Sro_client & Ollydbg ,need help?!

09/20/2011 04:12 Little Hole#1
now the sro_client.exe has a function that check if there is a debugger is running in the system such as ollydbg ,T-search,..etc

and if the client found any of this programs it will automatic terminate it !

i try to open the sro_client.exe with Ollydbg and fill all kernel32.exitprocess with nop's but this was useless ,need help so i can attach Ollydbg to Sro_client !!

Thanks in advance
09/20/2011 06:44 Kazuyaš#2
[Only registered and activated users can see links. Click Here To Register...]

i just opened sro_client in ollydbg, and it seems to work fine for me :)
09/20/2011 07:40 lesderid#3
Maybe tell us what version of SRO you're using?

By the way, on your blog it says:
"The Packet Structure:
2 bytes length of data (reversed)+ 2 bytes Opcode(reversed)+2 bytes security+data"

I would advise you to read on Endianness.
09/20/2011 12:47 belgther#4
OllyDeb + Sro works without problems...

I think you used Sbot or Mbot while you runned Olly
09/20/2011 14:22 Little Hole#5
Quote:
Originally Posted by Kazuyaš View Post
[Only registered and activated users can see links. Click Here To Register...]

i just opened sro_client in ollydbg, and it seems to work fine for me :)
i meant when i run sro first and then say after login i run ollydbg and attach it to sro not open sro in olly!!


and after i use edxloader and remove hackshield it works fine that i found so i think the debugger checker is in EHSvc.dll that in the hackshield folder

Quote:
Originally Posted by lesderid View Post
Maybe tell us what version of SRO you're using?

I would advise you to read on Endianness.
Thanks for advise & as u know im just a beginner ^^
btw:Thank you
09/20/2011 20:01 belgther#6
ah maybe tried to run sroclient.exe with olly and bypass the "Run Silkroad.exe" :)

because it works... I used it several times on my GoapBot...