You ever stop to think that maybe they're hosting the 3x exp to get anyone with running hacks to come out of the woodworks? Thanksgiving is not until the 27th. I been playing since the first day open beta started, and I've never recalled them hosting a larger than normal (2x 2-3 hour) event so soon after releasing a patch with updated .exe's.Quote:
Insane, true :P If the crc gets published by the triple xp event, i'll share my hack to you (Mm for me its gonna be heaven 40k xp or so per monster and I kill 500 per minute LOL)
30m-1hr for 137-138 aint bad, is it?
Data from 4.1.10
11/13/2008 14:54
DungeonAbloMoonsII#16
11/13/2008 15:38
Raknohv#17
- My crappy laptop may not support your hack :D , nor my internet connection speed of 2mb hahahah, but thanks :DdQuote:
30m-1hr for 137-138 aint bad, is it?
11/13/2008 17:38
xhugox#18
I thougth that the CRC calculation got changed because there were no new files added though the calculation failed and we get an 'Invalid Client'.
I opened the new dekaron.exe in OllyDBG and found out that the calculation got changed indeed.
Old one by Nebular:
New one:
Because the crc calc got changed, the CRC calculation made by nebular will not work. (the one from .epvp segment).
I opened the new dekaron.exe in OllyDBG and found out that the calculation got changed indeed.
Old one by Nebular:
Code:
.text:0063BEA0 ; void __thiscall Calc_CRC(void *pCRCObject, void *pFileObject) .text:0063BEA0 Calc_CRC proc near ; DATA XREF: .data:00A48AF0o .text:0063BEA0 .text:0063BEA0 dwOutput = byte ptr -308h .text:0063BEA0 var_304 = dword ptr -304h .text:0063BEA0 var_300 = byte ptr -300h .text:0063BEA0 var_200 = byte ptr -200h .text:0063BEA0 var_100 = byte ptr -100h .text:0063BEA0 pFileObject = dword ptr 8 .text:0063BEA0 .text:0063BEA0 push ebp .text:0063BEA1 mov ebp, esp .text:0063BEA3 and esp, 0FFFFFFF8h .text:0063BEA6 sub esp, 30Ch .text:0063BEAC push ebx .text:0063BEAD push esi .text:0063BEAE push edi .text:0063BEAF push 500000h ; size_t .text:0063BEB4 mov ebx, ecx .text:0063BEB6 call ??2@YAPAXI@Z ; operator new(uint) .text:0063BEBB mov ecx, [ebp+pFileObject] .text:0063BEBE mov esi, eax .text:0063BEC0 mov eax, [ecx] .text:0063BEC2 add esp, 4 .text:0063BEC5 push esi .text:0063BEC6 push 500000h .text:0063BECB mov [esp+320h+var_304], esi .text:0063BECF call dword ptr [eax+8] ; -> 88E6C0 load file into buffer .text:0063BED2 push eax ; SourceLen .text:0063BED3 lea ecx, [esp+31Ch+dwOutput] .text:0063BED7 push ecx ; dwOutput .text:0063BED8 push esi ; pSource .text:0063BED9 mov ecx, ebx ; pCRCObject .text:0063BEDB call CalcFileCRC .text:0063BEE0 mov edx, dword ptr [esp+318h+dwOutput] .text:0063BEE4 mov ecx, [ebx+10h] .text:0063BEE7 movzx eax, dl .text:0063BEEA and eax, 800000FFh .text:0063BEEF jns short loc_63BEF8 .text:0063BEF1 dec eax .text:0063BEF2 or eax, 0FFFFFF00h .text:0063BEF7 inc eax .text:0063BEF8 .text:0063BEF8 loc_63BEF8: ; CODE XREF: Calc_CRC+4Fj .text:0063BEF8 mov esi, ecx .text:0063BEFA movzx eax, al .text:0063BEFD and esi, 0FFh .text:0063BF03 xor eax, esi .text:0063BF05 mov eax, ds:dword_BAE660[eax*4] .text:0063BF0C shr ecx, 8 .text:0063BF0F xor eax, ecx .text:0063BF11 mov ecx, edx .text:0063BF13 shr ecx, 8 .text:0063BF16 movzx ecx, cl .text:0063BF19 and ecx, 800000FFh .text:0063BF1F mov [ebx+10h], eax .text:0063BF22 jns short loc_63BF2C .text:0063BF24 dec ecx .text:0063BF25 or ecx, 0FFFFFF00h .text:0063BF2B inc ecx .text:0063BF2C .text:0063BF2C loc_63BF2C: ; CODE XREF: Calc_CRC+82j .text:0063BF2C mov esi, eax .text:0063BF2E movzx ecx, cl .text:0063BF31 and esi, 0FFh .text:0063BF37 xor ecx, esi .text:0063BF39 mov ecx, ds:dword_BAE660[ecx*4] .text:0063BF40 shr eax, 8 .text:0063BF43 xor ecx, eax .text:0063BF45 mov eax, edx .text:0063BF47 shr eax, 10h .text:0063BF4A movzx eax, al .text:0063BF4D and eax, 800000FFh .text:0063BF52 mov [ebx+10h], ecx .text:0063BF55 jns short loc_63BF5E .text:0063BF57 dec eax .text:0063BF58 or eax, 0FFFFFF00h .text:0063BF5D inc eax .text:0063BF5E .text:0063BF5E loc_63BF5E: ; CODE XREF: Calc_CRC+B5j .text:0063BF5E mov esi, ecx .text:0063BF60 movzx eax, al .text:0063BF63 and esi, 0FFh .text:0063BF69 xor eax, esi .text:0063BF6B mov eax, ds:dword_BAE660[eax*4] .text:0063BF72 shr ecx, 8 .text:0063BF75 xor eax, ecx .text:0063BF77 mov ecx, edx .text:0063BF79 shr ecx, 18h .text:0063BF7C and ecx, 800000FFh .text:0063BF82 mov [ebx+10h], eax .text:0063BF85 jns short loc_63BF8F .text:0063BF87 dec ecx .text:0063BF88 or ecx, 0FFFFFF00h .text:0063BF8E inc ecx .text:0063BF8F .text:0063BF8F loc_63BF8F: ; CODE XREF: Calc_CRC+E5j .text:0063BF8F mov esi, eax .text:0063BF91 movzx ecx, cl .text:0063BF94 push edx ; char .text:0063BF95 and esi, 0FFh .text:0063BF9B xor ecx, esi .text:0063BF9D shr eax, 8 .text:0063BFA0 xor eax, ds:dword_BAE660[ecx*4] .text:0063BFA7 lea edx, [esp+31Ch+var_300] .text:0063BFAB push offset aCrc32U ; "[CRC32] : %u " .text:0063BFB0 push edx ; char * .text:0063BFB1 mov [ebx+10h], eax .text:0063BFB4 mov [esp+324h+var_300], 0 .text:0063BFB9 call sub_412B00 .text:0063BFBE mov esi, eax .text:0063BFC0 mov eax, [ebx+10h] .text:0063BFC3 push eax ; char .text:0063BFC4 mov ecx, 40h .text:0063BFC9 lea edi, [esp+328h+var_200] .text:0063BFD0 rep movsd .text:0063BFD2 lea ecx, [esp+328h+var_300] .text:0063BFD6 push offset aCrc32TotalU ; "[CRC32] Total: %u " .text:0063BFDB push ecx ; char * .text:0063BFDC mov [esp+330h+var_300], 0 .text:0063BFE1 call sub_412B00 .text:0063BFE6 lea edx, [esp+330h+var_200] .text:0063BFED mov esi, eax .text:0063BFEF mov ecx, 40h .text:0063BFF4 lea edi, [esp+330h+var_100] .text:0063BFFB push edx .text:0063BFFC rep movsd .text:0063BFFE call sub_8090D0 .text:0063C003 lea eax, [esp+334h+var_100] .text:0063C00A push eax .text:0063C00B call sub_8090D0 .text:0063C010 mov ecx, [esp+338h+var_304] .text:0063C014 push ecx ; void * .text:0063C015 call j__free_0 .text:0063C01A add esp, 24h .text:0063C01D pop edi .text:0063C01E pop esi .text:0063C01F pop ebx .text:0063C020 mov esp, ebp .text:0063C022 pop ebp .text:0063C023 retn 4 .text:0063C023 Calc_CRC endp
Code:
0063D210 /. 55 PUSH EBP 0063D211 |. 8BEC MOV EBP,ESP 0063D213 |. 83E4 F8 AND ESP,FFFFFFF8 0063D216 |. 81EC 0C030000 SUB ESP,30C 0063D21C |. 53 PUSH EBX 0063D21D |. 56 PUSH ESI 0063D21E |. 57 PUSH EDI 0063D21F |. 68 00005000 PUSH dekaronN.00500000 0063D224 |. 8BD9 MOV EBX,ECX 0063D226 |. E8 24371D00 CALL dekaronN.0081094F 0063D22B |. 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8] 0063D22E |. 83C4 04 ADD ESP,4 0063D231 |. 8BF8 MOV EDI,EAX 0063D233 |. 8B06 MOV EAX,DWORD PTR DS:[ESI] 0063D235 |. 6A 00 PUSH 0 0063D237 |. 6A 00 PUSH 0 0063D239 |. 8BCE MOV ECX,ESI 0063D23B |. 897C24 1C MOV DWORD PTR SS:[ESP+1C],EDI 0063D23F |. FF50 04 CALL DWORD PTR DS:[EAX+4] 0063D242 |. 8B16 MOV EDX,DWORD PTR DS:[ESI] 0063D244 |. 57 PUSH EDI 0063D245 |. 68 00005000 PUSH dekaronN.00500000 0063D24A |. 8BCE MOV ECX,ESI 0063D24C |. FF52 08 CALL DWORD PTR DS:[EDX+8] 0063D24F |. 50 PUSH EAX 0063D250 |. 8D4424 14 LEA EAX,DWORD PTR SS:[ESP+14] 0063D254 |. 50 PUSH EAX 0063D255 |. 57 PUSH EDI 0063D256 |. 8BCB MOV ECX,EBX 0063D258 |. E8 33FFFFFF CALL dekaronN.0063D190 0063D25D |. 8B5424 10 MOV EDX,DWORD PTR SS:[ESP+10] 0063D261 |. 8B4B 14 MOV ECX,DWORD PTR DS:[EBX+14] 0063D264 |. 0FB6C2 MOVZX EAX,DL 0063D267 |. 25 FF000080 AND EAX,800000FF 0063D26C |. 79 07 JNS SHORT dekaronN.0063D275 0063D26E |. 48 DEC EAX 0063D26F |. 0D 00FFFFFF OR EAX,FFFFFF00 0063D274 |. 40 INC EAX 0063D275 |> 8BF1 MOV ESI,ECX 0063D277 |. 0FB6C0 MOVZX EAX,AL 0063D27A |. 81E6 FF000000 AND ESI,0FF 0063D280 |. 33C6 XOR EAX,ESI 0063D282 |. 8B0485 4008BB0>MOV EAX,DWORD PTR DS:[EAX*4+BB0840] 0063D289 |. C1E9 08 SHR ECX,8 0063D28C |. 33C1 XOR EAX,ECX 0063D28E |. 8BCA MOV ECX,EDX 0063D290 |. C1E9 08 SHR ECX,8 0063D293 |. 0FB6C9 MOVZX ECX,CL 0063D296 |. 81E1 FF000080 AND ECX,800000FF 0063D29C |. 8943 14 MOV DWORD PTR DS:[EBX+14],EAX 0063D29F |. 79 08 JNS SHORT dekaronN.0063D2A9 0063D2A1 |. 49 DEC ECX 0063D2A2 |. 81C9 00FFFFFF OR ECX,FFFFFF00 0063D2A8 |. 41 INC ECX 0063D2A9 |> 8BF0 MOV ESI,EAX 0063D2AB |. 0FB6C9 MOVZX ECX,CL 0063D2AE |. 81E6 FF000000 AND ESI,0FF 0063D2B4 |. 33CE XOR ECX,ESI 0063D2B6 |. 8B0C8D 4008BB0>MOV ECX,DWORD PTR DS:[ECX*4+BB0840] 0063D2BD |. C1E8 08 SHR EAX,8 0063D2C0 |. 33C8 XOR ECX,EAX 0063D2C2 |. 8BC2 MOV EAX,EDX 0063D2C4 |. C1E8 10 SHR EAX,10 0063D2C7 |. 0FB6C0 MOVZX EAX,AL 0063D2CA |. 25 FF000080 AND EAX,800000FF 0063D2CF |. 894B 14 MOV DWORD PTR DS:[EBX+14],ECX 0063D2D2 |. 79 07 JNS SHORT dekaronN.0063D2DB 0063D2D4 |. 48 DEC EAX 0063D2D5 |. 0D 00FFFFFF OR EAX,FFFFFF00 0063D2DA |. 40 INC EAX 0063D2DB |> 8BF1 MOV ESI,ECX 0063D2DD |. 0FB6C0 MOVZX EAX,AL 0063D2E0 |. 81E6 FF000000 AND ESI,0FF 0063D2E6 |. 33C6 XOR EAX,ESI 0063D2E8 |. 8B0485 4008BB0>MOV EAX,DWORD PTR DS:[EAX*4+BB0840] 0063D2EF |. C1E9 08 SHR ECX,8 0063D2F2 |. 33C1 XOR EAX,ECX 0063D2F4 |. 8BCA MOV ECX,EDX 0063D2F6 |. C1E9 18 SHR ECX,18 0063D2F9 |. 81E1 FF000080 AND ECX,800000FF 0063D2FF |. 8943 14 MOV DWORD PTR DS:[EBX+14],EAX 0063D302 |. 79 08 JNS SHORT dekaronN.0063D30C 0063D304 |. 49 DEC ECX 0063D305 |. 81C9 00FFFFFF OR ECX,FFFFFF00 0063D30B |. 41 INC ECX 0063D30C |> 8BF0 MOV ESI,EAX 0063D30E |. 0FB6C9 MOVZX ECX,CL 0063D311 |. 52 PUSH EDX 0063D312 |. 81E6 FF000000 AND ESI,0FF 0063D318 |. 33CE XOR ECX,ESI 0063D31A |. C1E8 08 SHR EAX,8 0063D31D |. 33048D 4008BB0>XOR EAX,DWORD PTR DS:[ECX*4+BB0840] 0063D324 |. 8D5424 1C LEA EDX,DWORD PTR SS:[ESP+1C] 0063D328 |. 68 ECAAA400 PUSH dekaronN.00A4AAEC ; ASCII "[CRC32] : %u " 0063D32D |. 52 PUSH EDX 0063D32E |. 8943 14 MOV DWORD PTR DS:[EBX+14],EAX 0063D331 |. C64424 24 00 MOV BYTE PTR SS:[ESP+24],0 0063D336 |. E8 6556DDFF CALL dekaronN.004129A0 0063D33B |. 8BF0 MOV ESI,EAX 0063D33D |. 8B43 14 MOV EAX,DWORD PTR DS:[EBX+14] 0063D340 |. 50 PUSH EAX 0063D341 |. B9 40000000 MOV ECX,40 0063D346 |. 8DBC24 2801000>LEA EDI,DWORD PTR SS:[ESP+128] 0063D34D |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0063D34F |. 8D4C24 28 LEA ECX,DWORD PTR SS:[ESP+28] 0063D353 |. 68 FCAAA400 PUSH dekaronN.00A4AAFC ; ASCII "[CRC32] Total: %u " 0063D358 |. 51 PUSH ECX 0063D359 |. C64424 30 00 MOV BYTE PTR SS:[ESP+30],0 0063D35E |. E8 3D56DDFF CALL dekaronN.004129A0 0063D363 |. 8D9424 3001000>LEA EDX,DWORD PTR SS:[ESP+130] 0063D36A |. 8BF0 MOV ESI,EAX 0063D36C |. B9 40000000 MOV ECX,40 0063D371 |. 8DBC24 3002000>LEA EDI,DWORD PTR SS:[ESP+230] 0063D378 |. 52 PUSH EDX 0063D379 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS> 0063D37B |. E8 70D31C00 CALL dekaronN.0080A6F0 0063D380 |. 8D8424 3402000>LEA EAX,DWORD PTR SS:[ESP+234] 0063D387 |. 50 PUSH EAX 0063D388 |. E8 63D31C00 CALL dekaronN.0080A6F0 0063D38D |. 8B4C24 34 MOV ECX,DWORD PTR SS:[ESP+34] 0063D391 |. 51 PUSH ECX 0063D392 |. E8 78622300 CALL dekaronN.0087360F 0063D397 |. 83C4 24 ADD ESP,24 0063D39A |. 5F POP EDI 0063D39B |. 5E POP ESI 0063D39C |. 5B POP EBX 0063D39D |. 8BE5 MOV ESP,EBP 0063D39F |. 5D POP EBP 0063D3A0 \. C2 0400 RETN 4 //search for [CRC32] : %u and you will find this function
11/13/2008 22:05
hyxodus#19
crc calculation has nothing to do with redirecting what files the crc is calculated by, however.
11/13/2008 23:47
bogger46#20
im not a hacker pro never wuz what i know is from the tuts i read
still even managed to unpack the exe's but i dont have a clue what to do whit
it to edit the exe to make it no crc.
back to google then :D
still even managed to unpack the exe's but i dont have a clue what to do whit
it to edit the exe to make it no crc.
back to google then :D