Jump to content

Guide L2 Extenders


Recommended Posts

  • 1 month later...
  • 2 weeks later...
  • 3 weeks later...
  • 3 months later...
  • 2 months later...
  • 3 months later...

after analyzing the leaked C4 PTS L2server.exe with latest IDA(6) for x64 i get no string names equal to function calls like thoose you describe but i can only find strings like Loading Multisell, Loading Henna etc. Most of functions named sub_******.  And the ida's debugger for x64 processes like this one don't work, it asks for something like "dbgsrv.exe". Am i doing something wrong?

Link to comment
Share on other sites

after analyzing the leaked C4 PTS L2server.exe with latest IDA(6) for x64 i get no string names equal to function calls like thoose you describe but i can only find strings like Loading Multisell, Loading Henna etc. Most of functions named sub_******.  And the ida's debugger for x64 processes like this one don't work, it asks for something like "dbgsrv.exe". Am i doing something wrong?

 

....you expect IDA to analyze and research everything for you?

There's a reason no one learns this in L2 (and probably other MMO's too).

 

You need to map stuff yourself - and if your well versed in IDC script you could write one that:

1. Fetches said strings

2. Renames the function within to said string.

 

Alternatively find a c4 func list - and write a simpler IDC script to rename functions.

(Which all of us do).

Link to comment
Share on other sites

mcbigmac i am not expect anything i just made this question because my results are not the same as thoose described by the author of this topic.

 

Could you please be more spesific about the IDC script? how it will map sub_"hexaddr" functions to real named functions?

Link to comment
Share on other sites

mcbigmac i am not expect anything i just made this question because my results are not the same as thoose described by the author of this topic.

 

Could you please be more spesific about the IDC script? how it will map sub_"hexaddr" functions to real named functions?

 

The Guide never tells you that it will name functions - it will only find the strings used by the L2SERVER_GUARD\CrashGuard to make Lin2Error debug info.

IDC is IDA's "script" language - google it.

 

 

If your missing the actual strings - go to StringTypes - change from ansi to Unicode (option 6),

close Strings Tab, alt+f12 again to reload unicode strings.

 

Problem solved.

 

Link to comment
Share on other sites

after analyzing the leaked C4 PTS L2server.exe with latest IDA(6) for x64 i get no string names equal to function calls like thoose you describe but i can only find strings like Loading Multisell, Loading Henna etc. Most of functions named sub_******.  And the ida's debugger for x64 processes like this one don't work, it asks for something like "dbgsrv.exe". Am i doing something wrong?

 

Best way is to find the L2Server Guard Stack function, that is pressent in almost every function in l2server, and then use the cross reference and you will see all functions where the Guard Stack is present, then is just renaming the functions in IDA.

Link to comment
Share on other sites

  • Vision changed the title to L2 Extenders

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

 Share

×
×
  • Create New...

AdBlock Extension Detected!

Our website is made possible by displaying online advertisements to our members.

Please disable AdBlock browser extension first, to be able to use our community.

I've Disbaled AdBlock