Unpacked 4.7.4 Client

Astaelan · 09/29/2009, 03:15

This is my first attempt at unpacking anything, much thanks to the various tidbits of information around this forum that made it possible.

This client is a pure unadulterated 4.7.4 EXE with imports and segments fixed. I am getting into 2Moons from the perspective of creating a new emulated server, and will be following up this unpacked EXE with a tool called DekaronShark that can be used for packet sniffing and protocol analyzing.

If you are interested in helping and can provide some packet structures or details on the protocol, please send me a private message here on the forum. For example, the first 3 packets 0x0020080, 81 and 82, I think I have an idea how they work but I am neither convinced, nor am I certain what the purpose of them is, as I haven't tested anything yet.

Anyway, you can find the unpacked 4.7.4 client here, and don't forget to press the thanks button if you find it useful.

<link removed>

kefty32 · 09/29/2009, 03:22

could not download men

~~~Twister~~~ · 09/29/2009, 03:42

well i downloaded it but i think it doesn't work with No-XIGN.exe the bypass by insan death. The message pops up saying that unpacked.exe has stoped working :O

Astaelan · 09/29/2009, 03:43

Uh, I was able to download it just fine. I even logged out of mediafire just to be sure.

Quote:

Originally Posted by Mr_Twistеr

well i downloaded it but i think it doesn't work with No-XIGN.exe the bypass by insan death. The message pops up saying that unpacked.exe has stoped working :O

That may be, I haven't been looking at this from the hacking perspective. I am not sure how No-XIGN works, but I suspect it injects a DLL which stubs or overwrites some assembly at runtime. If that is the case, it may not have the right offsets for 4.7.4, this is just speculation. My goals are aimed at using the client to develop my emulator.

Phoenix357 · 09/29/2009, 03:47

does not work with any bypass i have that includes instants nice try but sry :/

Quote:

Originally Posted by Astaelan

That may be, I haven't been looking at this from the hacking perspective. I am not sure how No-XIGN works, but I suspect it injects a DLL which stubs or overwrites some assembly at runtime. If that is the case, it may not have the right offsets for 4.7.4, this is just speculation. My goals are aimed at using the client to develop my emulator.

finding new offsets are easy just need a client that works on all servers not just kalibus

Astaelan · 09/29/2009, 03:50

Quote:

Originally Posted by Phoenix357

does not work with any bypass i have that includes instants nice try but sry :/

Nice try? Sorry? I don't think you understand. The EXE is unpacked, simple as that. Whether or not your old hacks and bypasses work is irrelevant, they need to be updated for 4.7.4. If you don't believe me, open the EXE in IDA, and you'll see all the imports are fixed, it analyzes properly, OEP is correct, and if you run the EXE, it works just like the packed version, you can login just fine.

Now, if you want your bypasses to work, then talk to those authors about updating their offsets for 4.7.4, it has nothing to do with the work I did in unpacking it. This is an unpacked 4.7.4 EXE, what you do with it is upto you, but I saw people asking for it so I decided to share.

~~~Twister~~~ · 09/29/2009, 03:50

Astaelan instead of double posting edit the previous post and add the info...or I'll have to report you for double post since it's my job lol (posts # 4,5

)

Astaelan · 09/29/2009, 03:53

Quote:

Originally Posted by Mr_Twistеr

Astaelan instead of double posting edit the previous post and add the info...or I'll have to report you for double post since it's my job lol (posts # 4,5 )

Those 2 posts were in response to 2 different people. And were in fact, posted separately, the second response wasn't posted until I posted the first one and saw someone else replied. Anyway, if posting responses to people is against the rules, I'll keep my **** to myself.

Phoenix357 · 09/29/2009, 03:53

Quote:

Originally Posted by Mr_Twistеr

Astaelan instead of double posting edit the previous post and add the info...or I'll have to report you for double post since it's my job lol (posts # 4,5 )

i say give it a go twisted. i think every1 else gave up :s

~~~Twister~~~ · 09/29/2009, 03:59

Quote:

Originally Posted by Astaelan

Those 2 posts were in response to 2 different people. And were in fact, posted separately, the second response wasn't posted until I posted the first one and saw someone else replied. Anyway, if posting responses to people is against the rules, I'll keep my **** to myself.

You are not supposed to double post, it doen't metter how many responses you give you can put them all in one post. I was just trying to help out since you are new on the forums, but if you don't listen i can't help ya. please read our forum rules (

) tnx, have a good day.

Quote:

Originally Posted by Phoenix357

i say give it a go twisted. i think every1 else gave up :s

Well i warned him so here it goes

+#4,5 reported at 28/09/09 18:58 GMT-8 cause double post.

Astaelan · 09/29/2009, 04:06

Quote:

Originally Posted by Mr_Twistеr

You are not supposed to double post, it doen't metter how many responses you give you can put them all in one post. I was just trying to help out since you are new on the forums, but if you don't listen i can't help ya. please read our forum rules () tnx, have a good day.

Well i warned him so here it goes
+#4,5 reported at 28/09/09 18:58 GMT-8 cause double post.

Wow... lame rules, even lamer to get "reported" over it, after dealing with retards who don't know what an unpacked exe is, complaining that their 1-click cheats don't automatically work again. Please, do me a favor, just forget I tried to contribute anything, delete the post, I'll remove the file from mediafire, forget me even trying to help those who knew what they were asking for in the first place.

~~~Twister~~~ · 09/29/2009, 04:12

Quote:

Originally Posted by Astaelan

Wow... lame rules, even lamer to get "reported" over it, after dealing with retards who don't know what an unpacked exe is, complaining that their 1-click cheats don't automatically work again. Please, do me a favor, just forget I tried to contribute anything, delete the post, I'll remove the file from mediafire, forget me even trying to help those who knew what they were asking for in the first place.

I'm grateful for what you posted, reporting is my job on this forums. Since I'm not a MOD i can't do anything but report any rule breakings that i see, don't take it personally.

Astaelan · 09/29/2009, 04:18

Quote:

Originally Posted by Mr_Twistеr

I'm grateful for what you posted, reporting is my job on this forums. Since I'm not a MOD i can't do anything but report any rule breakings that i see, don't take it personally.

It's cool, link was removed, no sweat off my sack, if ya catch my drift, first thing people jumped to was "zomg my hackzors don't work, you fail!".

Then, it's followed up with a, no offense to you, retarded forum rule that contradicts every standard forum policy I've dealt with. I don't hold you responsible, but I do hold you accountable for your choice in being in a position to enforce such an obviously stupid rule.

Anyway, point made, my link is gone, I thought the community here was a bit more intelligent, but the handful of replies whining about hacks not working just proves otherwise.

kikichan · 09/29/2009, 05:40

Twister, he aint new XD joined on Dec of 07 and err 7 post.

@Astaelan, rules are rules. Lame or not, it must be followed. You are welcome to complain about our rules. People have position to keep the forum clean and neat or do things that would improve them. If twister didnt do his job as a guard then why would he BE a guard in the first place? Please dont take it on others when its your own fault not to read/know our forum rules. We also do not care which forum you had came from. We dont take others forum rules and it does not always apply here.

ps: We are one of the best forum. But dont apply the user action on the forum itself.

+Close and infraction.