[Release] Unpacked XignCode Files

[HellSpider]

Hi.

I've unpacked the XignCode anti-cheat files in order to understand better how the anti-cheat works. These files wont work in runtime (because of the security certificate and stripped VirtualMachines), so you can't substitute the original files with these .

Note! This is not a XignCode bypass! These files are just for analyzing purposes!


List of files:

splash.xem		--> splash.bmp		--> XIGNCODE Splash Bitmap
tray.xem		--> tray.ico		--> XIGNCODE Tray Icon
x3.xem			--> x3.dll		--> XIGNCODE System
xm.exe			--> xm.exe		--> XIGNCODE Message Printer
xmag.xem		--> xmag.xem		--> XIGNCODE File Archive
xsg.xem			--> xsg.dll		--> XIGNCODE System Guard
xxd.xem			--> xxd.dll		--> XIGNCODE WatchDog Process

The file x3.dll was protected by Themida (one of the newest versions), and it had a part of its code virtualized. As I am not able to devirtualize Themida VMs I have stripped it from the file.

This thread is supposed to be a research thread of XignCode. If you have made some research you can post it in this thread and I will add it to the main post (with your approval of course) .


Loading of x3.xem:

 Spoiler

Dekaron.exe loads x3.xem into its process space with LoadLibraryW. Then the address of the first import (and only) of x3.xem is retrieved with GetProcAddress. If that fails, an error code will be set, code = 0xE0190401.



If the address of the export got retrieved successfully it will be called at 0x004024B8. Note that before the call a constant gets pushed onto the stack (PUSH 1). The call will return an address in the stack location pointed by ECX.



Because the constant 1 got pushed before the call, the JNZ at 0x69122477 does not jump. Unfortunately the execution continues inside Themida's VM, so tracing it will be of no use (we can't understand what really happens).



Remember the CALL EAX in picture 2? I let that call execute and returned to the code after that call. Now I have stepped to the second CALL instruction. It calls a value located in the stack (ESP+0xC), as you see it's the address returned by the previous call. This is an address in x3.xem image too.



Unfortunately, most of this procedure is virtualized too .

XignCode packet structure:

 Spoiler

BYTE		bTotalPackets	<- The amount of packets to be expected in one "thunk"
BYTE		bPacketIndex	<- The index of the packet
WORD		wDataLen	<- Hex number representing the amount of data in bytes
BUF?		xData		<- Data (size wDataLen)

To clarify, if the bTotalPackets byte is 7 ie, the first packet will have the bPacketIndex 0 next 1 next 2 and so forth until 6, {0,1,2,3,4,5,6} = 7 packets.

PacketCMD 2008C - XignCode receive
PacketCMD 2008D - XignCode answer

If I'm completely wrong, let me know .

XignCode kernel-mode hooks:

 Spoiler

NtCreateProcessEx

NtCreateUserProcess

NtDuplicateObject

NtOpenProcess

NtQuerySystemInformation

NtReadVirtualMemory

NtWriteVirtualMemory

NtSuspendProcess

NtSuspendThread

NtTerminateProcess

NtUserSendInput


+ Some other modifications

-Update Log-

~13.11.2010~

+ Initial release (XIGNCODE 3.1)

~19.01.2011~

+ Detailed file information
+ Basic packet structure


Archive password (without spaces):

w w w . e l i t e p v p e r s . d e

[iamlegend93]

I willl have a check on that.

[4the]

Thanks for sharing
Good stuff.

[1tamer1]

so i can hack with that ?

[elfulll]

so hell what we do with that ? cant make bypass xign from his files ?

[Redis]

Originally Posted by HellSpider

Note! This is not a XignCode bypass! These files are just for analyzing purposes!


This thread is supposed to be a research thread of XignCode. If you have made some research you can post it in this thread and I will add it to the main post (with your approval of course) .

No you CANNOT hack with that...
Read what is written, don't just cry all day "omg i want hacks"

[EliteDKTrader]

Tnx Instant. I'm going to look into it later.

[lord17]

well i hope bypass will be created soon

[Apocalisse]

Thank you, i'm gonna check this out

[GooniGooGoo]

Cheers

[1tamer1]

hey man i wanna ask what we can do with this?
what help us with?

[HellSpider]

I added some base info of loadup regarding x3.xem in a spoiler tag in the first post .

[huquinho]

Celebrities I was tinkering with Charles Proxy, was playing Dekaron and seen it this, I thought I can help in any way concerned
bypass.

[HellSpider]

Originally Posted by huquinho

Celebrities I was tinkering with Charles Proxy, was playing Dekaron and seen it this, I thought I can help in any way concerned
bypass.

Quite interesting, didn't know that there was whole directories of XignCode stuff on the same domain with the Dekaron updates .

[ChinkyTinky]

i think this just became really really interesting


hey xigncode uses this to load/dl xxd.xem