JosephChalhoub1
13,374 views
6 slides
Oct 24, 2021
Slide 1 of 6
1
2
3
4
5
6
About This Presentation
How to decompile ex4 to mq4 with memory dumping
Size: 268.97 KB
Language: en
Added: Oct 24, 2021
Slides: 6 pages
Slide Content
How to decompile an EX4 file to an MQ4 source code?
I will explain where I am in the process of decompile ex4 to mq4 (Ex4 build 600+). In this
video you will find a valuable and unique content on how to use the reverse engineering
and the memory dumping methodology to convert ex4 to mq4, and in a later stage ex5 to
mq5.
In order to reach our target, we need to accomplish the following points:
1 – You need to use the x32dbg or x64dbg debugger
2 – Install the scyllahide plugin
3 – Find the breakpoint of OnInit() or Start() method
4 – Bypass the ExpertRemove() and Init_Failed()
5 – Dump patch ex4 from allocated memory
CONVERT EX4 TO MQ4 FOR BUILD VERSION < 600
To convert such files you need to access our software here in order to decompile ex4 to
mq4
You provide your Name, your email and your ex4 file, and automatically the mq4 file will be
converted automatically.
CONVERT EX4 TO MQ4 FOR BUILD VERSION >= 600
In order to decompile such files, we need to use the reverse engineering and memory
dumping, we already made a big progress with reverse engineering process
We are using the x32dbg debugger to attach the metatrader4 which already contain the ex4
that we need to crack.
The attached indicator is an ex4 build with 600+
This is the x32dbg debugger, we use this debugger to attach the MT4 process, and to
search for the name of the ex4
We search for a specific text by right clicking the debugger Search for -> Current module -
> String references
We search for the ex4 indicator name and we double click it
By that way, we caught the location of the indicator in the memory
Now we need to search ExpertRemove(). This function is jumping point, which is used by
Metaquote to stop us from accessing the content of the indicator. So we should bypass this
function.
Visit our website for guidance
https://rpchost.com/