Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


[Help Request] Removing GG from Neuz client

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
Eyalos
Master Cheater
Reputation: 0

Joined: 03 Oct 2006
Posts: 343
PostPosted: Sat May 03, 2008 2:35 am    Post subject: [Help Request] Removing GG from Neuz client Reply with quote
Hi all,
I was trying to figure how to "un-initialize" GameGuard from the FlyFF client (Neuz.exe), I've been checking the initialization in the call of CreateProcessA, but It seems that any change will keep notifying about errors of GameGuard.

the mov eax, 262 is usually the check of GameGuard (I think?)
And when trying to change it to 755 (remove the check at all) it doesnt seem to do anything.

So my opinion is that GameGuard is storing its check somewhere else OR the Game Client itself has more checks for GameGuard's initialization.

Here's the CreateProcessA section:
Code:
00429B95   . 52             PUSH EDX                                 ; /pProcessInfo
00429B96   . 50             PUSH EAX                                 ; |pStartupInfo
00429B97   . 6A 00          PUSH 0                                   ; |CurrentDir = NULL
00429B99   . 6A 00          PUSH 0                                   ; |pEnvironment = NULL
00429B9B   . 6A 00          PUSH 0                                   ; |CreationFlags = 0
00429B9D   . 6A 00          PUSH 0                                   ; |InheritHandles = FALSE
00429B9F   . 6A 00          PUSH 0                                   ; |pThreadSecurity = NULL
00429BA1   . 6A 00          PUSH 0                                   ; |pProcessSecurity = NULL
00429BA3   . 51             PUSH ECX                                 ; |CommandLine
00429BA4   . 6A 00          PUSH 0                                   ; |ModuleFileName = NULL
00429BA6   . FF15 0C947E00  CALL DWORD PTR DS:[<&kernel32.CreateProc>; \CreateProcessA


And there's a call of MessageDialogA for showing the Initializations Error, and ExitProcess for crashing the game:
Code:
006322EB  |. 6A 00          PUSH 0                                   ; /Style = MB_OK|MB_APPLMODAL
006322ED  |. 68 78D68B00    PUSH Unpacked.008BD678                   ; |Title = "nProtect GameGuard"
006322F2  |. 56             PUSH ESI                                 ; |Text
006322F3  |. 51             PUSH ECX                                 ; |hOwner => NULL
006322F4  |. FF15 48977E00  CALL DWORD PTR DS:[<&user32.MessageBoxA>>; \MessageBoxA
006322FA  |> 6A FF          PUSH -1                                  ; /ExitCode = FFFFFFFF
006322FC  \. FF15 00957E00  CALL DWORD PTR DS:[<&kernel32.ExitProces>; \ExitProcess


Anyways, I uploaded an Unpacked Client for those who wanna help out Wink
http://www4.zippyshare.com/v/56646867/file.html
Well maybe some of you can hint without it or by reading my description.

Thanks in advance,
Eyalos.
Back to top
View user's profile Send private message MSN Messenger
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Sat May 03, 2008 2:54 am    Post subject: Reply with quote
I want to help you with this, but first of all: why do you wanna disable flyff's gameguard? Everything in flyff is serverside except for you're current location. So the only thing you could make is a teleport hack, and you can do that while gameguard is running (I did).
Also, how did you unpack the client? I tried but failed, and I would really like to know how you did it.
About GG's check: where do you see a mov eax, 262
Back to top
View user's profile Send private message
Eyalos
Master Cheater
Reputation: 0

Joined: 03 Oct 2006
Posts: 343
PostPosted: Sat May 03, 2008 3:49 am    Post subject: Reply with quote
tombana wrote:
I want to help you with this, but first of all: why do you wanna disable flyff's gameguard? Everything in flyff is serverside except for you're current location. So the only thing you could make is a teleport hack, and you can do that while gameguard is running (I did).
Also, how did you unpack the client? I tried but failed, and I would really like to know how you did it.
About GG's check: where do you see a mov eax, 262


I unpacked it using a ASProtect script in OllyDBG.
And the GG check is placed right in:

OllyDBG wrote:
007B5E0E . E8 BDFBFFFF CALL Unpacked.007B59D0
007B5E13 . 83C4 08 ADD ESP,8
007B5E16 . B8 62020000 MOV EAX,262
007B5E1B . 5F POP EDI
007B5E1C . 5E POP ESI
007B5E1D . 5B POP EBX
007B5E1E . 59 POP ECX
007B5E1F . C3 RETN
007B5E20 > A1 6C24A600 MOV EAX,DWORD PTR DS:[A6246C]
007B5E25 . 85C0 TEST EAX,EAX
007B5E27 . 75 24 JNZ SHORT Unpacked.007B5E4D
007B5E29 . 68 58F18C00 PUSH Unpacked.008CF158
007B5E2E . E8 DD580000 CALL Unpacked.007BB710
007B5E33 . 83C4 04 ADD ESP,4
007B5E36 . 83C3 20 ADD EBX,20
007B5E39 . 50 PUSH EAX
007B5E3A . 53 PUSH EBX
007B5E3B . E8 90FBFFFF CALL Unpacked.007B59D0
007B5E40 . 83C4 08 ADD ESP,8
007B5E43 . B8 8A020000 MOV EAX,28A
007B5E48 . 5F POP EDI
007B5E49 . 5E POP ESI
007B5E4A . 5B POP EBX
007B5E4B . 59 POP ECX
007B5E4C . C3 RETN
007B5E4D > A1 7C24A600 MOV EAX,DWORD PTR DS:[A6247C]
007B5E52 . 85C0 TEST EAX,EAX
007B5E54 . 74 46 JE SHORT Unpacked.007B5E9C
007B5E56 . 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C]
007B5E5A . C74424 0C 0000>MOV DWORD PTR SS:[ESP+C],0
007B5E62 . 51 PUSH ECX ; /pExitCode
007B5E63 . 50 PUSH EAX ; |hProcess => NULL
007B5E64 . FF15 2C927E00 CALL DWORD PTR DS:[<&kernel32.GetExitCod>; \GetExitCodeProcess


Well, I'm asking for help and I never said what im planing to do with that, but I just need the help, eventhough everything is server-sided, I cant stay with a GGless in-game, so its not for actual hacking process, more about "researching".
Back to top
View user's profile Send private message MSN Messenger
tombana
Master Cheater
Reputation: 2

Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
PostPosted: Sat May 03, 2008 4:23 am    Post subject: Reply with quote
Quote:
Well, I'm asking for help and I never said what im planing to do with that, but I just need the help, eventhough everything is server-sided, I cant stay with a GGless in-game, so its not for actual hacking process, more about "researching".

Sure, I was just wondering why. Wink

Why would mov eax, 262 be a check of gameguard?
Back to top
View user's profile Send private message
Eyalos
Master Cheater
Reputation: 0

Joined: 03 Oct 2006
Posts: 343
PostPosted: Sat May 03, 2008 4:28 am    Post subject: Reply with quote
tombana wrote:
Quote:
Well, I'm asking for help and I never said what im planing to do with that, but I just need the help, eventhough everything is server-sided, I cant stay with a GGless in-game, so its not for actual hacking process, more about "researching".

Sure, I was just wondering why. Wink

Why would mov eax, 262 be a check of gameguard?


Just because of that.
Thats the method they use to check for "if gameguard is running".
I'll just wait for a serious answer.

Thanks for your try Wink
Back to top
View user's profile Send private message MSN Messenger
rapion124
Grandmaster Cheater Supreme
Reputation: 0

Joined: 25 Mar 2007
Posts: 1095
PostPosted: Sat May 03, 2008 6:43 pm    Post subject: Reply with quote
Are you sure you unpacked it correctly? I still see some random code that loops around and does nothing.
Back to top
View user's profile Send private message
Eyalos
Master Cheater
Reputation: 0

Joined: 03 Oct 2006
Posts: 343
PostPosted: Sat May 03, 2008 11:12 pm    Post subject: Reply with quote
rapion124 wrote:
Are you sure you unpacked it correctly? I still see some random code that loops around and does nothing.


Already figured out.
Mods, you can lock.

Thanks for your help Wink
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites