[Release] HP-Tool

[expo_botter]

Deutsch:

 Spoiler

Ich erlaube mir mal eins meiner Tools hier public zu machen. Was macht das Programm? Ganz einfach, es zeigt euch die gegnerischen HP nicht mehr und nicht weniger. Dies ist, nach meiner Auffassung nach, von Vorteil.

Anleitung:

1. öffne HP-Tool.exe
2. starte Archlord normal über die Homepage
3. loggt euch wie gewohnt in euern Char ein
4. wählt irgendein Ziel, egal ob ein Spieler oder ein NPC
5. klickt auf "Suche die Addresse"
6. oben links erscheint die gegnerischen HP
7. mit linker Umschalt + linker Strg + Pfeiltasten bewegt ihr das kleine Fenster hin und her

Ein Video-Tutorial mache ich nachdem der Thread hier offen ist.

English:

 Spoiler

I release my Tool to look at the Opponents-HP. Why do i need this program? It's easy, in some situations it's useful to know the Hitpoints of PKs, in my opinion.

Instruction:

1. open HP-Tool.exe
2. start Archlord normally over the homepage
3. login into your char
4. choose a target (it doesn't matter if it's a player or a NPC)
5. click on "Suche die Addresse"
6. on the upper left corner will be a window with the Opponents-HP
7. to move the window click left shift + left ctrl + arrow-keys

I make a video-tutorial after i post this thread.

VT:


MfG expo_botter

[WTF-imdoinyamom]

imo its a waste, if ur running some clients it will directly slow ur pc down

[expo_botter]

it don't slow down the PC, it takes like 1-2% more CPU that's all

[avati]

That tool needs a lot of investigation. To make an HP tool you need the static pointer of HP address. The only tools on old days that worked for this matter was Cheatengine and some other tools that i cant remember their names. Me and ACE we trie to find a way around to read memory addresses many months now, with no success.If you could share with us your method that would be greatful. Send me pm if you like...
To all of you, who download this tool be careful with what account you log in.
We need some answers first and would be clever not to use it for a while...

Cheers Avati

[expo_botter]

This programm isn't a account stealer.
i send you a PN

[kinq1]

Well, my avg antivirus find this:


...and virustotal find this:
Antivirus Version Last Update Result
AntiVir 7.10.14.38 2010.11.18 TR/Crypt.TPM.Gen
Antiy-AVL 2.0.3.7 2010.11.18 -
Avast 4.8.1351.0 2010.11.18 -
Avast5 5.0.594.0 2010.11.18 -
AVG 9.0.0.851 2010.11.18 Win32/Themida
BitDefender 7.2 2010.11.19 Gen:Trojan.Heur.GM.4000036080
CAT-QuickHeal 11.00 2010.11.09 -
ClamAV 0.96.4.0 2010.11.18 -
Command 5.2.11.5 2010.11.18 -
Comodo 6765 2010.11.18 -
DrWeb 5.0.2.03300 2010.11.19 -
Emsisoft 5.0.0.50 2010.11.18 Gen.Trojan!IK
eSafe 7.0.17.0 2010.11.18 -
eTrust-Vet 36.1.7985 2010.11.18 -
F-Prot 4.6.2.117 2010.11.18 -
F-Secure 9.0.16160.0 2010.11.18 Gen:Trojan.Heur.GM.4000036080
Fortinet 4.2.254.0 2010.11.18 -
Ikarus T3.1.1.90.0 2010.11.18 Gen.Trojan
Jiangmin 13.0.900 2010.11.18 -
K7AntiVirus 9.68.3021 2010.11.18 -
McAfee 5.400.0.1158 2010.11.19 Artemis!95182A336D45
McAfee-GW-Edition 2010.1C 2010.11.18 Artemis!29036CEC034B
NOD32 5631 2010.11.18 Win32/Packed.Themida.AAE
Norman 6.06.10 2010.11.18 -
Panda 10.0.2.7 2010.11.18 Trj/Thed.A
PCTools 7.0.3.5 2010.11.18 -
Prevx 3.0 2010.11.19 -
Rising 22.74.03.05 2010.11.18 -
Sophos 4.59.0 2010.11.19 Mal/Behav-374
SUPERAntiSpyware 4.40.0.1006 2010.11.19 -
TheHacker 6.7.0.1.086 2010.11.18 -
TrendMicro 9.120.0.1004 2010.11.18 -
VIPRE 7347 2010.11.19 Trojan.Win32.Generic!BT
ViRobot 2010.11.18.4155 2010.11.18 -
VirusBuster 13.6.48.0 2010.11.18 -


I dont try to use it

[ACE-ppc]

Originally Posted by kinq1

Well, my avg antivirus find this:


...and virustotal find this:
Antivirus Version Last Update Result
AntiVir 7.10.14.38 2010.11.18 TR/Crypt.TPM.Gen
Antiy-AVL 2.0.3.7 2010.11.18 -
Avast 4.8.1351.0 2010.11.18 -
Avast5 5.0.594.0 2010.11.18 -
AVG 9.0.0.851 2010.11.18 Win32/Themida
BitDefender 7.2 2010.11.19 Gen:Trojan.Heur.GM.4000036080
CAT-QuickHeal 11.00 2010.11.09 -
ClamAV 0.96.4.0 2010.11.18 -
Command 5.2.11.5 2010.11.18 -
Comodo 6765 2010.11.18 -
DrWeb 5.0.2.03300 2010.11.19 -
Emsisoft 5.0.0.50 2010.11.18 Gen.Trojan!IK
eSafe 7.0.17.0 2010.11.18 -
eTrust-Vet 36.1.7985 2010.11.18 -
F-Prot 4.6.2.117 2010.11.18 -
F-Secure 9.0.16160.0 2010.11.18 Gen:Trojan.Heur.GM.4000036080
Fortinet 4.2.254.0 2010.11.18 -
Ikarus T3.1.1.90.0 2010.11.18 Gen.Trojan
Jiangmin 13.0.900 2010.11.18 -
K7AntiVirus 9.68.3021 2010.11.18 -
McAfee 5.400.0.1158 2010.11.19 Artemis!95182A336D45
McAfee-GW-Edition 2010.1C 2010.11.18 Artemis!29036CEC034B
NOD32 5631 2010.11.18 Win32/Packed.Themida.AAE
Norman 6.06.10 2010.11.18 -
Panda 10.0.2.7 2010.11.18 Trj/Thed.A
PCTools 7.0.3.5 2010.11.18 -
Prevx 3.0 2010.11.19 -
Rising 22.74.03.05 2010.11.18 -
Sophos 4.59.0 2010.11.19 Mal/Behav-374
SUPERAntiSpyware 4.40.0.1006 2010.11.19 -
TheHacker 6.7.0.1.086 2010.11.18 -
TrendMicro 9.120.0.1004 2010.11.18 -
VIPRE 7347 2010.11.19 Trojan.Win32.Generic!BT
ViRobot 2010.11.18.4155 2010.11.18 -
VirusBuster 13.6.48.0 2010.11.18 -


I dont try to use it

Hi,
Themida is only a Packer ... so you cant say its an Virus because this.
If i have some time ill decomplie the Autoit Script and check it.


Greez ACE

[expo_botter]

The AutoIt GUI isn't that complicate

 Spoiler

PHP Code:

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_icon=..\Desktop\small.ico
#AutoIt3Wrapper_outfile=..\Desktop\HP-Tool\HP-Tool.exe
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_Res_Comment=HP-Tool
#AutoIt3Wrapper_Res_Description=HP-Tool
#AutoIt3Wrapper_Res_Fileversion=0.0.0.0
#AutoIt3Wrapper_Res_LegalCopyright=expo_botter
#AutoIt3Wrapper_Res_Language=1031
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
Opt("TrayMenuMode",1)
#include <ButtonConstants.au3>
#include <GUIConstantsEx.au3>
#include <StaticConstants.au3>
#include <WindowsConstants.au3>
#include <GuiComboBox.au3>
#include <File.au3>
#include <Array.au3>
#include <WindowsConstants.au3>
#include <GuiConstantsEx.au3>
#include <ButtonConstants.au3>
#include <misc.au3>
$Ja = @ScriptDir & "\Pics\Pic1.jpg"
$Nein = @ScriptDir & "\Pics\Pic2.jpg"
$Check = @ScriptDir & "\Pics\Pic3.jpg"
Global $Weiter = 0
Global $Form1 = GUICreate("Vorbereitung", 354, 530, -1,-1)
GUISetBkColor(0xFFFFFF,$Form1)
$Pic1 = GUICtrlCreatePic($Check, 8, 8, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label1 = GUICtrlCreateLabel("Als Administrator gestartet", 56, 14, 188, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic2 = GUICtrlCreatePic("", 8, 56, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label2 = GUICtrlCreateLabel("Warte auf Archlord-Patcher (Archlord.exe)", 56, 110, 293, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic3 = GUICtrlCreatePic("", 8, 104, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label3 = GUICtrlCreateLabel("Warte auf Client (alefclient.exe)", 56, 158, 219, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic4 = GUICtrlCreatePic("", 8, 152, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label4 = GUICtrlCreateLabel("Injection der DLL (Errorcode = )", 56, 206, 286, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic5 = GUICtrlCreatePic("", 8, 200, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label5 = GUICtrlCreateLabel("Warte auf Antwort der DLL", 56, 254, 188, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic6 = GUICtrlCreatePic("", 8, 248, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label6 = GUICtrlCreateLabel("Teste Kommunikation von DLL und EXE", 56, 302, 283, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic7 = GUICtrlCreatePic("", 8, 296, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label7 = GUICtrlCreateLabel("Warte auf Login", 56, 398, 119, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
Global $Button1 = GUICtrlCreateButton("Suche die Addresse", 184, 396, 115, 25, $WS_GROUP)
$Pic8 = GUICtrlCreatePic("", 8, 344, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label8 = GUICtrlCreateLabel("Warte auf Antwort der DLL", 56, 446, 188, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic9 = GUICtrlCreatePic("", 8, 392, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label9 = GUICtrlCreateLabel("Prüfe Nutzungsrechte", 56, 350, 226, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic10 = GUICtrlCreatePic("", 8, 440, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label10 = GUICtrlCreateLabel("HP-Tool made by expo_botter", 56, 62, 229, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
$Pic11 = GUICtrlCreatePic("", 8, 488, 32, 32, BitOR($SS_NOTIFY,$WS_GROUP,$WS_CLIPSIBLINGS))
$Label11 = GUICtrlCreateLabel("Fertig", 56, 494, 45, 22)
GUICtrlSetFont(-1, 12, 400, 0, "arial")
GUISetState(@SW_SHOW)
GUICtrlSetState($Button1,$GUI_DISABLE)
AdlibEnable("GUI",40)

If Not IsAdmin() Then
    GUICtrlSetImage($Pic1,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf

GUICtrlSetImage($Pic1,$Ja)
GUICtrlSetImage($Pic2,$Ja)

GUICtrlSetImage($Pic3,$Check)

While Not ProcessExists("Archlord.exe")
    Sleep(10)
WEnd

GUICtrlSetImage($Pic3,$Ja)


GUICtrlSetImage($Pic4,$Check)
If Not FileExists(@WindowsDir & "\system32\d3dx9_43.dll") Then FileCopy(@ScriptDir & "\d3dx9_43.dll",@WindowsDir & "\system32\d3dx9_43.dll",1)

While Not ProcessExists("alefclient.exe")
    Sleep(10)
WEnd

GUICtrlSetImage($Pic4,$Ja)

_INJECTDLL(ProcessExists("alefclient.exe"), @ScriptDir & "\alefclient.dll")
$err = @error
If $err = 0 Then
    $Pfad = @TempDir & "\Dat.dat"
    IniWrite($Pfad,"Status","Start","0")
    IniWrite($Pfad,"Status","Test","1")
    IniWrite($Pfad,"Status","Suchen","0")
    IniWrite($Pfad,"Status","TestEnde","0")
    IniWrite($Pfad,"Status","Login","2")
    Sleep(100)
    GUICtrlSetData($Label4,"Injection der DLL (Errorcode = " & $err & ")")
    GUICtrlSetImage($Pic5,$Ja)
Else
    GUICtrlSetData($Label4,"Injection der DLL (Errorcode = " & $err & ")")
    GUICtrlSetImage($Pic5,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf

$T = TimerInit()
Do
    Sleep(10)
    $Read = IniRead($Pfad,"Status","Start",0)
Until TimerDiff($T) > 5000 Or $Read = 1

If $Read = 0 Then
    GUICtrlSetImage($Pic6,$Nein)
    While 1
        Sleep(10)
    WEnd
Else
    GUICtrlSetImage($Pic6,$Ja)
    GUICtrlSetImage($Pic7,$Check)
EndIf
$T2 = TimerInit()
Do
    Sleep(10)
Until IniRead($Pfad,"Status","Test","1") = "2" Or TimerDiff($T2) > 6200

Do
    Sleep(10)
    IniWrite($Pfad,"Status","TestEnde","1")
Until IniRead($Pfad,"Status","Test","1") = "3" Or TimerDiff($T2) > 6200

If TimerDiff($T2) > 6100 Then
    GUICtrlSetImage($Pic7,$Nein)
    While 1
        Sleep(10)
    WEnd
Else
    GUICtrlSetImage($Pic7,$Ja)
EndIf

GUICtrlSetImage($Pic8,$Check)

Do
    Sleep(100)
    $Read = IniRead($Pfad,"Status","Login","2")
Until $Read <> "2"

If $Read = "1" Then
    GUICtrlSetImage($Pic8,$Ja)
    GUICtrlSetImage($Pic9,$Check)
Else
    GUICtrlSetImage($Pic8,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf
GUICtrlSetState($Button1,$GUI_ENABLE)
While $Weiter = 0
    Sleep(10)
WEnd
GUICtrlSetImage($Pic9,$Ja)
GUICtrlSetImage($Pic10,$Check)

IniWrite($Pfad,"Status","Suchen","1")

Do
    $Read = IniRead($Pfad,"Status","Suchen","1")
    Sleep(10)
Until $Read <> "1"

If $Read = "2" Then
    GUICtrlSetImage($Pic10,$Ja)
    GUICtrlSetImage($Pic11,$Check)
    Sleep(3000)
    GUICtrlSetImage($Pic11,$Ja)
Else
    GUICtrlSetImage($Pic10,$Nein)
    While 1
        Sleep(10)
    WEnd
EndIf

Func GUI()
    $nMsg = GUIGetMsg()
    Switch $nMsg
        Case $GUI_EVENT_CLOSE
            Exit
        Case $Button1
            $Weiter = 1
    EndSwitch
EndFunc

Func _INJECTDLL($PID, $DLLPATH)
    If $PID = 0 Then
        SetError(-1)
        Return False
    ElseIf StringLen($DLLPATH) <= 4 Or StringRight($DLLPATH, 4) <> ".dll" Then
        SetError(-2)
        Return False
    EndIf
    If Not FileExists($DLLPATH) Then
        SetError(-3)
        Return False
    EndIf
    Local $PHANDLE, $PLIBREMOTE, $MODHANDLE, $LOADLIBRARYA, $HTHREAD
    Local $KERNEL32 = DllOpen("kernel32.dll")
    $PHANDLE = DllCall($KERNEL32, "int", "OpenProcess", "int", 2035711, "int", 0, "int", $PID)
    If IsArray($PHANDLE) And $PHANDLE[0] > 0 Then
        $PHANDLE = $PHANDLE[0]
    Else
        SetError(-4)
        Return False
    EndIf
    $PLIBREMOTE = DllCall($KERNEL32, "int", "VirtualAllocEx", "int", $PHANDLE, "short", 0, "int", 4096, "int", 4096, "int", 4)
    If IsArray($PLIBREMOTE) Then
        If $PLIBREMOTE[0] > 0 Then
            ConsoleWrite("0x" & Hex($PLIBREMOTE[0], 8) & @CR)
            $PLIBREMOTE = $PLIBREMOTE[0]
        Else
            SetError(-5)
            Return False
        EndIf
    Else
        SetError(-6)
        Return False
    EndIf
    For $I = 0 To StringLen($DLLPATH)
        $RET = DllCall("kernel32.dll", "int", "WriteProcessMemory", "int", $PHANDLE, "int", $PLIBREMOTE + $I, "ptr*", Asc(StringMid($DLLPATH, $I + 1, 1)), "int", 1, "int", 0)
        If IsArray($RET) Then
            If $RET[0] = 0 Then
                SetError(-7)
                Return False
            EndIf
        Else
            SetError(-8)
            Return False
        EndIf
    Next
    $MODHANDLE = DllCall($KERNEL32, "long", "GetModuleHandle", "str", "kernel32.dll")
    If IsArray($MODHANDLE) Then
        If $MODHANDLE[0] > 0 Then
            $MODHANDLE = $MODHANDLE[0]
        Else
            SetError(-9)
            Return False
        EndIf
    Else
        SetError(-10)
        Return False
    EndIf
    $LOADLIBRARYA = DllCall($KERNEL32, "long", "GetProcAddress", "long", $MODHANDLE, "str", "LoadLibraryA")
    If IsArray($LOADLIBRARYA) Then
        If $LOADLIBRARYA[0] > 0 Then
            $LOADLIBRARYA = $LOADLIBRARYA[0]
        Else
            SetError(-11)
            Return False
        EndIf
    Else
        SetError(-12)
        Return False
    EndIf
    $HTHREAD = DllCall($KERNEL32, "int", "CreateRemoteThread", "int", $PHANDLE, "int", 0, "int", 0, "long", $LOADLIBRARYA, "long", $PLIBREMOTE, "int", 0, "int", 0)
    If IsArray($HTHREAD) Then
        ConsoleWrite($HTHREAD[0] & @CR)
        If $HTHREAD[0] > 0 Then
            $HTHREAD = $HTHREAD[0]
        Else
            SetError(-13)
            Return False
        EndIf
    Else
        SetError(-14)
        Return False
    EndIf
    DllCall($KERNEL32, "int", "VirtualFreeEx", "int", $PHANDLE, "int", $PLIBREMOTE, "int", 4096, "int", 32768)
    DllCall($KERNEL32, "int", "CloseHandle", "int", $HTHREAD)
    DllCall($KERNEL32, "int", "CloseHandle", "int", $PHANDLE)
    DllClose($KERNEL32)
    Return True
EndFunc   ;==>_INJECTDLL 


[Stuntman01]

Expo_botter is that app written just in AutoIT???