00\x00\xC9\xC3