[Arkshine]

Why 33 hex characters?

Again, again and again, read the tutorial. All is already written, it's amazing how it seems actually you have not read it.

Still not working:

Why don't you do something carefully ? You have remove one byte, 0x57, why ? Obviously it can't work.

[0x55,0x8B,0xEC,0x56,0x57,0x8B,0x7D,"*",0x85,0xFF,0x75,"*",0x68,"*","*","*","*",0xE8,"*","*","*","*",0x83,0xC4,"*",0x33,0xC0,0x5F,0x5E,0x5D,0xC3,0x8B,0x75]

Tested and found.

Please, check carefully what you are doing before posting.

[S34Qu4K3]

I´ve readed your tutorial at least 3 times, but you´re right, I don´t understand some things. I´ll read it again

But still not working for me
[IMG]http://img19.**************/img19/6494/jasnd.png[/IMG]

Sig

PHP Code:

{
    "name"       : "SV_CheckProtocol",
    "library"    : "engine",
    "arguments"  :
    [
        {
            "type" : "int"
        },
        {
            "type" : "int"
        }
    ],
    "identifiers":
    [
        {
            "os"    : "windows",
            "mod"   : "cstrike",
            "value" : [0x55,0x8B,0xEC,0x56,0x57,0x8B,0x7D,"*",0x85,0xFF,0x75,"*",0x68,"*","*","*","*",0xE8,"*","*","*","*",0x83,0xC4,"*",0x33,0xC0,0x5F,0x5E,0x5D,0xC3,0x8B,0x75]
        }
    ]
} 


I´ve checked all again and Orpheu cannot find the function
I have the Beta Update in my hlds

EDIT: A friend tried it and works, something is wrong with my hlds

[Arkshine]

Is the hlbeta update installed ?

[S34Qu4K3]

Yes

[souvikdas95]

Doesn't work :\

[Arkshine]

That's too bad.

[souvikdas95]

any help on that?

[Arkshine]

If you want help, start to stop post like "doesn't work" which doesn't help at all and make it feel to provide you a troll answer ; as you did not even care to explain what you've done exactly, what you're using, so basically concrete informations to avoid helpers to use their limited clairvoyance power.

[souvikdas95]

Sorry. I did not have any bad thoughts. Anyways I respect your opinion. I won't say anything like that again. I just put the signature file and it showed "NOT FOUND" while parsing the file. I tried the sample plugin he made on 1st page and it showed Function Not Found error although I did put the file in function folder. I used :

[0x55,0x8B,0xEC,0x56,0x57,0x8B,0x7D,"*",0x85,0 xFF,0x75,"*",0x68,"*","*","*","*",0xE8,"*","* ","*","*",0x83,0xC4,"*",0x33,0xC0,0x5F,0x5E,0 x5D,0xC3,0x8B,0x75]

which was suggested by you. Please can you correct it or make a new plugin on it? Please. I request you

[souvikdas95]

.text:01D98020 55 push ebp .text:01D98021 8B EC mov ebp, esp .text:01D98023 56 push esi .text:01D98024 57 push edi ; char .text:01D98025 8B 7D 08 mov edi, [ebp+arg_0] .text:01D98028 85 FF test edi, edi .text:01D9802A 75 13 jnz short loc_1D9803F .text:01D9802C 68 E0 2D E6 01 push offset aSv_checkprotoc ; "SV_CheckProtocol: Null address\n" .text:01D98031 E8 9A 3F 01 00 call sub_1DABFD0 .text:01D98036 83 C4 04 add esp, 4 .text:01D98039 33 C0 xor eax, eax .text:01D9803B 5F pop edi .text:01D9803C 5E pop esi .text:01D9803D 5D pop ebp .text:01D9803E C3 retn

This is what I found ... can you tell me now what to do? I did not understand your tutorial about sorting the HEX data and putting "*" in required places...