MY Registry called out.. Where are you Archlord :D

[5hoursez]

So you don't have to waste your time doing it, this is all thats in an XP registry for it.




HKEY_CLASSES_ROOT\ARCHLORDDOWNLOAD.ArchlordDownloa dCtrl.1
HKEY_CLASSES_ROOT\ARCHLORDDOWNLOAD.ArchlordDownloa dCtrl.1\CLSID
{24960521-7F51-4743-9D83-906B16D188E5}

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}
Archlord_downloader Control

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\Control

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\Implemented Categories
HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}
HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\InprocServer32
C:\WINDOWS\DOWNLO~1\ARCHLO~1.OCX
Apartment

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\MiscStatus
0
HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\MiscStatus\1
131473
? ^^ ?


HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\ProgID
ARCHLORDDOWNLOAD.ArchlordDownloadCtrl.1

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\ToolboxBitmap32
C:\WINDOWS\DOWNLO~1\ARCHLO~1.OCX, 1

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\TypeLib
{57AFDBC1-F460-4573-BC88-B1B171363A47}

HKEY_CLASSES_ROOT\CLSID\{24960521-7F51-4743-9D83-906B16D188E5}\Version
1.0

HKEY_CLASSES_ROOT\CLSID\{D519A306-8A92-48A7-ACBA-8FB2858CA619}
Archlord_downloader Property Page
HKEY_CLASSES_ROOT\CLSID\{D519A306-8A92-48A7-ACBA-8FB2858CA619}\InprocServer32
C:\WINDOWS\DOWNLO~1\ARCHLO~1.OCX

HKEY_CLASSES_ROOT\Interface\{2B96F2E8-16D1-4117-9FE2-377CDC2C8E55}
_DArchlordDownloader
HKEY_CLASSES_ROOT\Interface\{2B96F2E8-16D1-4117-9FE2-377CDC2C8E55}\ProxyStubClsid
{00020420-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{2B96F2E8-16D1-4117-9FE2-377CDC2C8E55}\ProxyStubClsid32
{00020420-0000-0000-C000-000000000046}
HKEY_CLASSES_ROOT\Interface\{2B96F2E8-16D1-4117-9FE2-377CDC2C8E55}\TypeLib
{57AFDBC1-F460-4573-BC88-B1B171363A47}
Version 1.0

HKEY_CLASSES_ROOT\TypeLib\{57AFDBC1-F460-4573-BC88-B1B171363A47}
HKEY_CLASSES_ROOT\TypeLib\{57AFDBC1-F460-4573-BC88-B1B171363A47}\1.0
Archlord Downloader ActiveX Control module
HKEY_CLASSES_ROOT\TypeLib\{57AFDBC1-F460-4573-BC88-B1B171363A47}\1.0\0
HKEY_CLASSES_ROOT\TypeLib\{57AFDBC1-F460-4573-BC88-B1B171363A47}\1.0\0\win32
C:\WINDOWS\Downloaded Program Files\Archlorddownloader.ocx
HKEY_CLASSES_ROOT\TypeLib\{57AFDBC1-F460-4573-BC88-B1B171363A47}\1.0\FLAGS
2
HKEY_CLASSES_ROOT\TypeLib\{57AFDBC1-F460-4573-BC88-B1B171363A47}\1.0\HELPDIR
C:\WINDOWS\Downloaded Program Files



~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


HKEY_LOCAL_MACHINE\SOFTWARE\ArchLord

Code DWORD
3c80619b(hexadecimal) / decimal(1015046555)

file
Archlord.exe

loginserverIP
206.17.105.10

LoginServerPort
0x00002afa / 11002

PatchServerIP
206.17.105.40

PatchServerPort
0x00002af8 / 11000

SelfPatchFlag
1

Version
0x00000049 / 73


HKEY_LOCAL_MACHINE\SOFTWARE\ATI Technologies\CDS\Software\0
[Archlord] (0x00000000)

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ARCHLORDDOWNLO AD.ArchlordDownloadCtrl.1
Archlord_downloader Control
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\ARCHLORDDOWNLO AD.ArchlordDownloadCtrl.1\CLSID
{24960521-7F51-4743-9D83-906B16D188E5}



HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{24960521-7F51-4743-9D83-906B16D188E5}\Contains\Files
(Value Name) ~ C:\WINDOWS\Downloaded Program Files\Archlorddownloader.ocx

{HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution

Units\{24960521-7F51-4743-9D83-906B16D188E5}\DownloadInformation}
CodeBase

INF
C:\WINDOWS\Downloaded Program Files\Archlorddownloader.inf


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\App Management\ARPCache\Archlord_is1
changed
0
SlowInfoCache
(couldnt copy contents)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ModuleUsage\C:/WINDOWS/Downloaded Program

Files/Archlorddownloader.ocx
.Owner


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\SharedDLLs
C:\WINDOWS\Downloaded Program Files\Archlorddownloader.ocx

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Uninstall\Archlord_is1
norepair & nomodify = 1

Inno Setup: Setup Version 5.1.6


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
C:\Program Files\Codemasters\Archlord\Archlord.exe
EnableNXShowUI
(huh?)

[noobcube]

:S lmao whats that mean

also anyone know a trick hack packet idea or anything to log on in a dif spot to you logged out in?

[llllllllllll]

no much u can do with it lol

[5hoursez]

I see a couple DWORDS in it - 131473 & 380619 & a URL <http://download.archlord.com/archlord/arch_relay/Archlord_downloader.2.0.0.7.cab>. Will see what use they have later...

[5hoursez]

Funny I advance googled part of the URL and got back someones hijack this log... I guess they play archlord

<http://www.ozzu.com/ftopic70499.html>

& from that his profile =

# Gender: Male
# Education: Graduate degree
# Spoken Languages: English/Korean

lol haqer or wannabe prolly

also them ip's listed... give you a range.... but thats not legal so i will not, not, not, not, not, go there

[llllllllllll]

Originally Posted by 5hoursez

Funny I advance googled part of the URL and got back someones hijack this log... I guess they play archlord

<http://www.ozzu.com/ftopic70499.html>

& from that his profile =

# Gender: Male
# Education: Graduate degree
# Spoken Languages: English/Korean

lol haqer or wannabe prolly

also them ip's listed... give you a range.... but thats not legal so i will not, not, not, not, not, go there

why no it will be fun dont be scared:P

[5hoursez]

count my not's I will not(=dont), not(=do it), not(=dont), not(=do it), not(=dont), not(=do it), lol

[Malivictus]

ok ok people I did a little diggin and I found a site within the DLL file !! here is the link if you want to look at it I got a dead end until I removed the r2 blah blah blah **** and it took me to a page that just says It works! well the onlything I can think of is this is the Patch server also I used IDA pro on it and I let it run in a Emu for about 10 mins and I found out even more info..now I know to the normal player this is just junk but to me and a few Bot makers this is Gold !! man there is some Sick **** in here the DLL file lists a **** load of other files that Store the Imfo like Items drops HP MP you just have to look maybe if I can cross refence the the CRC with the HEX I mite get lucky but also in the INI file that come with the CAB file it Lists a Code that I think mite be the Activator code to the Clint to Server AKA the Packet De-coder...the info is this ..

[version]
signature="$CHICAGO$"
AdvancedINF=2.0

[Add.Code]
Archlorddownloader.ocx=Archlorddownloader.ocx

[Archlorddownloader.ocx]
file-win32-x86=thiscab
clsid={24960521-7F51-4743-9D83-906B16D188E5}
FileVersion=2,0,0,7
RegisterServer=yes


Any other Words on this....Any help will do also I am looking for a C++ coder that can do a little fillin Job for me on my Bot Progy I am making...anyway thanks for this Info I hope I helped

( side note I am sorry I have not posted in a LONG @$$ time I have had health and ISP problems but thanks again)

[llllllllllll]

Originally Posted by Malivictus

ok ok people I did a little diggin and I found a site within the DLL file !! here is the link if you want to look at it I got a dead end until I removed the r2 blah blah blah **** and it took me to a page that just says It works! well the onlything I can think of is this is the Patch server also I used IDA pro on it and I let it run in a Emu for about 10 mins and I found out even more info..now I know to the normal player this is just junk but to me and a few Bot makers this is Gold !! man there is some Sick **** in here the DLL file lists a **** load of other files that Store the Imfo like Items drops HP MP you just have to look maybe if I can cross refence the the CRC with the HEX I mite get lucky but also in the INI file that come with the CAB file it Lists a Code that I think mite be the Activator code to the Clint to Server AKA the Packet De-coder...the info is this ..

[version]
signature="$"
AdvancedINF=2.0

[Add.Code]
Archlorddownloader.ocx=Archlorddownloader.ocx

[Archlorddownloader.ocx]
file-win32-x86=thiscab
clsid={24960521-7F51-4743-9D83-906B16D188E5}
FileVersion=2,0,0,7
RegisterServer=yes


Any other Words on this....Any help will do also I am looking for a C++ coder that can do a little fillin Job for me on my Bot Progy I am making...anyway thanks for this Info I hope I helped

( side note I am sorry I have not posted in a LONG @$$ time I have had health and ISP problems but thanks again)

yes i can see the page that it said "It Works" but what does that mean? petty interesting

[Malivictus]

I am not sure I think its the Server check sum to make sure that the client has NOT been tampered with or it mite be some kind of backup server for the patches eather way its progress in my Book...

[llllllllllll]

Originally Posted by Malivictus

I am not sure I think its the Server check sum to make sure that the client has NOT been tampered with or it mite be some kind of backup server for the patches eather way its progress in my Book...

well i guess yea but i dont think u can do much with it but anyways thats just me

[5hoursez]

Originally Posted by Malivictus

I am not sure I think its the Server check sum to make sure that the client has NOT been tampered with or it mite be some kind of backup server for the patches eather way its progress in my Book...

I am so happy to see others like me that will take the obvious nothings, knowing they will lead to something (Hope that makes sense). I am off sunday and will put in some time, so pm me anything that needs further looking into.

I also was thinking the same thing, if these are the registry entries showing download servers and reg keys / etc., they should have an auth code linked in them or a hint to it anyway, Awesome lookin out Mal! thanks