[Release] Rohan Hacks

07/28/2008 04:49 suco2000#526
to Leisures

I notice the GM command address remain the same but damage animation and attack speed changes, did you find this yourself or got it from someone else, can you provide a tur to locate the address so ppl who can, can find the address for themself?
07/28/2008 05:17 Leisures#527
well..
normally before to patch something i look at the original code hoow it is then i patch it.
so if update come i just go to same addres then before and i scroll down a bt til i found similar ocde then before (or at last if it does the same thing) and remake it.
07/28/2008 05:18 woodyfly#528
Hmm i think it got patched? I ran the auto update and now it wont work.
07/28/2008 05:21 longdang#529
yp, they patched the hack, still the bot is working fine
07/28/2008 05:52 Leisures#530
they havent patched anything -.-
my still work.
07/28/2008 06:17 longdang#531
did you update the client yet? cause mine wont work anymore
07/28/2008 06:29 basterman#532
Please some 1 tell me how to make no more cooldown on hack ¿ what i need to configure ? , = )
07/28/2008 07:02 justanoobz#533
Quote:
Originally Posted by knightned View Post
hi is there any way to make dmg hack attack even faster, cos sometgimes the monsters hit me b4 they die. thanks.
even with damage hack you have to consider the attack rate that you have...
it is not something that you can 1hit all the monsters with little attack rate that you have...
07/28/2008 08:04 Leisures#534
client version 1.0.5.245.....
07/28/2008 09:12 papabehr#535
How do you do the "follow in dump" part? I can't find the login.rohan.kr or whatever, and I can't edit anything in the dump.
07/28/2008 10:00 ViperXD#536
This Tutorial should explain everything about the hacks. So first download the rohan hacks.rar witch i added in this post.Than download the newest Bot (ver1.0.9)(link Underneath)
The hacks must be extracted to the rohan game folder and the original exe has to be replaced! now extract the bot anywhere u want to and click on the start bot icon(litle white finger) now it should appear in your system tray (down right corner) right click it and choose start game! now set the path to your rohanonline.exe and wait for the game to start. now u will see the login screen
type your username and password ,now login.When at character selection screen open the rohan hacks controller. leave everything to the default settings. now choose your character and Have Fun HACKING!
PS! only working and useful gm commands atm are /gmspeed NUMBER /cammode and !*show target info on

and now to the LINKS:

v1.0.9: [Only registered and activated users can see links. Click Here To Register...]
File-Upload:
File-Upload.net - RohanBotEn1.0.9.exe
MD5: C8123094C09CB240A7987E49748DC0A9

ROHAN HACKS:
[Only registered and activated users can see links. Click Here To Register...]
07/28/2008 10:15 papabehr#537
Quote:
Originally Posted by ViperXD View Post
This Tutorial should explain everything about the hacks. So first download the rohan hacks.rar witch i added in this post.Than download the newest Bot (ver1.0.9)(link Underneath)
The hacks must be extracted to the rohan game folder and the original exe has to be replaced! now extract the bot anywhere u want to and click on the start bot icon(litle white finger) now it should appear in your system tray (down right corner) right click it and choose start game! now set the path to your rohanonline.exe and wait for the game to start. now u will see the login screen
type your username and password ,now login.When at character selection screen open the rohan hacks controller. leave everything to the default settings. now choose your character and Have Fun HACKING!
PS! only working and useful gm commands atm are /gmspeed NUMBER /cammode and !*show target info on

and now to the LINKS:

v1.0.9: [Only registered and activated users can see links. Click Here To Register...]
File-Upload:
File-Upload.net - RohanBotEn1.0.9.exe
MD5: C8123094C09CB240A7987E49748DC0A9

ROHAN HACKS:
[Only registered and activated users can see links. Click Here To Register...]
I'd like to be able to do it myself, I followed the instructions best I could but I think he assumed we would have some kowledge of the program. Can you explain the "follow to dump" part in a bit more detail? How exactly do I "edit the dump" to playrohan.com?
07/28/2008 10:25 shmuliknet#538
hey where 2 put it?
07/28/2008 10:26 woodyfly#539
The hack doesnt work anymore with the new client, only bot
07/28/2008 10:32 Killer-K#540
the hack works just find you have to redo it yourself here is a lil how to redo it lol

Hack Explanation #1 - GM Commands
Alright well, I guess I'll try my best to show/explain how some of the stuff is done.

First you need OllyDBG, which is a debugger.

Also, you need some experience with Assembly, or you'll be thinking "What the hell is that crap?".

I'll be explaining how to enable GM commands in this one.



First, go to the address 004110A5 in the non-hacked EXE (Version 244), you should see this:
MOVZX EAX,BYTE PTR SS:[ESP+A9]

The Command above reads your access level and moves it to the EAX Register (Padded with 0's), so what you need to do is create your own function to write your own access level.

So you create a call at that address to a code cave you found/created, in this example, I'll be using the address 008EF925 as my code cave. (To use this address, you'll need to write the command "RETN 4" to the address 008EF920, the function we will be using for the code cave is the error handler)

So you change the code at 004110A5 to:
CALL 008EF925
then you go to 008EF925 and write this code:
MOV BYTE PTR SS:[ESP+A9],0FA
MOVZX EAX,BYTE PTR SS:[ESP+A9]
RETN

and voila. ;p

================================================== ================================================== ============

Hack Explanation #2 - Disabling Gameguard
There are a few ways to do this, all of them are relatively simple.

The two main methods are just changing one jump position.

Method 1:
Change the code at 0043E8F2 to JMP 0043EB7C .

This method will completely stop Gameguard from loading at all, but can cause some problems, especially with Gameguard Authentication (If used.).

Method 2:
Change the code at 0043EB5B to JMP 0043EB6B .

This method will allow Gameguard to initialize some stuff but will stop it from loading completely.

================================================== =================================================

Hack Explanation #3 - Increased Damage (Sorta)
Normally when you attack, you tell the server to start an attack on a target and the server handles everything from there, updating you when you attack and what not.

But there's a way to make attacking client-side, it's a pretty simple exploit, that once built into the game, can become a very good hack.

This hack does not increase your damage, it just makes you attack extremely fast.

You'll need to hack two different things for this one, you need to disable the animations for attacking while its in use and the actual attacking.

(If you leave the animation on, it won't work correctly.)

This is probably going to be a long one so bear with me. :x

Disable Attack Animation
Go to 0048A04B and change the command there to JE 0048A0DD .

This will disable the attack animation for players. (Yourself and others)


Damage Hack
I'm just going to copy and paste the code to make things shorter, and then explain what it does and what not.

For this hack, I'll be using 008EF976 as the code cave.

Go to 00487491 and change that code to CALL 008EF974.
This command will jump to our custom code.

Go to 00487497, right click it, go to Binary, and Fill With NOPs.
This change will disable the client from setting the current attack state.

Go to 004874C7, right click it, go to Binary, and Fill With NOPs.
This change will disable attack speed, so your next attack is called instantly.


Now go to 008EF976 and put this code. (Make sure it's perfect)

XOR EDI,EDI
MOV EDX,DWORD PTR DS:[0AEE1D4]
MOV EAX,DWORD PTR DS:[0AEE1D0]
MOV ECX,DWORD PTR DS:[0ABFEB8]
PUSH EDX
PUSH EAX
PUSH 0
PUSH 1308
CALL 00407010
MOV EDX,DWORD PTR DS:[0AEE1D4]
MOV EAX,DWORD PTR DS:[0AEE1D0]
PUSH EDX
PUSH EAX
LEA ECX,DWORD PTR SS:[ESP+1C]
PUSH ECX
MOV ECX,DWORD PTR DS:[0ABFEB8]
PUSH 1307
CALL 00407010
INC EDI
CMP EDI,4
JL SHORT 008EF978
MOV EDI,EBP
RETN

This code sends 4 sets of stop attacking / start attacking commands to the server.

The 4 in CMP EDI, 4 is how many loops it does, so you can change it to suit your needs.
(I dont suggest going over 20, 4 should be the perfect number for everyone.. Going too high may make you do less damage.)

I think that's everything I should post about this, but I'm tired.. So if I forgot anything, I'll edit it later.


This Is Sorien Tutorial

and i just forgot how to spell his name lol