SV trace assembly code

[anantasia]

Sorry this thread isn't work anymore since patch 4346. Please goto this link.
[color=red]http://www.elitepvpers.com/forum/index.php?act=ST&f=53&t=42366&s=[color]


*** History ***

First thing to do is download all program that require,

1. Download SV (2 files of them)
Download link for SV for patch 4337 is posting below please find it.

2. Use "Cheat Engine" to set trace/debug & trap
Here is link to download "Cheat Engine"


3. Uncompress Exe & Hex edit program,


Below is instruction code and step that you see in Cheat Engine, Please follow step,
.
/*1* Starting SV insert user/password use any char more than 5 character and don't press start
.
/*2* Start Cheat Engine and click on top left icon to select Scriptvessel process. Then click memory viewer.
.
On Left Upper side windows right click and goto address as shown belwo then Set trap(breakpoint) on first instruction as seen below and click start button at SV window
.
004035B6 je 403XXX <- Set Break Point on this and select does nothing
004035BC move ecx,[ebp-2c]
.
/*3* After click start your cheat engine should stop at above line with EIP on Left Upper window is equal that above address. Right click on that address and select Replace with code that does nothing
.
.
/*4* Goto address 4035EB and Right click to replace with code that does nothing also
004035EB jne 403XXX <- Replace this code with does nothing
004035F1 cmp [004356e0],edi
004035F7 jne 403XXX <- Replace this code with does nothing
004035FD push 00
.
.
/*5* Goto address 4036A5 and Set trap here. When CE stop press F7 at here to trace in to countrymakeinus.dll routine.
004036A5 CALL 00403XXX <- Press F7 at here
004036AA mov eax,[esi+1c]
.
.
/*6* Routine 403XXX will send you to address 10002860.
00403XXX JMP DWORD PTR[00429508] <- Press F7 at here
.
.
/*7* From this point u must change any address below to does nothing before press F9. Please look carefully for JNE command.
10002860 SUB ESP, 000000C8 <- here is starting of countrymakeinus.dll
.
.
10002895 JNE XXXX <- Right click and replace with code that does nothing
.
100028A2 JNE XXXX <- Right click and replace with code that does nothing
.
10002932 JNE XXXX <- Right click and replace with code that does nothing
.
1000294F JNE XXXX <- Right click and replace with code that does nothing
.
1000296F JNE XXXX <- Right click and replace with code that does nothing
.
1000298C JNE XXXX <- Right click and replace with code that does nothing
.
100029AC JNE XXXX <- Right click and replace with code that does nothing
.
10002A3D JNE XXXX <- Right click and replace with code that does nothing
.
10002A5A JNE XXXX <- Right click and replace with code that does nothing
.
10002AEB JNE XXXX <- Right click and replace with code that does nothing
.
10002E47 JNE XXXX <- Right click and replace with code that does nothing
.
.
When found JNE command Right click and replace with code that does nothing next command. .
.
there amount 11 jump condition (JNE) at here.
.
.
/*11* This section add due to date checking, You must hard code to edit it in countrymakeinus.dll
.
You must need some tool to do it. Please follow below link to download unpack and hex edit program.

.
Find 0F 8F E0 A8 00 00 and Replace with 90 90 90 90 90 90
Find 0F 8F D0 A8 00 00 and Replace with 90 90 90 90 90 90
Find 0F 85 B6 A8 00 00 and Replace with 90 90 90 90 90 90
.
/*12* Then Press F9 to make program run, If you work succesfully you may get message "Return to program and try press F11" to test bot is activate or not press F11 at CO2

From this point you can start bot by press Funtion key 11


-- History Update --
1) change from asking to guidance.
2) Update for new patch 4337.
3) Update for checking date in script. Minor correct

[anantasia]

Here is link may you can learn and outstanding about hex editing , crack and debug program

by Cucurucho

by Cucurucho

by Enki

by mind...

by coder62

by dpman405

Relate topic
For stripper expand compress file
by alatedseraph

How to using SV
by king69_666

SV manual
by Clyps

Change your caption on SV or AgentKing
by SchizO


If you think that link helpful give karma to who creator of that thread.

[anantasia]

/**** Old History pls ignore

To experts,

I try trace assembly code on this program

AgentKing



and found that there check point on following trap assembly code

Please take breakpoint on 403596,4035cb

00403596 je 40378c <- by pass this point
0040359C move ecx,[ebp-2c]
.
.
004035CB jne 40378c <- by pass this point
004035D1 cmp [004356e0],edi
.
.

00403685 call 403cf6 <- call SV routine and disable button

I can't trace anything else, Anyone please suggest.

Continue
...

00403596 je 40378c <- by pass this point
0040359C move ecx,[ebp-2c]
.
.
004035CB jne 40378c <- by pass this point
004035D1 cmp [004356e0],edi
004035D7 jne 40378c <- by pass this point
004035DD push 00
.
.

00403685 call 403cf6 <- call SV routine (PF11 to activate and disable button)



in 403cf6 jmp long ptr to 10002860


10002860 mov eax,[esp+08]
10002864 mov ecx,[esp+04]
.
.
1000286A call 1001e134 <--- it's said returns to game and press key f11 or * to start the partner!

BTW after that it's check script vessel is new or not and not activate function anymore

anyone could help?

Continue
Sorry for download link for agent king, below is new one,
Anyway i use Cheat Engine to set trace & trap
here is link to download

.
/** Starting King Agent insert user/password and click start
.
.
/** set trap
00403596 je 40378c <- by pass this point to 40359C
0040359C move ecx,[ebp-2c]
.
.
/** set trap
004035CB jne 40378c <- by pass this point to 4035DD
004035D1 cmp [004356e0],edi
004035D7 jne 40378c <- by pass this point
004035DD push 00
.
.
/** set trace
00403685 call 403cf6 <- call SV routine (PF11 to activate and disable button as picture below)

.
.
00403CF6 jmp PTR <- call countrymakeinus.dll jmp long ptr to 10002860
.
.
/** module countrymakeinus.dll
10002860 mov eax,[esp+08]
10002864 mov ecx,[esp+04]
.
.
/** set trap and change
10002874 jne <-- by pass next command
1000287E jne <-- by pass next command
10002894 je <-- jump address
100028AE jne <-- by pass next command
100028C8 jne <-- by pass next command
100028E7 jne <-- by pass next command
10002901 jne <-- by pass next command
1000291B jne <-- by pass next command
10002931 je <-- jump address
10002949 jne <-- by pass next command
10002963 jne <-- by pass next command
1000299C jne <-- by pass next command
100029B2 je <-- jump address
100029BF jnl <-- jump address
100029CC jnl <-- jump address
100029E2 je <-- jump address
10002A06 jne <-- by pass next command
10002A1C je <-- jump address
10002A29 jnl <-- jump address
10002A36 jnl <-- jump address
10002A4C je <-- jump address
.
.
/** after all that trace u can go to program and press PF11 and this is result,


I think it's cause of invalid script vessel that need for more further check.
Anyone have suggestion?

[anantasia]

Oh at last i got that program work,

I will answer trick later

[anantasia]

Here is uncracked scriptvessel execute file. **4337**

!! You must DIY to crack it

[anantasia]

Here is uncracked Dynamic Link Library that use with previous execute file.

[Violent_Plague]

Not to reveal any mistrust, but can someone scan this? I'm having problems getting to Jotti's, a bit busy..


File: AgentKing.exe
Status:
OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 2c271bfd0deaca5745e87bf069999862
Packers detected:
PE_PATCH, ASPROTECT

AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing


File: countrymakeinUS.dll
Status:
OK(Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 bfcd6e9cd879bb6c01b7fbf2d6266f04
Packers detected:
ASPROTECT

AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

[anantasia]

See above

[gorgone]

anny wht are u usiing for debug the code ? i m in hexa but i m master porogramme in .net and use reflex on programs

but not enought for this script

[Violent_Plague]

Now that the scans are out of the way, this time ignoring my ignorance, what exactly does your downloadable files contain that the original ScriptVessel doesn't?

[Xibungo]

anantasia, this way to use the program its only for programmers?

[fastblade1]

wow! nice +k good job for release it.. btw it works..? :?

[Violent_Plague]

Unless i know exactly what her program is for and what it does, I can't really +k.. So any explanation on what you've done would be nice..

[anantasia]

Originally posted by fastblade1@Jan 4 2007, 23:14
wow! nice +k good job for release it.. btw it works..? :?

Yah it's work as post picture as above,

I try post this for ask some help but anyone can answer it. So i will answer crack in DIY version. Anyone who want it must do it yourself. I ever ask crack one from ratz but i think i can do it.

I know that it's really hard and take time to trace assembly code. You must have fundamental of basic assembly code.

But for this it's make sure that u can do it yourself without trojan,virus or keylogger,

Have a nice day

[Xibungo]

u cant do it for us anantasia? if not, i will try it myself, i know a little about c+ and pascal, i think its a base... or not?