[Release] TzPhQy Bot v1.8 (Exp)

Quote:

Originally Posted by dskrlin5 Ok. that is a new trianer, i know i need bypass, but if anyone can told me how that train worcks at [Only registered and activated users can see links. Click Here To Register...], please. TANKS. And..Mighty-Me: I can read, and I know when that trainer was UPDATED, but You dont know.

Quote:

Originally Posted by Thelune [Only registered and activated users can see links. Click Here To Register...] Really?:rtfm:

Quote:

Originally Posted by Thelune That is not answering the statement "Really?" :confused: I didn't say if it worked or not I'm asking why 20/41.. Never seen a bot that had anymore then 3-4 tops.. Just curious is all.. Never said anything to disrespect the creator.. Don't make it as I did..

Quote:

Originally Posted by Nebular Almost all of these alerts are caused by file TzPhQy-File-Kj.exe [Only registered and activated users can see links. Click Here To Register...] Here is disassembly listing of the file (note that MD5 hashes are the same in virus scan and listing), you can see it by yourself if you load it into IDA or OllyDbg.  Spoiler .data:00401000 ; .data:00401000 ; +-------------------------------------------------------------------------+ .data:00401000 ; | This file is generated by The Interactive Disassembler (IDA) | .data:00401000 ; | Copyright (c) 2007 by DataRescue sa/nv, <[Only registered and activated users can see links. Click Here To Register...]> | .data:00401000 ; | Licensed to: | .data:00401000 ; +-------------------------------------------------------------------------+ .data:00401000 ; .data:00401000 ; Input MD5 : 2C298952E3A09F56B6C81A669AF40600 .data:00401000 .data:00401000 ; File Name : E:\1.9\TzPhQy-Global\TzPhqy-File-Kj.exe .data:00401000 ; Format : Portable executable for 80386 (PE) .data:00401000 ; Imagebase : 400000 .data:00401000 ; Section 1. (virtual address 00001000) .data:00401000 ; Virtual size : 0000006F ( 111.) .data:00401000 ; Section size in file : 00000200 ( 512.) .data:00401000 ; Offset to raw data for section: 00000400 .data:00401000 ; Flags C0000040: Data Readable Writable .data:00401000 ; Alignment : default .data:00401000 .data:00401000 .686p .data:00401000 .mmx .data:00401000 .model flat .data:00401000 .data:00401000 ; ================================================== ========================= .data:00401000 .data:00401000 ; Segment type: Pure data .data:00401000 ; Segment permissions: Read/Write .data:00401000 _data segment para public 'DATA' use32 .data:00401000 assume cs:_data .data:00401000 ;org 401000h .data:00401000 ; char CurrentDirectory[] .data:00401000 CurrentDirectory db '.\',0 ; DATA XREF: start+27o .data:00401003 ; char CommandLine[] .data:00401003 CommandLine db '.\GameGuard\GameMon.des',0 ; DATA XREF: start+36o .data:0040101B ; struct _STARTUPINFOA StartupInfo .data:0040101B StartupInfo _STARTUPINFOA <0> ; DATA XREF: startw .data:0040101B ; start+22o .data:0040105F ; struct _PROCESS_INFORMATION ProcessInformation .data:0040105F ProcessInformation _PROCESS_INFORMATION <0> ; DATA XREF: start+1Do .data:0040106F align 200h .data:0040106F _data ends .data:0040106F .code:00402000 ; Section 2. (virtual address 00002000) .code:00402000 ; Virtual size : 0000004B ( 75.) .code:00402000 ; Section size in file : 00000200 ( 512.) .code:00402000 ; Offset to raw data for section: 00000600 .code:00402000 ; Flags 60000020: Text Executable Readable .code:00402000 ; Alignment : default .code:00402000 ; ================================================== ========================= .code:00402000 .code:00402000 ; Segment type: Pure code .code:00402000 ; Segment permissions: Read/Execute .code:00402000 _code segment para public 'CODE' use32 .code:00402000 assume cs:_code .code:00402000 ;org 402000h .code:00402000 assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing .code:00402000 .code:00402000 ; =============== S U B R O U T I N E ======================================= .code:00402000 .code:00402000 ; Attributes: noreturn .code:00402000 .code:00402000 public start .code:00402000 start proc near .code:00402000 mov StartupInfo.cb, 44h .code:0040200A mov StartupInfo.wShowWindow, 5 .code:00402013 mov StartupInfo.dwFlags, 1 .code:0040201D push offset ProcessInformation ; lpProcessInformation .code:00402022 push offset StartupInfo ; lpStartupInfo .code:00402027 push offset CurrentDirectory ; ".\\" .code:0040202C push 0 ; lpEnvironment .code:0040202E push 30h ; dwCreationFlags .code:00402030 push 1 ; bInheritHandles .code:00402032 push 0 ; lpThreadAttributes .code:00402034 push 0 ; lpProcessAttributes .code:00402036 push offset CommandLine ; ".\\GameGuard\\GameMon.des" .code:0040203B push 0 ; lpApplicationName .code:0040203D call ds:CreateProcessA .code:00402043 push 0 ; uExitCode .code:00402045 call ds:ExitProcess .code:00402045 start endp .code:00402045 .code:00402045 ; --------------------------------------------------------------------------- .code:0040204B align 200h .code:0040204B _code ends .code:0040204B .idata:00403042 ; .idata:00403042 ; Imports from KERNEL32.DLL .idata:00403042 ; .idata:00403042 ; Section 3. (virtual address 00003000) .idata:00403042 ; Virtual size : 0000006E ( 110.) .idata:00403042 ; Section size in file : 00000200 ( 512.) .idata:00403042 ; Offset to raw data for section: 00000800 .idata:00403042 ; Flags C0000040: Data Readable Writable .idata:00403042 ; Alignment : default .idata:00403042 ; ================================================== ========================= .idata:00403042 .idata:00403042 ; Segment type: Externs .idata:00403042 ; _idata .idata:00403042 ; void __stdcall ExitProcess(UINT uExitCode) .idata:00403042 extrn ExitProcess:dword ; CODE XREF: start+45p .idata:00403042 ; DATA XREF: start+45r .idata:00403046 ; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation) .idata:00403046 extrn CreateProcessA:dword ; CODE XREF: start+3Dp .idata:00403046 ; DATA XREF: start+3Dr .idata:00403046 .idata:00403046 .idata:00403046 end start This file is essentially a launcher for bot, it only creates GameMon.des process and immediately exits. Why AV's so allergic on it - i don't know.Probably beause it is only 6kB in size and written in pure assembly language.Anyway, if you feel so nervous about that file, i will replace it with another one, which will not give any false positives.

Quote:

Originally Posted by Cautionzzzz lol why would people help with bots they dont wanna see anther out break of millions of bots