AntiWPA Forum

Hello,

I'm trying "IC 4.3 5.2 StringDecryptScript LabelsOllyDebug" for newer loader but after few days searching I can't find correct offset for VA_DecryCall and VA_DecryCallCore can anyone help me how to find it.

Thanks.

Oh dear thats years now.

Well in the beginning you use the script with the old and original version it was supposed to be used.

Load the Dll twice in olly. The base adress should stay the same.
If it's changing it's because of ASLR
Disable it using EMET.

Well VA_DecryCall is the adress of the Call that does the string decryption.
You may find that easy while debugging the ioncube dll and come across encrypted strings.