Hoking dll with ShadowDBG

[narkata]

Look at #10 post

I canot find save function can you atach SS ? plz

[ScanX]

good job XD...

[L0ЯD]

New update :)

[zEsko]

Put pictures of new update...please, because i`m very stupid and can`t understand :D

can`t Understand this:

   7. Mov dword ptr ds:[006B3005]
   8. eax Push [006B3007]
   9. Push Eax
  10. Call GetProcAddress
  11. Call Eax

FAQ:

   1. What is free space? INT OR DB 00

About offsets

   1. 006B3000 - Name of your dll
   2. 006B3005 - Free offset
   3. 006B3007 - Name of your PROCESS

If i hvent offsets in sourse noo need to change offsets right?
so if I haven`t offsets must do only this:

Load normal 1.00.16 game server on shadow or olly. 
Search for free space on gameserver 
Search in hex dump offset 006B3000 
There write name of your dll 
At game server free space write push 006B3000 
At second line write call LoadLibraryA

right?

[muminek35]

very good tutorial 10/10

[bramdebouvere]

thanks, nice guide