nProtect GameGuard & Game Monitor Rev 2376 / Rev 288

[blapanda]

Figured out, no matter if you run GG or got it killed, those files where created temporarily and disappearing(? or has anyone found them yet), if you try to locate them. Try to run the game with a killed GG and blocked nProtect* files, you won't be able to.

Results, blocking their access to the internet or the execution entirely:
nProtect Game Monitor Rev 2376 & nProtect GameGuard Launcher Rev 288:
"The game client encountered an error while running. Shutting down the game client.(4049)"

Anyone has a clue how to redirect their connections?
Currently not able to ping their destined IP and creating a loopback for that ****.

Here, some show-off:


So, there is clearly a heartbeat, snitcher, a ******* "backtracker", however you want to call it, fact is: It is still monitoring the game, regardless of the current GG-Killer. And yes, GG-Killer still works, GameMon.des/GameMon64.des is NOT running at all, the other two are, though, and are not listed on your process list!

Current safe methods staying undetected:
Macro possibilities with Logitech Gaming Software and (might be changed) AutoHotKey. (But avoid key spamming until the client freezes! That will be monitored as well.)
Dress/Headgear/Adornment/Hair mods, either replaced or added additionally, are good to go.

Grey-zoned:
VMWare seems to work, though I am not clearly sure how they will handle the "duplicate IP connection". Seeing it as a mutlibox or 2 physical machines. (I have had the issue, got banned for it, unbanned again after posting more than 2 physical machines with the shared IPv4 address).

Unsafe/Instaban methods:
Do not even dare to start Cheat Engine. Not hooked with the client, just started: Test account got banned within 18h. Call yourself lucky, if your test account gets banned but not your main, since they ban you IP vise... might affect other accounts too, while cheating with only one. (Don't TROLL, unless you have a dynamic IP!)
WPE is a no go. Don't use it.

[[P2933]Step29]

The first thing we want to do is Debug that message. We need to find out what is ot that's triggering that message, and how to obviously overwrite/bypass it. I have not done much research myself on this due to lack of time and busy with mabinogi. But if you have good reverse engineering skills. The text "System Message" can be found on Client.exe. Search for the string and find the PUSH address in the Disassembler. Once you've found the System Message function put a Brakepoint tracer on the RETN and follow along the tracer of where it's going out, try to analyze what is it trying to do, that'll be thehard part. Since the tracer will keep on RETNing I recommend you save those addresses and comparethe instances between a client with GG running and one with not. alternatively there is also a "Splash.jpg" function as well, you may want to analyse and find out what its doing _before_ it loads the splash screen.

Normally I do my debugging in cheat engine. But in this case because the initialization is way too fast. You'll probably going to need to use OllyDBG, with Phant0m and Stealth64 plugins.

[meak1]

the version.dll currently works, spent your time to get into the game with your Dll or Hack, in some Weeks they update their Hackshield completly i heared :L

it's not their finished Update, currently they work on Eu Hackshield D;

i know if the Gameguard is bypassed they still log the Data but who cares, if u only read their memory ;c

Edit: Hackshield = Hack Shield

[[P2933]Step29]

Originally Posted by meak1

the version.dll currently works, spent your time to get into the game with your Dll or Hack, in some Weeks they update their Hackshield completly i heared :L

it's not their finished Update, currently they work on Eu Hackshield D;

i know if the Gameguard is bypassed they still log the Data but who cares, if u only read their memory ;c

Okay, first of all You are mixxing up gameguard and hackshield. As most people have already known here Hackshield for all games has been discontiuned since December 2015 because Ahnlabs has budget problems or some stupid reason. You can look at their website or other sources.

2nd, about your "who cares if data is logged after disabling". Why are you even here? The point is because there has been numorious bans throwing around players who disabled gameguard. Regardless whenever if you have ever used any game hacks or not. . This is a problem especially to people with Low tier PCS or people who has incompatiblity with Gameguard. Basically the main point is We want to bypass gameguard for the optimization of the client, without the fear of getting banned for it . I don't know why I have to explain it.

We need a level 2 board here.

[orlyowlz]

I looked at this back during the beta in December so this is just off the top of my head.

This code is pretty much the first code the code section in client.exe executes. It parses the command line and does a bunch of initial checks. I do not remember all of them because my goal was something else and I somewhat skimmed over but I think there was:

- .ini verification
- registry key validation
- memory access checks??
- process and multi client check

Either way these checks were setting a bitfield at a constant address. Later, these fields are checked and error messages occur based on the values.

Again, this is just a hint because it's been a while and my memory is foggy. If you've unpacked the latest client it should be as easy as break-on-execute the .code section of client.exe. Step through till you see the command line being parsed on the stack and this code is not much further.