[*M*]CO Loader

; *******************
; *  Loader 0.[B]5062  [/B]*   
; *******************
; *                 * 
; * Code     : *M*  *
; * language : MASM *
; *                 * 
; *******************

.586
.model flat,stdcall
option casemap:none
;=============================================================================================

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc

includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
;=============================================================================================

.data

;// Target Process
target db "Conquer.exe",0

;// Injection Values

    ;Blacknull
        BN1 db 0EBh,41h

    ;Multi-Client
        MUL1 db 0EBh

    ;GM Commands
        GM1 db 0EBh

    ;Wall-Jump
        Wall1 db 0EBh
        ;//Guild
        Wall2 db 0E9h, 42h, 0F8h, 0FFh, 0FFh, 90h

    ;Server.dat bypass
        SB1 db 90h,90h
    
    ;//Popup-Filter
        PU1 db 0EBh

    ;Equipment Parenthesis
        EP1 db 00h

    ;//Extra Zoom
        EZ1 db 80h,00h
        EZ2 db 05h
    ;//FPS Unlock
        FPS3 db 90h,90h,90h
        
    ;//Magic Hack
        MG1 db 90h,90h,90h,90h,90h,90h
        
    ;//Anti-Anti Virus
        AV1 db 0EBh
    
    ;//Non-DC
        NDC1 db 0E9h, 03Ch, 24h, 0FCh, 0FFh
        NDC2 db 81h, 05h, 0B0h, 0EFh, 56h, 00h, 06Ah, 04h, 00h, 00h, 0A1h, 0B0h, 0EFh, 56h, 00h, 0E9h, 0B0h, 0DBh, 03h, 00h
        NDC3 db 0E9h, 95h, 54h, 05h, 00h
        NDC4 db 56h, 33h, 0F6h, 06Ah, 64h, 83h, 03Dh, 0BEh, 0D0h, 56h, 00h, 00h, 07Ch, 0Ah, 0C7h, 05h, 0BEh, 0D0h, 56h, 00h, 00h, 00h, 00h, 00h, 07Fh, 00Ah, 0C7h, 05h, 0BEh, 0D0h, 56h, 00h, 80h, 00h, 00h, 00h, 0E9h, 42h, 0ABh, 0FAh, 0FFh
        NDC5 DB 0C3h        
        
    ;//Wharehouse
        WH1 db 0E9h, 0CEh, 06h, 00h, 00h, 90h, 90h










;// Error Captions
    no_exe db "Conquer.exe not found",0 ;If file isnt found
    no_inject db "Couldn't Inject",0 ;If there is an injection error

;// PI
hInstance dd ?
startinfo STARTUPINFO <?> ;the startupinfo structure
pi PROCESS_INFORMATION <?> ;the process_information structure
;=============================================================================================

.code
start:

;// Get handle of loader
    invoke GetModuleHandle,NULL
    mov hInstance,eax

;// Create Process
    invoke CreateProcess,addr target,NULL,NULL,NULL,FALSE,NORMAL_PRIORITY_CLASS, NULL,NULL, addr startinfo,addr pi
    
;If Conquer.exe (target) is not found, Jump to error 1
    cmp eax,0 ;error ??
    jz error_1

;// Wait till process is in memory
    ;Set injection time to 0 miliseconds, this is necesary to inject blacknull code before play.exe error
    ;Not necessary for conquer but if an app had a CRC check, patches could be applied after a certain timeframe
    invoke WaitForInputIdle,pi.hProcess,0 


;// Inject Code

    ;// Blacknull
        invoke WriteProcessMemory, pi.hProcess, 004687C8h, addr BN1, sizeof BN1, NULL

    ;// Multi-Client
        invoke WriteProcessMemory, pi.hProcess, 00469AE3h, addr MUL1, sizeof MUL1, NULL

    ;// GM Commands
        invoke WriteProcessMemory, pi.hProcess, 004A65ADh, addr GM1, sizeof GM1, NULL

    ;// Wall-Jump
        invoke WriteProcessMemory, pi.hProcess, 004A62BFh, addr Wall1, sizeof Wall1, NULL
        invoke WriteProcessMemory, pi.hProcess, 004C0DDCh, addr Wall2, sizeof Wall2, NULL

    ;//Server.dat bypass
        invoke WriteProcessMemory, pi.hProcess, 00432C62h, addr SB1, sizeof SB1, NULL
        invoke WriteProcessMemory, pi.hProcess, 004E405Ah, addr SB1, sizeof SB1, NULL

    ;//Popup-Filter
        invoke WriteProcessMemory, pi.hProcess, 00477E3Dh, addr PU1, sizeof PU1, NULL

    ;//Extra Zoom
        invoke WriteProcessMemory, pi.hProcess, 004791FFh, addr EZ1, sizeof EZ1, NULL
        invoke WriteProcessMemory, pi.hProcess, 0047920Dh, addr EZ2, sizeof EZ2, NULL
        
    ;//FPS Unlock
        invoke WriteProcessMemory, pi.hProcess, 00468ADBh, addr Wall1, sizeof Wall1, NULL
        
    ;//Anti-Anti Virus
        invoke WriteProcessMemory, pi.hProcess, 004686CFh, addr AV1, sizeof AV1, NULL
        
    ;//Magic Hack
        invoke WriteProcessMemory, pi.hProcess, 004C4CE2h, addr Wall1, sizeof Wall1, NULL
        invoke WriteProcessMemory, pi.hProcess, 004C4F6Dh, addr MG1, sizeof MG1, NULL
        invoke WriteProcessMemory, pi.hProcess, 004C4F82h, addr MG1, sizeof MG1, NULL
        
    ;//Non-DC
        invoke WriteProcessMemory, pi.hProcess, 004A6389h, addr NDC1, sizeof NDC1, NULL
        invoke WriteProcessMemory, pi.hProcess, 004687CAh, addr NDC2, sizeof NDC2, NULL
        invoke WriteProcessMemory, pi.hProcess, 00413344h, addr NDC3, sizeof NDC3, NULL
        invoke WriteProcessMemory, pi.hProcess, 004687DEh, addr NDC4, sizeof NDC4, NULL
        invoke WriteProcessMemory, pi.hProcess, 00412453h, addr NDC5, sizeof NDC5, NULL

    ;//Wharehouse
    ;    invoke WriteProcessMemory, pi.hProcess, 00475D24h, addr WH1, sizeof WH1, NULL


;If code injection is not possible, Jump to error 2:
    cmp eax,0 ;error??
    jz error_2

;// End and launch apps
    fin:
    invoke ExitProcess,NULL
    error_1:
    invoke MessageBoxA,NULL,addr no_exe,NULL,NULL
    jmp fin
    error_2:
    invoke MessageBoxA,NULL,addr no_inject,NULL,NULL
    jmp fin
end start