Well, well, what do we have here?

OmegaArma · 09/06/2012, 16:03

I was exploring cabal/data/ folder, and i've found funny file, dl.enc.
So i unpacked it using HellSpiders enc tool, and here is content of that file:

Spoiler

Every dll you will try to inject to cabalmain that is below /B/; will cause DC, client crash or something like that, so you can imagine what can you do with that knowledge:P
(for morons: you can simple change name of dll and folder, then it should work fine!)
Have fun!
Correct me if i'm wrong, but it is working for me

genesisVI · 09/06/2012, 16:09

lol nc1 wow that is really quite a list @_@

~~drax189~~ · 09/06/2012, 16:09

works for me thx omega

yummyCHX · 09/06/2012, 16:10

^^ goody!

Thebuch · 09/06/2012, 16:27

nice one...

syndrah · 09/06/2012, 16:30

lol punkwh is there baws. now if only my dll can fcking work then were on to something.

Thebuch · 09/06/2012, 16:41

now is it possible to add aoe /range / nsd in dll and inject it to cabalmain.exe?

then it would be best hack with no dc ;D

tanyabeleren · 09/06/2012, 16:45

does cabal enc tool of HELLSPIDER works on PH? he dont XORS for PH in his post..

WenYen · 09/06/2012, 17:39

for ph

Spoiler

tried to edit this enc file maxcore.dll to max.dll > no bot panel but not detected
i haven't tried to edit maxcore.dll on maxcabal folder because it will not work

Apok12 · 09/06/2012, 17:40

but one thing there Omega im using crkd's wh dll and not received any error or dc (still dancing in EU MF atm).

So If I rename another WH dll im using that is currently on the list and also MaxRider sorry maxcabal they should work? going to test back with info in 2 minutes.

Tried MAxCabal and Punky's WH and they do not work even after a rename. I could have not renamed something in the MaxCabal section but punkys WH should be working as that is only a single dll file but it does not want to work. (Goes back to crkd's dll instead)

stephyoneg4ever · 09/06/2012, 17:52

Quote:

Originally Posted by OmegaArma

I was exploring cabal/data/ folder, and i've found funny file, dl.enc.
So i unpacked it using HellSpiders enc tool, and here is content of that file:

Spoiler

cabalmain.exe;
ntdll.dll;
kernel32.dll;
dinput8.dll;
msvcrt.dll;
ADVAPI32.dll;
RPCRT4.dll;
USER32.dll;
GDI32.dll;
IMM32.DLL;
USP10.dll;
d3dx9_30.dll;
d3d9.dll;
d3d8thk.dll;
VERSION.dll;
ddraw.dll;
DCIMAN32.dll;
urlmon.dll;
ole32.dll;
OLEAUT32.dll;
SHLWAPI.dll;
iertutil.dll;
comctl32.dll;
Normaliz.dll;
psapi.dll;
shell32.dll;
ws2_32.dll;
fmodex.dll;
MSACM32.dll;
WSOCK32.dll;
winhttp.dll;
uxtheme.dll;
MSCTF.dll;
mswsock.dll;
wshtcpip.dll;
DNSAPI.dll;
rasadhlp.dll;
rsaenh.dll;
npsc.des;
powrprof.dll;
HID.DLL;
WINTRUST.dll;
CRYPT32.dll;
MSASN1.dll;
WLDAP32.dll;
dsound.dll;
wdmaud.drv;
msacm32.drv;
midimap.dll;
winrnr.dll;
Secur32.dll;
LPK.DLL;
WINMM.dll;
wininet.dll;
WS2HELP.dll;
hnetcfg.dll;
iphlpapi.dll;
npggNT.des;
msctfime.ime;
SETUPAPI.DLL;
IMAGEHLP.dll;
NTMARTA.DLL;
SAMLIB.dll;
KsUser.dll;
CLBCATQ.DLL;
COMRes.dll;
ieframe.dll;
RASAPI32.dll;
rasman.dll;
NETAPI32.dll;
TAPI32.dll;
rtutils.dll;
USERENV.dll;
sensapi.dll;
msv1_0.dll;
MLANG.dll;
mshtml.dll;
msls31.dll;
jscript.dll;
xpsp2res.dll;
msimtf.dll;
Apphelp.dll;
imekr61.ime;
cryptdll.dll;
KERNELBASE.dll;
sechost.dll;
SspiCli.dll;
CRYPTBASE.dll;
LPK.dll;
dwmapi.dll;
winmm.dll;
SETUPAPI.dll;
CFGMGR32.dll;
DEVOBJ.dll;
WININET.dll;
NSI.dll;
webio.dll;
credssp.dll;
wship6.dll;
WINNSI.DLL;
fwpuclnt.dll;
CRYPTSP.dll;
apphelp.dll;
IMKR12.IME;
COMCTL32.dll;
MSVCR80.dll;
MSVCP80.dll;
ntmarta.dll;
CLBCatQ.DLL;
IMKRTIP.DLL;
IMETIP.DLL;
IMKRAPI.DLL;
IMJKAPI.DLL;
MMDevApi.dll;
PROPSYS.dll;
AUDIOSES.DLL;
avrt.dll;
ksuser.dll;
NLAapi.dll;
napinsp.dll;
pnrpnsp.dll;
imekrcic.dll;
MSIMG32.dll;
COMDLG32.dll;
mscms.dll;
WINSPOOL.DRV;
SXS.DLL;
schannel.dll;
ddrawex.dll;
Dxtrans.dll;
ATL.DLL;
Dxtmsft.dll;
nvd3dum.dll;
IPHLPAPI.DLL;
OLEACC.dll;
profapi.dll;
RpcRtRemote.dll;
mLock.dll;
inicrypto45.dll;
appHelp.dll;
imkrtip.dll;
imetip.dll;
imkrapi.dll;
imjkapi.dll;
MSHTML.dll;
d2d1.dll;
DWrite.dll;
dxgi.dll;
d3d10_1.dll;
d3d10_1core.dll;
jscript9.dll;
msxml3.dll;
RocketDock.dll;
UxTheme.dll;
NSProcess32.dll;
user32.dll;
advapi32.dll;
oleaut32.dll;
msctf.dll;
InitechSHTTPInterface.10123.dll;
WLIDNSP.DLL;
InitechSHTTPInterface.10124.dll;
wshbth.dll;
InitechSHTTPInterface.11013.dll;
inicore_v2.3.16.dll;
inicrypto_v5.1.dll;
inipki_v5.1.19.dll;
pdm.dll;
mdmui.dll;
msdbg2.dll;
ws2help.dll;
ws2helpXP.dll;
mgLock.dll;
aticfx32.dll;
atiu9pag.dll;
atiumdag.dll;
atiumdva.dll;
wshqos.dll;
wshtcpip.DLL;
msi.dll;
igdumdx32.dll;
igdumd32.dll;
PowrProf.dll;
peerdist.dll;
AUTHZ.dll;
MPRAPI.dll;
ACTIVEDS.dll;
adsldpc.dll;
netprofm.dll;
npmproxy.dll;
iepeers.dll;
Flash32_11_3_300_271.ocx;
AcLayers.DLL;
SHELL32.dll;
MPR.dll;
mdnsNSP.dll;
IMEKRCIC.DLL;
IMEKRUDT.DLL;
MFC42.DLL;
MFC42LOC.DLL;
shdocvw.dll;
CRYPTUI.dll;
shdoclc.dll;
mlang.dll;
RASAPI32.DLL;
AcGenral.DLL;
Iphlpapi.DLL;
InitechSHTTPInterface.11014.dll;
wkscli.dll;
netutils.dll;
imaadp32.acm;
msg711.acm;
msgsm32.acm;
msadp32.acm;
l3codeca.acm;
MSVCR90.dll;
ShimEng.dll;
InitechSHTTPInterface.11010.dll;
inicore_v2.3.10.dll;
inipki_v5.1.17.dll;
MaCSProHook.DLL;
msaud32_divx.acm;
ImgUtil.dll;
pngfilt.dll;
ieproxy.dll;
dispex.dll;
gdiplus.dll;
D3DIM700.DLL;
MSVCP90.dll;
IMKR14.IME;
dhcpcsvc.DLL;
dhcpcsvc6.DLL;
imagehlp.dll;
audioeng.dll;
AVRT.dll;
windowscodecs.dll;
windowscodecsext.dll;
msxml6.dll;
d3d10.dll;
d3d10core.dll;
Iphlpapi.dll;
JScript.dll;
Flash32_11_3_300_257.ocx;
ImageSAFERFilter.dll;
actxprxy.dll;
nvinit.dll;
nvapi.dll;
D3D10Warp.dll;
f_sps.dll;
winspool.drv;
f_pbrc12.dll;
IMEKR70.IME;
DockShellHook.dll;
sprj_msg.dll;
InitechSHTTPInterface.10121.dll;
PENKOR.DLL;
HANJADIC.DLL;
Flash32_11_2_202_233.ocx;
imekr70.ime;schannel.DLL;
mshtmled.dll;
NTDSAPI.dll;
MSVCP60.dll;
fastprox.dll;
wbemsvc.dll;
wbemcomn.dll;
wbemprox.dll;
comdlg32.dll;
ghelper.dll;
WinCRT.dll;
sirenacm.dll;
Flash11g.ocx;
btmmhook.dll;
InitechSHTTPInterface.10122.dll;
PSAPI.DLL;
WindowsCodecs.dll;
Flash11e.ocx;
jsproxy.dll;
nvwddi.dll;
NVWRSKO.DLL;
nview.dll;
InitechSHTTPInterface.10113.dll;
PDM.DLL;
bdfilters.dll;
bdmpega.acm;
Flash32_11_2_202_235.ocx;
dxtmsft.dll;
dxtrans.dll;
ac3filter.acm;
samcli.dll;
sfc_os.DLL;
dwshengine80.DLL;
ShellHook.dll;
aswJsFlt.dll;
snxhk.dll;
Flash11f.ocx;
ProcessClean.dll;
UKHook40.dll;
avifil32.dll;
MSVFW32.dll;
/B/;
BLHK.dll;
GlobalCbt.dll;
CBJoiner.dll;
Ahm.dll;
QQZip.dll;
cat.dll;
MMGOGO.dll;
TTProject2.dll;
TTViolie.dll;
DLL_CabalOnline_2.dll;
D3DMenu_082412-082512.dll;
Cabal_290812.dll;
CabalMainVersion_081512.dll;
D3DMenu_082712-082812.dll;
MAXCore.dll;
\MaxCabal;
\PunkWH;
ca.dll;
plesedll.dll;
\ByPassGame;
\crckdWH;
wh.dll;
\Cheat Engine;
speedhack-i386.dll;
lol.dll;
cabalhack.dll;
\cabal\;
Cabal.dll;
WriteProcessMemory_Hook_Module.dll;
\yypip\HookGame.dll;
\CabalRider;
Mon Cabal Injector.dll;
VirtualProtectEx_Hook_Module.dll;
XTrapVa.dll;
CabulHack.dll;
Updater_CBL.dll;
Drache.dll;
korakora.dll;
cabah_hackPKL.dll;

Every dll you will try to inject to cabalmain that is below /B/; will cause DC, client crash or something like that, so you can imagine what can you do with that knowledge:P
(for morons: you can simple change name of dll and folder, then it should work fine!)
Have fun!
Correct me if i'm wrong, but it is working for me

GREAT..

tanyabeleren · 09/06/2012, 17:56

how to unpack it boss..

xkhay · 09/06/2012, 18:01

wow thank you for this.

bartbilf · 09/06/2012, 18:32

Quote:

Originally Posted by tanyabeleren

how to unpack it boss..

Just use Hellspider his .enc-tool

Thebuch · 09/06/2012, 18:39

hmm after decompresing changing names of files compressing cabal wont run... corrupted file ;o