Cracking SV

[susuchai]

can anyone help me?
trainer program "launch" button is grey

<hr>Append on Mar 20 2007, 21:39<hr> yay now i could launch...
but the problem is that everytime i patch the program, the computer hangs - the background doesnt refresh and like everything stops

[Tw3ak]

Originally posted by Night666@Mar 20 2007, 21:30
@ Lake292

Hi, thx for the help but i dont finish it yet. I have some questions(correct me if im wrong):

1.- Is this version that i have to use "ScriptVessel-4339.zip (2/23/07) <---- New Dont Pickup Item Function"? I dont know what 3/02 version is.

2.- Im using Hiew (great tool! ty) but i cant find some adress that anastasia posted:

100037dc <- Replace with no code
100037dd <- Replace with no code
10003843 <- Replace with no code
10003844 <- Replace with no code

Btw the tips that u did of Hiew are clear!* TY*

this is because these adresses show in memory due to the call to dll there not in the exe

those remaining adresses are edits if your doing it by hex editing or manual edit i assume u must do in the countrymakeinus.dll and you should be golden

[Lake292]

hiew is great tool just scan that file i posted after i cracked it... it says there is some trojan so carefull i dunno im using it long and didnt have problem but its suspicious

[vladbb]

Originally posted by thechaoshydra@Mar 20 2007, 17:56
This morning i followed the post and i make vessel to work perfectly.

Byt now i get this message :

Welcom to use this Platform!
Logining......
Sorry, the Client is not accept. 2007-3-21 0:52:18

On F11 i get the meny to set up byt the character doesent move & attack at all.


any solution for this?

Did the same thing...cracked sv and when i press F11 abd then Start it doesnt move or attack..:|
Can someone clear this up for me?

[Lake292]

@Night666
i was talking about this version i tried and i think only this one is working atm

download it... and using HIEW
open scriptvessel.exe
and change this adresses
40F6E8 < Replace with no code
40F8C2 < Replace with no code
40FAA7 < Replace with no code
40FAAF < Replace with no code
40FAE4 < Replace with no code
40FAF0 < Replace with no code
and after u made this u have edited SV file
now u just need to change that unhook
so run scriptvessel.exe and with cheatengine go into your memory view
and do like anantasia says
Press Ctrl + Alt + S in Cheat Engine and find UnhookWindowsHookEx write down address on the left XXXXXXXX

Go to address XXXXXXXX from above and Replace with command "Ret 0004"

exactly its adress 77D05DF3 and just change its code to ret 0004 and put no operation on 3 left bytes
then fill in pass and id press start on SV
it will say just loginning... and wont say anything more not even gray icons or what but it will work in game so open your co window and press F11
it should work
if any problems tell me where

<hr>Append on Mar 20 2007, 23:53<hr>

Originally posted by vladbb+Mar 20 2007, 23:48--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (vladbb @ Mar 20 2007, 23:48)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin--thechaoshydra@Mar 20 2007, 17:56
This morning i followed the post and i make vessel to work perfectly.

Byt now i get this message :

Welcom to use this Platform!
Logining......
Sorry, the Client is not accept. 2007-3-21 0:52:18

On F11 i get the meny to set up byt the character doesent move & attack at all.


any solution for this?

Did the same thing...cracked sv and when i press F11 abd then Start it doesnt move or attack..:|
Can someone clear this up for me? [/b][/quote]
only sv 4339 03/01 is working atm
older stopped moving like if there was data check again

[Night666]

@Lake292

Thx for the help, now i understand all.

I thought that we could make patch without cheat engine with HIEW Tool But the f*** UnhookWindowsHookEx function can be patched except in memory.

Anyway we have to do only 1 change with CE, It's ok but not cool.

@Tw3ak

I have edited the dll but I dont know exactly what look for cuz the adress seems to be normal code 100037dc ---> mov sp, cx and it suposed to be jmp ,call or any type of jump for patch.

Well i have learn some more about asm. TY

[Lake292]

yea... i was searching for that to make it standalone but no success
but that one step wont kill if im doing it like once a week better then making 6 steps

[MAFIA BOSS]

AhnLab-V3 2007.3.21.0 03.20.2007 no virus found
AntiVir 7.3.1.44 03.20.2007 no virus found
Authentium 4.93.8 03.20.2007 no virus found
Avast 4.7.936.0 03.20.2007 no virus found
AVG 7.5.0.447 03.20.2007 no virus found
BitDefender 7.2 03.21.2007 no virus found
CAT-QuickHeal 9.00 03.20.2007 no virus found
ClamAV devel-20070312 03.21.2007 no virus found
DrWeb 4.33 03.20.2007 no virus found
eSafe 7.0.14.0 03.20.2007 no virus found
eTrust-Vet 30.6.3496 03.20.2007 no virus found
Ewido 4.0 03.20.2007 no virus found
FileAdvisor 1 03.21.2007 No threat detected
Fortinet 2.85.0.0 03.20.2007 suspicious
F-Prot 4.3.1.45 03.20.2007 no virus found
F-Secure 6.70.13030.0 03.21.2007 no virus found
Ikarus T3.1.1.3 03.20.2007 Trojan-PWS.Lenmir.30 <---- :S
Kaspersky 4.0.2.24 03.21.2007 no virus found
McAfee 4988 03.20.2007 no virus found
Microsoft 1.2306 03.21.2007 no virus found
NOD32v2 2129 03.20.2007 no virus found
Norman 5.80.02 03.20.2007 no virus found
Panda 9.0.0.4 03.20.2007 no virus found
Prevx1 V2 03.21.2007 no virus found
Sophos 4.15.0 03.13.2007 no virus found
Sunbelt 2.2.907.0 03.16.2007 no virus found
Symantec 10 03.21.2007 no virus found
TheHacker 6.1.6.078 03.20.2007 no virus found
UNA 1.83 03.16.2007 no virus found
VBA32 3.11.2 03.19.2007 no virus found
VirusBuster 4.3.7:9 03.20.2007 no virus found
Webwasher-Gateway 6.0.1 03.20.2007 Worm.Win32.Malware.gen (suspicious) <--- :S :dead: :dead:

the sv 4339 03/01 have virus we need clean (sv) plz ..

[Lake292]

there is no clean SV 4339 it was made with virus by creators

[Tw3ak]

Originally posted by Lake292+Mar 20 2007, 23:49--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (Lake292 @ Mar 20 2007, 23:49)</td></tr><tr><td id='QUOTE'> @Night666
i was talking about this version i tried and i think only this one is working atm

download it... and using HIEW
open scriptvessel.exe
and change this adresses
40F6E8 < Replace with no code
40F8C2 < Replace with no code
40FAA7 < Replace with no code
40FAAF < Replace with no code
40FAE4 < Replace with no code
40FAF0 < Replace with no code
and after u made this u have edited SV file
now u just need to change that unhook
so run scriptvessel.exe and with cheatengine go into your memory view
and do like anantasia says
Press Ctrl + Alt + S in Cheat Engine and find UnhookWindowsHookEx write down address on the left XXXXXXXX

Go to address XXXXXXXX from above and Replace with command "Ret 0004"

exactly its adress 77D05DF3 and just change its code to ret 0004 and put no operation on 3 left bytes
then fill in pass and id press start on SV
it will say just loginning... and wont say anything more not even gray icons or what but it will work in game so open your co window and press F11
it should work
if any problems tell me where

<hr>Append on Mar 20 2007, 23:53<hr>

Did the same thing...cracked sv and when i press F11 abd then Start it doesnt move or attack..:|
Can someone clear this up for me?

only sv 4339 03/01 is working atm
older stopped moving like if there was data check again [/b][/quote]
77D05DF3 << -- is what it is on YOUR machine it is different on other peoples pc which is why anastasia said to find the adress on your own and do ret 0004 it won't be the same addy for all

like for me it is 77D4F22E ret 0004

that offset is only present in memory from user32 when SV is loaded.

also anything in the 7xxxxxx range in memory is kernel adress space and is protected you can't just patch user32 because other progies calling functions to it would cease to function. ( I believe why alot of peeps getting the drwatson crash bug )

The way i'm gonna go about it is patch it by form of injection.what i'm going to do is patch the caller to call something else instead then pad the PE with my own code then apon successful start of SV the injector will close.


I dunno how anastasia patched his stand alone it may be similair or maybe he did it a easier/different way lol i dunno but i know this way works too i have done it before on prior co-part versions.


also note my 2/31 version still works fine like all my others before that.I dunno what you guys are patching wrong that they all die everyother day lol

[Lake292]

interesting that the adress was same for me on 6 pcs lol

[COAddict220]

I found the unhook file but not sure exactly how to replace the address with "ret 0004". How is that done? Thanks!

[Tw3ak]

Originally posted by COAddict220@Mar 21 2007, 03:30
I found the unhook file but not sure exactly how to replace the address with "ret 0004". How is that done? Thanks!

in memory view of cheat engine in middle of window where adress is listed right click and click assemble then replace the code with ret 0004 and hit ok and it will popup with a unsigned bytes msg just hit yes then go to sv and hit start it will say loging... and that's it then go to co and hit f11 it should work.

[Lake292]

or just double click on that adress

[COAddict220]

Originally posted by Tw3ak+Mar 21 2007, 03:32--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (Tw3ak @ Mar 21 2007, 03:32)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin--COAddict220@Mar 21 2007, 03:30
I found the unhook file but not sure exactly how to replace the address with "ret 0004". How is that done? Thanks!

in memory view of cheat engine in middle of window where adress is listed right click and click assemble then replace the code with ret 0004 and hit ok and it will popup with a unsigned bytes msg just hit yes then go to sv and hit start it will say loging... and that's it then go to co and hit f11 it should work. [/b][/quote]
Oh thanks! Got what I needed.