google and download OllyDbg V1.10 and these plugins:
ODBGScript v1.82.6
StrongOD 0.4.8.892
PhantOm 1.79
copy the plugins into plugin folder
start ollydbg, click plugins -> PhantOm -> Options
check -protect DRx, uncheck everything else, save
click plugins -> StrongOD -> Options
check HidePEB, *Kernelmode, !*Kill BadPE Bug, Skip Some Exceptions
uncheck everything else, save
close ollydbg, edit ollydbg.ini, change this line:
DriverName=fengyue0
to
DriverName=whatever
The first step is unpacking the bot and removing TheMida protection.
We will use a readymade script to do this. The script works only on win x32,
if you are running windows x64 (like me), you will need vmware with win x32
to run the script.
The script can be found here:
[Only registered and activated users can see links. Click Here To Register...]
download the script, copy Themida - Winlicense Ultra Unpacker 1.0.txt into scripts folder,
copy ARImpRec.dll into scripts folder,
edit Themida - Winlicense Ultra Unpacker 1.0.txt and enter the full dll path like this:
HERE_ENTER_YOUR_DLL_PATH_TO_ARIMPREC_DLL:
mov ARIMPREC_PATH, "C:\odbg110\Scripts\ARImpRec.dll"
also edit line 876:
free HEAP_PATCHSEC
to
// free HEAP_PATCHSEC
Ollydbg needs to be configured properly to run the script,
start ollydbg, click Options -> Debugging options
Watch the first tut video that comes with the script,
pause on every olly config page he clicks,
make sure to setup your ollydbg accordingly
Now we are ready to remove TheMida,
start ollydbg
press F3 -> open ExiledBot.exe
click plugins -> ODbgscript -> Script Window
click Plugins -> ODbgScript -> Run script -> Themida - Winlicense Ultra Unpacker 1.0.txt
when the script pauses -> press space to resume
when asked to bypass VMWare checks click YES if you are running in VMWare,
when the script pauses here:
1967 pause
1968 pause
1969 pause
1970 sub FIRST_API_ADDR_FOUND, 04
hold space until this loop is done, cancel the Assemble window that opens
when asked to fix direct API JUMPs click NO,
when the script is finished, you will find ExiledBot_DP.exe in your bot folder
If you have trouble running the script, read the info text files, watch the tut videos, read the thread at tuts4you.
The second step is modifying the code and cracking the bot.
press F3, open ExiledBot_DP.exe
click view -> Executable modules,
click on the first line 04000000,
now you are at the first command of the bot.exe,
rightclick -> search for -> all referenced text strings,
in the result window rightclick -> search text -> "RESPONSE",
double click the line with ASCII "RESPONSE",
now you are back in the disassembler window,
scroll up and click on the JE command right above,
press space, enter NOP (x fill with NOP's), click Assemble, close assemble window,
there are three more JE commands to remove,
search text "USAGE_ID", "STATUS", "USES", in disassembler window replace the JE commands right above with NOPs,
removing these 4 JE commands will make the bot start in elite mode with invalid username/password,
but there's a runtime check, setting the bot back to non-elite after 25secs,
rightclick on the disassembler window -> search for -> Binary string
enter in HEX field: E8 75 FF FF FF, press OK
the first call command is not the one we are looking for, press ctrl-L to find the second,
now remove this call command, press space and NOP it,
now the bot stays in elite mode, but it still phones home, so let's remove that also,
search for text -> "No Connection", remove (NOP) the JNZ command 2 lines above
we are done, time to save the new file,
rightclick on disassembler window -> copy to executable -> All modifications
click copy all, rightclick on result window -> save file
test the cracked exe, enter anything as username/password.
The level 60 check (or 45 now?) is still there, no need to remove it as we run in elite mode.
ODBGScript v1.82.6
StrongOD 0.4.8.892
PhantOm 1.79
copy the plugins into plugin folder
start ollydbg, click plugins -> PhantOm -> Options
check -protect DRx, uncheck everything else, save
click plugins -> StrongOD -> Options
check HidePEB, *Kernelmode, !*Kill BadPE Bug, Skip Some Exceptions
uncheck everything else, save
close ollydbg, edit ollydbg.ini, change this line:
DriverName=fengyue0
to
DriverName=whatever
The first step is unpacking the bot and removing TheMida protection.
We will use a readymade script to do this. The script works only on win x32,
if you are running windows x64 (like me), you will need vmware with win x32
to run the script.
The script can be found here:
[Only registered and activated users can see links. Click Here To Register...]
download the script, copy Themida - Winlicense Ultra Unpacker 1.0.txt into scripts folder,
copy ARImpRec.dll into scripts folder,
edit Themida - Winlicense Ultra Unpacker 1.0.txt and enter the full dll path like this:
HERE_ENTER_YOUR_DLL_PATH_TO_ARIMPREC_DLL:
mov ARIMPREC_PATH, "C:\odbg110\Scripts\ARImpRec.dll"
also edit line 876:
free HEAP_PATCHSEC
to
// free HEAP_PATCHSEC
Ollydbg needs to be configured properly to run the script,
start ollydbg, click Options -> Debugging options
Watch the first tut video that comes with the script,
pause on every olly config page he clicks,
make sure to setup your ollydbg accordingly
Now we are ready to remove TheMida,
start ollydbg
press F3 -> open ExiledBot.exe
click plugins -> ODbgscript -> Script Window
click Plugins -> ODbgScript -> Run script -> Themida - Winlicense Ultra Unpacker 1.0.txt
when the script pauses -> press space to resume
when asked to bypass VMWare checks click YES if you are running in VMWare,
when the script pauses here:
1967 pause
1968 pause
1969 pause
1970 sub FIRST_API_ADDR_FOUND, 04
hold space until this loop is done, cancel the Assemble window that opens
when asked to fix direct API JUMPs click NO,
when the script is finished, you will find ExiledBot_DP.exe in your bot folder
If you have trouble running the script, read the info text files, watch the tut videos, read the thread at tuts4you.
The second step is modifying the code and cracking the bot.
press F3, open ExiledBot_DP.exe
click view -> Executable modules,
click on the first line 04000000,
now you are at the first command of the bot.exe,
rightclick -> search for -> all referenced text strings,
in the result window rightclick -> search text -> "RESPONSE",
double click the line with ASCII "RESPONSE",
now you are back in the disassembler window,
scroll up and click on the JE command right above,
press space, enter NOP (x fill with NOP's), click Assemble, close assemble window,
there are three more JE commands to remove,
search text "USAGE_ID", "STATUS", "USES", in disassembler window replace the JE commands right above with NOPs,
removing these 4 JE commands will make the bot start in elite mode with invalid username/password,
but there's a runtime check, setting the bot back to non-elite after 25secs,
rightclick on the disassembler window -> search for -> Binary string
enter in HEX field: E8 75 FF FF FF, press OK
the first call command is not the one we are looking for, press ctrl-L to find the second,
now remove this call command, press space and NOP it,
now the bot stays in elite mode, but it still phones home, so let's remove that also,
search for text -> "No Connection", remove (NOP) the JNZ command 2 lines above
we are done, time to save the new file,
rightclick on disassembler window -> copy to executable -> All modifications
click copy all, rightclick on result window -> save file
test the cracked exe, enter anything as username/password.
The level 60 check (or 45 now?) is still there, no need to remove it as we run in elite mode.
