Welcome to the UnKnoWnCheaTs - Multiplayer Game Hacks and Cheats.
You have to register before you can post and see and access any of the advanced forum features, please click the register link to proceed to the registration form. To start viewing threads or posts, select a forum that you want to visit from the selection below.
Didn't find the third one yet though.
Anyways, whenever i try to hook the MD5Scan / MD5Init, i keep crashing. Is there a way to hook it succesfully and then alter the socket / strings etc?
Thanks!
P.S. There seems to be MD5 Update at 0x21D0, but the strings are encrypted i think, all it outputs is your GUID with a load of crap right after it ..
Thanks for responding , but i am not focussed on the Scanmem function.
I was more wondering on how to hook any of those MD5 Functions properly without crashing, mind sharing how to do so?
I had already stated some of the offsets, and still u didn't note where MD5 Crypt is ;-)
And btw, your PBCL seems out of date :O
Thanks for responding , but i am not focussed on the Scanmem function.
I was more wondering on how to hook any of those MD5 Functions properly without crashing, mind sharing how to do so?
I had already stated some of the offsets, and still u didn't note where MD5 Crypt is ;-)
And btw, your PBCL seems out of date :O
Thanks!
-.-
This is an old Dissemble of the pbcl file. I cba to do the new ones so you should just find them yourself.
Why don't you find MD5Crypt?
I Can't remember how I logged them. Try a Naked hook Maybe? Or Try not even Hooking at all
Thanks for responding , but i am not focussed on the Scanmem function.
I was more wondering on how to hook any of those MD5 Functions properly without crashing, mind sharing how to do so?
I had already stated some of the offsets, and still u didn't note where MD5 Crypt is ;-)
And btw, your PBCL seems out of date :O
Thanks!
Hello,
If your having trouble with code you have written, the first thing to do would be to post that code. You can hook these functions in many ways.
They each parse the 'this' ptr so if you hook them you must preserve the ecx register before calling your logging function and then restore it before returning.
Keep in mind the offsets change so just because you find some in a post does not mean they are the same now or the same for other games.
So as an example:
Code:
//typedef for orig call
typedef int (WINAPI *LPFN_sub_4011D0)(void* thisPtr, SOCKET s, u_short hostshort, const char *cp)
//hooked function declaration
int WINAPI sub_4011D0(void* thisPtr, SOCKET s, u_short hostshort, const char *cp);
__________________
I'm like a virus, you can delete me but I am never really gone.
Links die, searching does not. (Fravia : searchlores.org)
Solving problems requires effort not a college degree.
What exactly is your point as I was pointing out how to quickly see it is most likely the member of a class and how to typedef a function to preserve teh "this" pointer which in fact is held in ECX. I don't recall showing him how to hook anything.
BTW, typedef's like I posted can be used with MS detours as well, I do it all the time, for example the "void* thisPtr" becomes "LPDIRECT3DDEVICE9 pDevice" for DIP etc...
"Give a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime."
__________________
I'm like a virus, you can delete me but I am never really gone.
Links die, searching does not. (Fravia : searchlores.org)
Solving problems requires effort not a college degree.
What exactly is your point as I was pointing out how to quickly see it is most likely the member of a class and how to typedef a function to preserve teh "this" pointer which in fact is held in ECX. I don't recall showing him how to hook anything.
BTW, typedef's like I posted can be used with MS detours as well, I do it all the time, for example the "void* thisPtr" becomes "LPDIRECT3DDEVICE9 pDevice" for DIP etc...
"Give a man a fish and you feed him for a day. Teach a man to fish and you feed him for a lifetime."
I Was just going through Threads on UC and I found that one and decided to post it here... lol.
Thought that maybe it would help someone here.
lol... I'ma stab u for going all 'wize grazhuppa' on meh!
I Was just going through Threads on UC and I found that one and decided to post it here... lol.
Thought that maybe it would help someone here.
lol... I'ma stab u for going all 'wize grazhuppa' on meh!
Be careful with those "lol" you add on then end and sorry if I had a PMS (Message Posting Syndrome) moment as I get conveniently dyslexic at times
__________________
I'm like a virus, you can delete me but I am never really gone.
Links die, searching does not. (Fravia : searchlores.org)
Solving problems requires effort not a college degree.
Didn't find the third one yet though.
Anyways, whenever i try to hook the MD5Scan / MD5Init, i keep crashing. Is there a way to hook it succesfully and then alter the socket / strings etc?
Thanks!
P.S. There seems to be MD5 Update at 0x21D0, but the strings are encrypted i think, all it outputs is your GUID with a load of crap right after it ..
I think i remember there is a tool called where you can hook send/sendto calls and you can change the data at runtime, i remeber some guy talking to me about when he was using it for online casino stuff..wpepro09x.zip is the filename, you just need to google it
here is a screenshot so you know what the program looks like
I think i remember there is a tool called wespro where you hook send/sendto calls and you can change the data at runtime, i remeber some guy talking to me about when he was using it for online casino stuff..
Hello,
WPE* Pro is an old and deprecated application in my opinion, there exists better alternatives (one of which was developed in this forum if memory serves me correct, try searching for Max Power's threads). Wireshark is also a nice application.
Anyway, punk-buster traffic is encrypted as far as I know, one would have to hook before send/sendto in order to decipher the encryption. Depending on what you are trying to accomplish, hooking those winsock functions may or may not be useful. I wonder how punk-buster handles IPC?
WPE* Pro is an old and deprecated application in my opinion, there exists better alternatives (one of which was developed in this forum if memory serves me correct, try searching for Max Power's threads). Wireshark is also a nice application.
Anyway, punk-buster traffic is encrypted as far as I know, one would have to hook before send/sendto in order to decipher the encryption. Depending on what you are trying to accomplish, hooking those winsock functions may or may not be useful. I wonder how punk-buster handles IPC?
Regards,
- Quicktime
Traffic to/from servers is encrypted. They open a socket on localhost to communicate with services. There is also a named pipe to the kernel driver I believe.
__________________
I'm like a virus, you can delete me but I am never really gone.
Links die, searching does not. (Fravia : searchlores.org)
Solving problems requires effort not a college degree.
Traffic to/from servers is encrypted. They open a socket on localhost to communicate with services. There is also a named pipe to the kernel driver I believe.
Hey,
That's what I was guessing, I wonder if the localhost data is encrypted! Might be fun to play with...
I should have said obfuscated before someone corrects me. If encryption to them is XOR with static constants then it's not going to be a challenge. You only need to mouse over in IDA to get their "key" values
I've drawn the conclusion that their goal has changed to become the world record holder for the number of XOR ops in a single dll. In addition they have decided that hiding the word "summon" is important as seen below.
__________________
I'm like a virus, you can delete me but I am never really gone.
Links die, searching does not. (Fravia : searchlores.org)
Solving problems requires effort not a college degree.
...
