Okay, So let’s say I have an OP-Code 0x1DAE witch I received to server, I am guessing it is CMSG packet.
Next step is would be decompiling the exe with IDA right ? So after I have the pseudo C code I can ether use IDA or Notepad++ to search n stuff.
My question is how to search for an opcode ?
I have two ways.
First one is taking 0x1DAE and making it 0x1DA and then CTRL+F and it lead me to:
[ol][li][COLOR=rgb(0,0,136)]case[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]0x1DAu[COLOR=rgb(102,102,0)]:[/li]
[li][COLOR=rgb(0,0,0)]sub_73DD10[COLOR=rgb(102,102,0)](([COLOR=rgb(0,0,136)]int[COLOR=rgb(102,102,0)])&[COLOR=rgb(0,0,0)]v80[COLOR=rgb(102,102,0)],[COLOR=rgb(0,0,0)] v5[COLOR=rgb(102,102,0)],[COLOR=rgb(0,0,0)] a2[COLOR=rgb(102,102,0)],[COLOR=rgb(0,0,0)] a5[COLOR=rgb(102,102,0)],[COLOR=rgb(0,0,0)] a3[COLOR=rgb(102,102,0)]);[/li] [li][COLOR=rgb(0,0,0)]sub_6F9DB1COLOR=rgb(102,102,0);[/li] [li][COLOR=rgb(0,0,0)]sub_726899COLOR=rgb(102,102,0);[/li] [li][COLOR=rgb(0,0,136)]goto[COLOR=rgb(0,0,0)] LABEL_673[COLOR=rgb(102,102,0)];[/li][/ol]
Second one is taking 0x1DAE and making it 1DAE and then again use CTRL + F, and then it lead me into:
[ol][li][COLOR=rgb(136,0,0)]//----- (00C1DAE0) --------------------------------------------------------[/li]
[li][COLOR=rgb(0,0,136)]unsigned[COLOR=rgb(0,0,0)] [COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] __cdecl sub_C1DAE0[COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] a1[COLOR=rgb(102,102,0)],[COLOR=rgb(0,0,0)] [COLOR=rgb(0,0,136)]unsigned[COLOR=rgb(0,0,0)] [COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] a2[COLOR=rgb(102,102,0)])[/li] [li][COLOR=rgb(102,102,0)]{[/li] [li][COLOR=rgb(0,0,136)]unsigned[COLOR=rgb(0,0,0)] [COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] v2[COLOR=rgb(102,102,0)];[COLOR=rgb(0,0,0)] [COLOR=rgb(136,0,0)]// edi@1[/li] [li][COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] v3[COLOR=rgb(102,102,0)];[COLOR=rgb(0,0,0)] [COLOR=rgb(136,0,0)]// ebx@2[/li] [li][COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] v4[COLOR=rgb(102,102,0)];[COLOR=rgb(0,0,0)] [COLOR=rgb(136,0,0)]// eax@3[/li] [li][COLOR=rgb(0,0,136)]unsigned[COLOR=rgb(0,0,0)] [COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] v6[COLOR=rgb(102,102,0)];[COLOR=rgb(0,0,0)] [COLOR=rgb(136,0,0)]// [sp+4h] [bp-4h]@1[/li] [li][COLOR=rgb(0,0,0)] [/li] [li][COLOR=rgb(0,0,0)]v2 [COLOR=rgb(102,102,0)]=[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]0[COLOR=rgb(102,102,0)];[/li] [li][COLOR=rgb(0,0,0)]v6 [COLOR=rgb(102,102,0)]=[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]0[COLOR=rgb(102,102,0)];[/li] [li][COLOR=rgb(0,0,136)]if[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)] a2 [COLOR=rgb(102,102,0)]<[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]0x100[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)])[/li] [li][COLOR=rgb(102,102,0)]{[/li] [li][COLOR=rgb(0,0,0)]v3 [COLOR=rgb(102,102,0)]=[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)](([COLOR=rgb(0,0,136)]int[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)]__cdecl [COLOR=rgb(102,102,0)]**)([COLOR=rgb(0,0,0)]_DWORD[COLOR=rgb(102,102,0)]))([COLOR=rgb(0,0,0)]a1 [COLOR=rgb(102,102,0)]+[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]20[COLOR=rgb(102,102,0)]))(([COLOR=rgb(0,0,0)]_WORD [COLOR=rgb(102,102,0)])(([COLOR=rgb(0,0,0)]_DWORD [COLOR=rgb(102,102,0)])([COLOR=rgb(0,0,0)]a1 [COLOR=rgb(102,102,0)]+[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]16[COLOR=rgb(102,102,0)])[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]+[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]2[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)][COLOR=rgb(0,0,0)] a2[COLOR=rgb(102,102,0)]));[/li] [li][COLOR=rgb(0,0,136)]if[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)]_DWORD [COLOR=rgb(102,102,0)])([COLOR=rgb(0,0,0)]a1 [COLOR=rgb(102,102,0)]+[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]24[COLOR=rgb(102,102,0)])[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]>[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]0u[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)])[/li] [li][COLOR=rgb(102,102,0)]{[/li] [li][COLOR=rgb(0,0,136)]while[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]1[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)])[/li] [li][COLOR=rgb(102,102,0)]{[/li] [li][COLOR=rgb(0,0,0)]v4 [COLOR=rgb(102,102,0)]=[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)]_DWORD [COLOR=rgb(102,102,0)])(([COLOR=rgb(0,0,0)]_DWORD [COLOR=rgb(102,102,0)])([COLOR=rgb(0,0,0)]a1 [COLOR=rgb(102,102,0)]+[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]28[COLOR=rgb(102,102,0)])[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]+[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]4[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)][COLOR=rgb(0,0,0)] v2[COLOR=rgb(102,102,0)]);[/li] [li][COLOR=rgb(0,0,136)]if[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)] v4 [COLOR=rgb(102,102,0)])[/li] [li][COLOR=rgb(102,102,0)]{[/li] [li][COLOR=rgb(0,0,136)]if[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)]_BYTE [COLOR=rgb(102,102,0)])[COLOR=rgb(0,0,0)]v4 [COLOR=rgb(102,102,0)]==[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)]_BYTE [COLOR=rgb(102,102,0)])[COLOR=rgb(0,0,0)]v3 [COLOR=rgb(102,102,0)]&&[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]![COLOR=rgb(0,0,0)]sub_A6FFE0[COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)]v4[COLOR=rgb(102,102,0)],[COLOR=rgb(0,0,0)] v3[COLOR=rgb(102,102,0)])[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)])[/li] [li][COLOR=rgb(0,0,136)]break[COLOR=rgb(102,102,0)];[/li] [li][COLOR=rgb(102,102,0)]}[/li] [li][COLOR=rgb(102,102,0)]++[COLOR=rgb(0,0,0)]v2[COLOR=rgb(102,102,0)];[/li] [li][COLOR=rgb(0,0,136)]if[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)] v2 [COLOR=rgb(102,102,0)]>=[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)]([COLOR=rgb(0,0,0)]_DWORD [COLOR=rgb(102,102,0)]*)([COLOR=rgb(0,0,0)]a1 [COLOR=rgb(102,102,0)]+[COLOR=rgb(0,0,0)] [COLOR=rgb(0,102,102)]24[COLOR=rgb(102,102,0)])[COLOR=rgb(0,0,0)] [COLOR=rgb(102,102,0)])[/li] [li][COLOR=rgb(0,0,136)]return[COLOR=rgb(0,0,0)] v6[COLOR=rgb(102,102,0)];[/li] [li][COLOR=rgb(102,102,0)]}[/li] [li][COLOR=rgb(0,0,0)]v6 [COLOR=rgb(102,102,0)]=[COLOR=rgb(0,0,0)] v2[COLOR=rgb(102,102,0)];[/li] [li][COLOR=rgb(102,102,0)]}[/li] [li][COLOR=rgb(102,102,0)]}[/li] [li][COLOR=rgb(0,0,136)]return[COLOR=rgb(0,0,0)] v6[COLOR=rgb(102,102,0)];[/li] [li][COLOR=rgb(102,102,0)]}[/li] [li][COLOR=rgb(0,0,0)] [/li][/ol]
So I would like to ask, witch is correct way for search opcodes and theyre structures ?
The first option did give me a lot of HEX values, maybe it’s related ?