InsanityFlyff Bypass

12/27/2012 17:11 +Yazzn#1
Code:
	memcpy((LPVOID)0x480F21, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
	memcpy((LPVOID)0x480F90, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
	memcpy((LPVOID)0x480FFF, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
	memcpy((LPVOID)0x481079, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
Bypasses their "mega" check for QueryPerformanceCounter and WSASend/WSARecv hooks by replacing the exitprocess call with NOP.
12/28/2012 01:21 Flyff_Service#2
You could also NOP the CreateThread call which creates this check thread.
12/28/2012 19:02 xMootie#3
Quote:
Originally Posted by Yazzn (: View Post
Code:
	memcpy((LPVOID)0x480F21, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
	memcpy((LPVOID)0x480F90, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
	memcpy((LPVOID)0x480FFF, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
	memcpy((LPVOID)0x481079, (const void *)"\x90\x90\x90\x90\x90\x90", 6);
Bypasses their "mega" check for QueryPerformanceCounter and WSASend/WSARecv hooks by replacing the exitprocess call with NOP.
ExitProcess? Seriously, what are the "geniuses" at InsanityFlyff thinking? Guess they finally went Insane...

Watch them change the call to use the standard library "exit" function and get bypassed again just as easily.
12/28/2012 21:35 Fremo..#4
Found that shit before too, i thought flyff is jus shitty coded(well it is) but its jus insanityflyff
12/29/2012 14:20 ChinkyCheek#5
Kind of new with this, what is NOP?
Sorry if this is a bothersome question from a newbie like me!
12/30/2012 04:05 xMootie#6
Quote:
Originally Posted by ChinkyCheek View Post
Kind of new with this, what is NOP?
Sorry if this is a bothersome question from a newbie like me!
\x90.
12/30/2012 08:35 ChinkyCheek#7
And what do we use to edit this? and edit which file/s? :|
Forgot to include it into my last post. (Hex Editor or?)
12/30/2012 11:30 +Yazzn#8
Quote:
Originally Posted by Flyff_Service View Post
You could also NOP the CreateThread call which creates this check thread.
Yes but then you can't interrupt it whenever you want.

Quote:
Originally Posted by XorLethal View Post
ExitProcess? Seriously, what are the "geniuses" at InsanityFlyff thinking? Guess they finally went Insane...

Watch them change the call to use the standard library "exit" function and get bypassed again just as easily.
As you will see in the code below you could just hook QPC, WSASend, etc 5 bytes later and reconstruct the overwritten opcodes or use hot patching or fake the IAT or (...)


Conclusion: The guys from InsanityFlyFF don't know what they're doing.
12/30/2012 20:01 xMootie#9
By the way, you might want to look into hooking other functions to modify or read packet data. If you use the functions below, you won't need to reverse the encryption routine.

void CClientSock::Send(char* lpData, DWORD dwDataSize, DPID dpidTo)

- Just send it data for easy packet sending, no encryption necessary

CBuffer* CClientSock::Fetch(DWORD dwBytes)

- Detour call and use return to read packet data decrypted.

Note that both methods are non-static member functions, thus you need to find the address of g_DPlay(global non-static object), which can be obtained by hooking its initialization between the entry point and WinMain().
01/01/2013 22:35 xBleak#10
Could some1 build a Bypass , dunno what I have to do haha :)
01/31/2013 06:01 naomiclark#11
can i ask what if the function of this code?