We have A working loader, ^Quote:
i cant do it, ill have to rr sro
which will cause me to connect for 10000 more hours
fuck theres none working loader in whole epvp
awesome...
Which unpacked client are you using?Quote:
it patches the security seed at address 0x49111E instead of 0x491D1E.
seems as if the sig for that is not working really.
would it be possible to get the address of the CoCreateGuid function and then use the offset to this address as well in the sig (since this func is called right before the current signature start).
// Security seed fix
if(bDoSecuritySeed)
{
do
{
BYTE securitySeedSig[] =
{
0x8B, 0x4C, 0x24, 0x04, 0x81, 0xE1, 0xFF, 0xFF,
0xFF, 0x7F
};
results = FindSignature(securitySeedSig, 0, sizeof(securitySeedSig), pMappedFileBase, size);
if(results.size() != 1)
{
printf("%i results were returned. Only %i were expected. Please use an updated signature.\n", results.size(), 1);
break;
}
DWORD secSeedAddr = (DWORD)(dwImageBase + results[0] + dwCodeOffset);
printf("secSeedAddr: 0x%X\n", secSeedAddr);
BYTE patch1[] = {0xB9, 0x33, 0x00, 0x00, 0x00, 0x90, 0x90, 0x90, 0x90, 0x90};
WriteBytes(secSeedAddr, patch1, sizeof(patch1));
printf("\n");
} while(false);
}
00491118 8B4C24 20 MOV ECX,DWORD PTR SS:[ESP+20] 0049111C 64:890D 00000000 MOV DWORD PTR FS:[0],ECX 00491123 59 POP ECX
I used an OllyDbgScript. The ASProtect section is left intact, which is why the exe is larger and also why your AV detects it as a 'virus'. If stripper didn't take out the ASProtect section, you'd see the same results.Quote:
i noticed your client (taken from page 13) is about ~12MB while mine is only ~9,5MB.
furthermore yours is detected as a possible thread by my antivirus.
did you use stripper or ollyscripts to unpack it?
Go to Bin directory and run edxSilkroadLoader_Lite.exeQuote:
Download it again, from the first post.Quote:
I looked into this more and the issue has to do with my address calculating code. The client the stripper generates is 'valid' since Windows loads it, but it unfortunately makes things a lot more complicated.Quote:
tested with your client now and its working.
the error seems to be related to the unpacking method used...
dwSizeLow: 9851392 dwSizeHigh: 0 GetImageBase: 400000 GetOEP: A1DD82 GetCodeStart: 401000 GetDataStart: C2F000 GetCodeSize: 82E000 GetCodeOffset: C00 GetDataOffset: C00 header.PointerToRawData: 8575488 secSeedAddr: 0x42DFFE logicalAddress1: 0xC38A40 patchAddress: 0x4CCE6C patchAddress: 0x5058C6 patchAddress: 0x673E9B nudePatchAddr: 0x8D4A4B zoomHackAddr: 0x640DE6 physicalKoreanStringAddress: 0xC73870 physicalChineseStringAddress: 0xC73868 physicalTaiwanStringAddress: 0xC73860 physicalJapanStringAddress: 0xC73858 physicalEnglishStringAddress: 0xC73850 physicalVietnamStringAddress: 0xC73848 logicalKoreanStringAddress: 0x6F028F logicalChineseStringAddress: 0x6F02B7 logicalTaiwanStringAddress: 0x6F02F0 logicalJapanStringAddress: 0x6F031D logicalEnglishStringAddress: 0x6F035D logicalVietnamStringAddress: 0x6F0396 physicalCharSelectStringAddress: 0xC73FDC logicalCharSelectStringAddress: 0x6F4169 callOffset: 0xFFD74E5D callAddr: 0x468FE0 physicalLauncherStringAddress: 0xC72858 logicalLauncherStringAddress: 0x6DB8C5 codecaveAddr: 0x6DB931 customMultiAddr: 0xD5E884 mutexStringAddress: 0xC728D0 patchAddress: 0x6DB850 macAddrSigAddr: 0x43B8CA codecaveAddr: 0x43B8D3 callOffset: 0xFFFD84A8 callAddr: 0x413D80 bindSigAddr: 0x9B6970
dwSizeLow: 10024960 dwSizeHigh: 0 GetImageBase: 400000 GetOEP: A44C42 GetCodeStart: 401000 GetDataStart: C50000 GetCodeSize: 84F000 GetCodeOffset: 0 GetDataOffset: 0 header.PointerToRawData: 8712192 anotherOffset: 3072 secSeedAddr: 0x491D1E logicalAddress1: 0xC591D0 patchAddress: 0x558349 patchAddress: 0x58CEB6 patchAddress: 0x700375 nudePatchAddr: 0x95783B zoomHackAddr: 0x6CDE66 physicalKoreanStringAddress: 0xC92BDC physicalChineseStringAddress: 0xC92BD4 physicalTaiwanStringAddress: 0xC92BCC physicalJapanStringAddress: 0xC92BC4 physicalEnglishStringAddress: 0xC92BBC physicalVietnamStringAddress: 0xC92BB4 logicalKoreanStringAddress: 0x77B4AF logicalChineseStringAddress: 0x77B4D7 logicalTaiwanStringAddress: 0x77B510 logicalJapanStringAddress: 0x77B550 logicalEnglishStringAddress: 0x77B590 logicalVietnamStringAddress: 0x77B5C9 physicalCharSelectStringAddress: 0xC93358 logicalCharSelectStringAddress: 0x77F329 callOffset: 0xFFD768BD callAddr: 0x4F5C00 physicalLauncherStringAddress: 0xC91C64 logicalLauncherStringAddress: 0x766FF5 codecaveAddr: 0x767061 customMultiAddr: 0xD88060 mutexStringAddress: 0xC91CD8 patchAddress: 0x766F80 macAddrSigAddr: 0x49C16A codecaveAddr: 0x49C173 callOffset: 0xFFFDB988 callAddr: 0x477B00 bindSigAddr: 0xA399E0