| View previous topic :: View next topic | 
	
	
		| Author | Message | 
	
		| Hack-Addict Master Cheater
 
  Reputation: 0 
 Joined: 20 Nov 2007
 Posts: 287
 
 
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| GMZorita Grandmaster Cheater Supreme
 
 ![]() Reputation: 0 
 Joined: 21 Mar 2007
 Posts: 1361
 
 
 | 
			
				|  Posted: Mon Aug 11, 2008 3:06 pm    Post subject: |   |  
				| 
 |  
				| You should post it in the binary section. Cgz on making it.
 _________________
 
 Gone |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| kitterz Grandmaster Cheater Supreme
 
 ![]() Reputation: 0 
 Joined: 24 Dec 2007
 Posts: 1268
 
 
 | 
			
				|  Posted: Mon Aug 11, 2008 3:34 pm    Post subject: |   |  
				| 
 |  
				| What does this do? |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| atom0s Moderator
 
  Reputation: 205 
 Joined: 25 Jan 2006
 Posts: 8587
 Location: 127.0.0.1
 
 | 
			
				|  Posted: Tue Aug 12, 2008 4:31 am    Post subject: |   |  
				| 
 |  
				|  	  | Code: |  	  | A-Squared Found nothing
 AntiVir
 Found nothing
 ArcaVir
 Found nothing
 Avast
 Found nothing
 AVG Antivirus
 Found nothing
 BitDefender
 Found nothing
 ClamAV
 Found nothing
 CPsecure
 Found nothing
 Dr.Web
 Found nothing
 F-Prot Antivirus
 Found nothing
 F-Secure Anti-Virus
 Found nothing
 Fortinet
 Found nothing
 Ikarus
 Found nothing
 Kaspersky Anti-Virus
 Found nothing
 NOD32
 Found nothing
 Norman Virus Control
 Found nothing
 Panda Antivirus
 Found nothing
 Sophos Antivirus
 Found nothing
 VirusBuster
 Found nothing
 VBA32
 Found nothing
 | 
 
 File appears clean, download and use at your own risk.
 
 @Hack-Addict: Please try to put some more detail in your main post about what this does so users will have a sense of what to do with it before downloading it.
 _________________
 
 - Retired. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| Hack-Addict Master Cheater
 
  Reputation: 0 
 Joined: 20 Nov 2007
 Posts: 287
 
 
 | 
			
				|  Posted: Tue Aug 12, 2008 8:35 am    Post subject: |   |  
				| 
 |  
				|  	  | Wiccaan wrote: |  	  |  	  | Code: |  	  | A-Squared Found nothing
 AntiVir
 Found nothing
 ArcaVir
 Found nothing
 Avast
 Found nothing
 AVG Antivirus
 Found nothing
 BitDefender
 Found nothing
 ClamAV
 Found nothing
 CPsecure
 Found nothing
 Dr.Web
 Found nothing
 F-Prot Antivirus
 Found nothing
 F-Secure Anti-Virus
 Found nothing
 Fortinet
 Found nothing
 Ikarus
 Found nothing
 Kaspersky Anti-Virus
 Found nothing
 NOD32
 Found nothing
 Norman Virus Control
 Found nothing
 Panda Antivirus
 Found nothing
 Sophos Antivirus
 Found nothing
 VirusBuster
 Found nothing
 VBA32
 Found nothing
 | 
 
 File appears clean, download and use at your own risk.
 
 @Hack-Addict: Please try to put some more detail in your main post about what this does so users will have a sense of what to do with it before downloading it.
 | 
 
 Meh, ok, And you know me, you know I wouldn't upload a virus.
   _________________
 
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| blackdog Expert Cheater
 
  Reputation: 0 
 Joined: 02 Aug 2006
 Posts: 101
 
 
 | 
			
				|  Posted: Tue Aug 12, 2008 5:38 pm    Post subject: |   |  
				| 
 |  
				| Hey not bad, I like the alarm clock part the best. Good job. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| nwongfeiying Grandmaster Cheater
 
 ![]() Reputation: 2 
 Joined: 25 Jun 2007
 Posts: 695
 
 
 | 
			
				|  Posted: Tue Aug 12, 2008 11:54 pm    Post subject: |   |  
				| 
 |  
				| I made an alarm clock too...mine is pretty sweet. I'm not going to post mine just yet though. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| Hack-Addict Master Cheater
 
  Reputation: 0 
 Joined: 20 Nov 2007
 Posts: 287
 
 
 | 
			
				|  Posted: Wed Aug 13, 2008 7:39 am    Post subject: |   |  
				| 
 |  
				| Thanks. 	  | blackdog wrote: |  	  | Hey not bad, I like the alarm clock part the best. Good job. | 
  Glad you like it, and the alarm clock I had the most trouble, cause I had like 4 things looping to eachother, that didn't make sense in the beginning. If you want the source for the alarm clock, PM me. _________________
 
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| blackdog Expert Cheater
 
  Reputation: 0 
 Joined: 02 Aug 2006
 Posts: 101
 
 
 | 
			
				|  Posted: Wed Aug 13, 2008 11:49 pm    Post subject: |   |  
				| 
 |  
				| What's it coded in? |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| sponge I'm a spammer
 
  Reputation: 1 
 Joined: 07 Nov 2006
 Posts: 6009
 
 
 | 
			
				|  Posted: Thu Aug 14, 2008 12:14 am    Post subject: |   |  
				| 
 |  
				| VB. 	  | blackdog wrote: |  	  | What's it coded in? | 
 _________________
 
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| blackdog Expert Cheater
 
  Reputation: 0 
 Joined: 02 Aug 2006
 Posts: 101
 
 
 | 
			
				|  Posted: Thu Aug 14, 2008 4:19 pm    Post subject: |   |  
				| 
 |  
				|  	  | sponge wrote: |  	  | VB. 	  | blackdog wrote: |  	  | What's it coded in? | 
 | 
 How can you tell? I'm not questioning your statement, just want to know how you can tell what it's coded in.
 |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| atom0s Moderator
 
  Reputation: 205 
 Joined: 25 Jan 2006
 Posts: 8587
 Location: 127.0.0.1
 
 | 
			
				|  Posted: Thu Aug 14, 2008 9:39 pm    Post subject: |   |  
				| 
 |  
				| Various ways to tell: 
 1. The icon. Standard VB5/6 icon. (Doesn't mean it's VB5/6 this way though.)
 2. Imports, the only import a VB application uses is MSVBVM60.dll as it handles DLL calls through its own functions.
 3. OEP look-alike. Open it in a debugger and you get:
 
 
  	  | Code: |  	  | 00401358 >  68 FC184000     PUSH All_in_o.004018FC 0040135D    E8 F0FFFFFF     CALL <JMP.&MSVBVM60.#100>
 | 
 
 This is the initialization call for VB. The push is the project settings and information structure.
 
 Just above the OEP in a VB application you also have the refernece table for the calls to the runtime:
 
 
  	  | Code: |  	  | 00401226   $- FF25 6C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaExcept>;  MSVBVM60.__vbaExceptHandler; Structured exception handler 0040122C   >- FF25 78104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFPExce>;  MSVBVM60.__vbaFPException
 00401232   .- FF25 38104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m16i
 00401238   .- FF25 2C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m32
 0040123E   .- FF25 8C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m32i
 00401244   $- FF25 18104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_m>;  MSVBVM60._adj_fdiv_m64
 0040124A   .- FF25 A0104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdiv_r>;  MSVBVM60._adj_fdiv_r
 00401250   .- FF25 40104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m16i
 00401256   .- FF25 9C104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m32
 0040125C   .- FF25 90104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m32i
 00401262   .- FF25 74104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fdivr_>;  MSVBVM60._adj_fdivr_m64
 00401268   .- FF25 58104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fpatan>;  MSVBVM60._adj_fpatan
 0040126E   .- FF25 70104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fprem>>;  MSVBVM60._adj_fprem
 00401274   .- FF25 20104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fprem1>;  MSVBVM60._adj_fprem1
 0040127A   .- FF25 08104000 JMP DWORD PTR DS:[<&MSVBVM60._adj_fptan>>;  MSVBVM60._adj_fptan
 00401280   .- FF25 B0104000 JMP DWORD PTR DS:[<&MSVBVM60._CIatan>]   ;  MSVBVM60._CIatan
 00401286   .- FF25 04104000 JMP DWORD PTR DS:[<&MSVBVM60._CIcos>]    ;  MSVBVM60._CIcos
 0040128C   .- FF25 C0104000 JMP DWORD PTR DS:[<&MSVBVM60._CIexp>]    ;  MSVBVM60._CIexp
 00401292   .- FF25 84104000 JMP DWORD PTR DS:[<&MSVBVM60._CIlog>]    ;  MSVBVM60._CIlog
 00401298   .- FF25 44104000 JMP DWORD PTR DS:[<&MSVBVM60._CIsin>]    ;  MSVBVM60._CIsin
 0040129E   .- FF25 64104000 JMP DWORD PTR DS:[<&MSVBVM60._CIsqrt>]   ;  MSVBVM60._CIsqrt
 004012A4   .- FF25 BC104000 JMP DWORD PTR DS:[<&MSVBVM60._CItan>]    ;  MSVBVM60._CItan
 004012AA   .- FF25 B8104000 JMP DWORD PTR DS:[<&MSVBVM60._allmul>]   ;  MSVBVM60._allmul
 004012B0   .- FF25 80104000 JMP DWORD PTR DS:[<&MSVBVM60.#534>]      ;  MSVBVM60.rtcBeep
 004012B6   .- FF25 14104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFreeVa>;  MSVBVM60.__vbaFreeVarList
 004012BC   .- FF25 54104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaVarTst>;  MSVBVM60.__vbaVarTstEq
 004012C2   .- FF25 00104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaStrI2>>;  MSVBVM60.__vbaStrI2
 004012C8   .- FF25 10104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFreeVa>;  MSVBVM60.__vbaFreeVar
 004012CE   .- FF25 A8104000 JMP DWORD PTR DS:[<&MSVBVM60.#612>]      ;  MSVBVM60.rtcGetTimeVar
 004012D4   .- FF25 7C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaStrVar>;  MSVBVM60.__vbaStrVarVal
 004012DA   .- FF25 50104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaStrCmp>;  MSVBVM60.__vbaStrCmp
 004012E0   .- FF25 3C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaObjSet>;  MSVBVM60.__vbaObjSetAddref
 004012E6   .- FF25 88104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaNew2>] ;  MSVBVM60.__vbaNew2
 004012EC   .- FF25 C8104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFreeSt>;  MSVBVM60.__vbaFreeStr
 004012F2   .- FF25 94104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaI4Str>>;  MSVBVM60.__vbaI4Str
 004012F8   .- FF25 AC104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFpI4>] ;  MSVBVM60.__vbaFpI4
 004012FE   .- FF25 0C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaStrI4>>;  MSVBVM60.__vbaStrI4
 00401304   .- FF25 34104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaOnErro>;  MSVBVM60.__vbaOnError
 0040130A   .- FF25 1C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFreeOb>;  MSVBVM60.__vbaFreeObjList
 00401310   .- FF25 98104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFreeSt>;  MSVBVM60.__vbaFreeStrList
 00401316   .- FF25 5C104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaStrR8>>;  MSVBVM60.__vbaStrR8
 0040131C   .- FF25 B4104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaStrMov>;  MSVBVM60.__vbaStrMove
 00401322   .- FF25 CC104000 JMP DWORD PTR DS:[<&MSVBVM60.#581>]      ;  MSVBVM60.rtcR8ValFromBstr
 00401328   .- FF25 C4104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaFreeOb>;  MSVBVM60.__vbaFreeObj
 0040132E   .- FF25 28104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaHresul>;  MSVBVM60.__vbaHresultCheckObj
 00401334   .- FF25 30104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaObjSet>;  MSVBVM60.__vbaObjSet
 0040133A   .- FF25 24104000 JMP DWORD PTR DS:[<&MSVBVM60.__vbaStrCat>;  MSVBVM60.__vbaStrCat
 00401340   .- FF25 68104000 JMP DWORD PTR DS:[<&MSVBVM60.EVENT_SINK_>;  MSVBVM60.EVENT_SINK_QueryInterface
 00401346   .- FF25 4C104000 JMP DWORD PTR DS:[<&MSVBVM60.EVENT_SINK_>;  MSVBVM60.EVENT_SINK_AddRef
 0040134C   .- FF25 60104000 JMP DWORD PTR DS:[<&MSVBVM60.EVENT_SINK_>;  MSVBVM60.EVENT_SINK_Release
 00401352   $- FF25 A4104000 JMP DWORD PTR DS:[<&MSVBVM60.#100>]      ;  MSVBVM60.ThunRTMain
 | 
 
 Eh.. theres tons of ways to tell, those probably being the easiest.
 _________________
 
 - Retired. |  | 
	
		| Back to top |  | 
	
		|  | 
	
		| blackdog Expert Cheater
 
  Reputation: 0 
 Joined: 02 Aug 2006
 Posts: 101
 
 
 | 
			
				|  Posted: Thu Aug 14, 2008 11:02 pm    Post subject: |   |  
				| 
 |  
				| Thanks, even though I didn't understand most of it. haha |  | 
	
		| Back to top |  | 
	
		|  | 
	
		|  |