Well I thought its loading a "real" WRS from the directory into a buffer located @ this offset, but the file is hardcoded there <_<
Here are 2 functions for a byte signature:
Code:
bool CMisc::bDataCompare(const BYTE *pData, const BYTE *bMask, const char *szMask)
{
    for(; *szMask; ++szMask, ++pData, ++bMask)
	{
        if(*szMask == 'x' && *pData != *bMask) 
		{
            return false;
		}
	}

    return (*szMask) == NULL;
}

DWORD CMisc::FindPattern(DWORD dwAddress, DWORD dwLen, BYTE *bMask, char *szMask)
{
    for(DWORD i=0; i < dwLen; i++)
	{
		if(bDataCompare((BYTE*)(dwAddress + i), bMask, szMask) )
		{
			return (DWORD)(dwAddress + i);
		}
	}

    return 0;
}



Use:
Code:
FindPattern(0xEntryPoint, 0xSizeOfScan, (BYTE*)"\xFF\xFF\xFF\x00\x00\xFF\x00, "xxx??x?");



x = known byte
? = unknown byte (could change after an update etc.)

Last edited by Ch40zzC0d3r; 01/16/14 17:56.