I'm just here to increase the number of functioning brain cells in this thread.
So, the line 4400-4401 are definitly nothing dangerous. It's simply the instructions that were overwritten when creating the hook on the so-called "engine". It's mostly a hook on the main loop of Guild Wars that allow to execute the command sent by GWA2.
You can see in the following screen the highlighted lines are the instructions replaced by the "jump" to the custom code. Screen capture here: [Only registered and activated users can see links. Click Here To Register...]
Second point: Of course virus total won't detect anything, it's a text file. There is simply not enough information to do any kind of relevant diagnostics, so what virus total tells you is meaningless in this case.
Third point: It's a completly garbage the claim that copy-pasting your password is safe. If the guy can open an r/w handle to the game, the password is there in clear.
Let's move to more interesting to the actual code for whoever is interesting and for whoever made those fixes.
So, you did restore the stack frame after the call of the functions, but you could improve that a bit. Let's take UseFunction as an example:
So, you added 4 pops at the end. It will work, but generally speaking you don't really want to pop in ebx, esi & edi, because they are "non-volatile registers". In this case, you could have done the following if you don't care about the return value:
Indeed, the return value is stored in eax. (eax & edx if 64 bits, like uint64_t or double)
But, you can do even better, you can restore the stack frame without affecting any registers. (That's in fact how the compiler does it)
Indeed, the stack is reversed (it grow down and shrink up), so adding 0x10 = 16 = 4 * 4 has the similar effect of poping 4 times.
Fourth and final point, there is a lot of random stuff and it's understandable, but there is also a bunch that could be taken from other ressources. Especially regarding how things are scanned. See here: [Only registered and activated users can see links. Click Here To Register...]
Finally, there is nothing malicious in the code, but you can expect some instabilities.
So, the line 4400-4401 are definitly nothing dangerous. It's simply the instructions that were overwritten when creating the hook on the so-called "engine". It's mostly a hook on the main loop of Guild Wars that allow to execute the command sent by GWA2.
You can see in the following screen the highlighted lines are the instructions replaced by the "jump" to the custom code. Screen capture here: [Only registered and activated users can see links. Click Here To Register...]
Second point: Of course virus total won't detect anything, it's a text file. There is simply not enough information to do any kind of relevant diagnostics, so what virus total tells you is meaningless in this case.
Third point: It's a completly garbage the claim that copy-pasting your password is safe. If the guy can open an r/w handle to the game, the password is there in clear.
Let's move to more interesting to the actual code for whoever is interesting and for whoever made those fixes.
So, you did restore the stack frame after the call of the functions, but you could improve that a bit. Let's take UseFunction as an example:
Code:
_('CommandUseSkill:')
_('mov ecx,dword[eax+C]')
_('push ecx')
_('mov ebx,dword[eax+8]')
_('push ebx')
_('mov edx,dword[eax+4]')
_('dec edx')
_('push edx')
_('mov eax,dword[MyID]')
_('push eax')
_('call UseSkillFunction')
_('pop eax')
_('pop edx')
_('pop ebx')
_('pop ecx')
_('ljmp CommandReturn')
Code:
_('pop eax')
_('pop eax')
_('pop eax')
_('pop eax')
But, you can do even better, you can restore the stack frame without affecting any registers. (That's in fact how the compiler does it)
Code:
_('add esp,10')
Fourth and final point, there is a lot of random stuff and it's understandable, but there is also a bunch that could be taken from other ressources. Especially regarding how things are scanned. See here: [Only registered and activated users can see links. Click Here To Register...]
Finally, there is nothing malicious in the code, but you can expect some instabilities.
