edit: addresses are outdated, method is shit.
if you still want to use it, make a pattern out of it?
if you still want to use it, make a pattern out of it?
Eyyo, after they decided to strengthen the level check (channel selection) a bit, I decided to share this little "exploit method" with you. Might be useful for some1. It's pretty simple.
We're going to focus on this function;
Let's look at the calls first.
^this will send the packet "Channel_Enter_Req". EAX (at the push) contains the ChannelID. This is going to be important.
and then there is this call;
this will just show the "Requesting" MessageBox, we don't care about this.
--
We could now do a pretty simple trick, we could modify what's inside of eax (at the push from the packet call), so we send a different channelID.
Example: We click on beginner, but send a channelID of netsphere, so we will get the channel-information for netsphere (and we're in it)
Does this work? Yes, but there is a little problem. There is a global var which stores the channelID and if you now join a room, no players will appear.
How could we fix that?
Still, pretty simple. We just need to modify the global var after joining the channel. It's used here;
So just set a breakpoint there, join the channel, read out whats inside of ecx, add 10 to it and you got the address which stores the channelID.
After joining the channel, just change it to the "real" channelID (the one you've sent with the push eax bla).
So that's it. Pretty simple, right?
If you do want to make a better method, I give you a hint. Look at "Channel_Leave_Req" and leave a room while using this "exploit" ;)
Oh and here are some channelID's:
Have fun and I hope you could understand the shit I wrote down here.
Please don't flame me for the shitty method ~
My first tut. here, surrey for the bad explanation.
See you soon.
We're going to focus on this function;
Code:
S4Client.exe+9367E0 - 55 - push ebp
S4Client.exe+9367E1 - 8B EC - mov ebp,esp
S4Client.exe+9367E3 - 83 EC 0C - sub esp,0C { 12 }
S4Client.exe+9367E6 - 89 4D F4 - mov [ebp-0C],ecx
S4Client.exe+9367E9 - A1 ECED2502 - mov eax,[S4Client.exe+16BEDEC] { [00000000] }
S4Client.exe+9367EE - 89 45 FC - mov [ebp-04],eax
S4Client.exe+9367F1 - 8B 4D FC - mov ecx,[ebp-04]
S4Client.exe+9367F4 - 8B 51 10 - mov edx,[ecx+10]
S4Client.exe+9367F7 - 89 55 F8 - mov [ebp-08],edx
S4Client.exe+9367FA - 8B 45 F8 - mov eax,[ebp-08]
S4Client.exe+9367FD - 50 - push eax
S4Client.exe+9367FE - E8 4D8877FF - call S4Client.exe+AF050
S4Client.exe+936803 - 8B C8 - mov ecx,eax
S4Client.exe+936805 - E8 C61F2200 - call S4Client.exe+B587D0
S4Client.exe+93680A - 68 00040000 - push 00000400 { 1024 }
S4Client.exe+93680F - 6A 05 - push 05 { 5 }
S4Client.exe+936811 - 8B 0D 78D42502 - mov ecx,[S4Client.exe+16BD478] { [00000000] }
S4Client.exe+936817 - E8 449E78FF - call S4Client.exe+C0660
S4Client.exe+93681C - 8B E5 - mov esp,ebp
S4Client.exe+93681E - 5D - pop ebp
S4Client.exe+93681F - C3 - ret
Let's look at the calls first.
Code:
S4Client.exe+9367FD - 50 - push eax S4Client.exe+9367FE - E8 4D8877FF - call S4Client.exe+AF050 S4Client.exe+936803 - 8B C8 - mov ecx,eax S4Client.exe+936805 - E8 C61F2200 - call S4Client.exe+B587D0
and then there is this call;
Code:
S4Client.exe+93680A - 68 00040000 - push 00000400 { 1024 }
S4Client.exe+93680F - 6A 05 - push 05 { 5 }
S4Client.exe+936811 - 8B 0D 78D42502 - mov ecx,[S4Client.exe+16BD478] { [00000000] }
S4Client.exe+936817 - E8 449E78FF - call S4Client.exe+C0660
--
We could now do a pretty simple trick, we could modify what's inside of eax (at the push from the packet call), so we send a different channelID.
Example: We click on beginner, but send a channelID of netsphere, so we will get the channel-information for netsphere (and we're in it)
Does this work? Yes, but there is a little problem. There is a global var which stores the channelID and if you now join a room, no players will appear.
How could we fix that?
Still, pretty simple. We just need to modify the global var after joining the channel. It's used here;
Code:
S4Client.exe+9367F4 - 8B 51 10 - mov edx,[ecx+10]
After joining the channel, just change it to the "real" channelID (the one you've sent with the push eax bla).
So that's it. Pretty simple, right?
If you do want to make a better method, I give you a hint. Look at "Channel_Leave_Req" and leave a room while using this "exploit" ;)
Oh and here are some channelID's:
Code:
Beginner - 01 Netsphere 1 - 02 Netsphere 2 - 03 Netsphere 3 - 04
Please don't flame me for the shitty method ~
My first tut. here, surrey for the bad explanation.
See you soon.
