[Release] Cabal dlog.dat Decrypter

09/21/2012 18:46 inssider#46
I think we found a temporary solution according to this:


Quote:
Originally Posted by Jason View Post
Basically, one way Nexon can detect hack attempts is to take a "hash" of the .dll when it's injected. They then compare this hash to a list of "blacklisted" dlls and if there is a match, they report a hack detection and exit. The purpose of a cipher like this is to change up some data within the .dll so that the hash of the file changes. Previously this was achieved by writing a few extra bytes of data to the end of the file. However, recently Nexon have changed the way they hash the dll (rather than simply hashing the entire file, they hash only a portion of the file), which is why some of the old ciphers have stopped working.

My method modifies safe data within the file itself (through the documented PE structure), and is thus more likely to modify the portion of the file that Nexon hashes (most likely the executable sections, but not 100% sure so I modify a few different areas). The idea, of course, is to not break the .dll itself when modifying data.
Credit to [Only registered and activated users can see links. Click Here To Register...] from [Only registered and activated users can see links. Click Here To Register...]

Quote:
Originally Posted by medievil17 View Post
thanks for this sir. This is the result when i run the dlog.exe and i open the dlog.dat then result is "The file does not have any data" what's the meaning of this? and its 0kb
Means that dlog don't have any log hack,is empty.So you are clean at the moment.
09/21/2012 18:55 medievil17#47
ok thanks by the way inssider
09/21/2012 19:06 rayson11#48
aswCmnBS.dll;aswCmnOS.dll;aswCmnIS.dll; < this dll are safe?
thank you
09/21/2012 19:12 inssider#49
Quote:
Originally Posted by rayson11 View Post
aswCmnBS.dll;aswCmnOS.dll;aswCmnIS.dll; < this dll are safe?
thank you
aswCmnBS.dll;aswCmnOS.dll;aswCmnIS.dll all are related to your avast antivirus.
So yes,there are safe.

Next time try to google a little.
09/21/2012 19:15 rayson11#50
Quote:
Originally Posted by inssider View Post
aswCmnBS.dll;aswCmnOS.dll;aswCmnIS.dll all are related to your avast antivirus.
So yes,there are safe.

Next time try to google a little.
thank you sir thumbs up
09/21/2012 19:28 ibonehj15#51
Edited: now i know
09/21/2012 19:28 urosjoj#52
inssider ur sure that tool u quoted works 100% and i wont get ban??
09/21/2012 19:41 ichezen23#53
Quote:
Originally Posted by chinta95 View Post
when i execute the decrypt-er it says the fie does not have any data. do i execute the decrypt-er wrong? or i just got a lucky message

- I got the Same Error ? what does this means ?
[Only registered and activated users can see links. Click Here To Register...]
09/21/2012 19:43 inssider#54
Quote:
Originally Posted by urosjoj View Post
inssider ur sure that tool u quoted works 100% and i wont get ban??
NO i am not.
That quote was for you guys to have a start point.
Now is up to you if will test it or not.
About ban...you can get banned now,even for using the word hack.:D
Good luck with it!

Quote:
Originally Posted by ichezen23 View Post
- I got the Same Error ? what does this means ?
[Only registered and activated users can see links. Click Here To Register...]
it has already been answered several times.
that means you log is empty(clean).
Please read the entire thread next time.
09/21/2012 19:54 кev#55
Quote:
Originally Posted by ibonehj15 View Post
hhmm.. little experiment..
renamed my mikezWH.dll to wcahllak.dll

see 4 urself. :)
Shut down your client and check again. :p

And it's unwise to post screenshots with IGN visible to this forum.
09/21/2012 19:54 HellSpider#56
Quote:
Originally Posted by urosjoj View Post
what that means string match!??!?! what is module?!?!?
sry i dont very understand
please write in simple language

if i have dlog.dat empty there is chance i get banned or there is completely no chance?
dlog.dat has text from dl.enc -> almost surely banned
dlog.dat has not text from dl.enc -> not banned but maybe checked
dlog.dat has no text at all -> nothing to worry about

Quote:
Originally Posted by ibonehj15 View Post
hhmm.. little experiment..
renamed my mikezWH.dll to wcahllak.dll

see 4 urself. :)
The dlog.dat file gets updated when you close the Cabal client, not on start or during gameplay.

Quote:
Originally Posted by ichezen23 View Post
- I got the Same Error ? what does this means ?
[Only registered and activated users can see links. Click Here To Register...]
It means the file has no data, you're safe.
09/21/2012 20:00 krazeenookie#57
it should be sticked!!!!!!!!! thanks men
09/21/2012 20:21 anonimouse1989#58
What if I'll uninstall my Cabal then re-install?

How can they trace me if Im using any hacks?
09/21/2012 20:30 russel1962#59
is test.dll safe for me ?
09/21/2012 20:35 anonimouse1989#60
Sometimes Im playing at Internet Cafe

How can I make sure that Im safe from ban?