I would like not only to request, but if somehow help in a way to make this possible, I wouldn't mind putting my time and efford into it. I have allready a "common sense" of what to search for to make this possible. However my lack of knowledge using Ollybgs is really poor. Thus I thou that if we all shared our knowledge or someone could guide me/us on how to do it I would really appreciate it. So far This is the idea what I got from a blog on face book
Before you begin:
Make a backup of your game.exe file. I normally just make a copy of it in the same folder, except rename it to game.bak. That way, if you screw things up, you can easily delete the bad file, and then rename game.bak back to game.exe.
STEP 1
Download OllyDbg. Download links are at the bottom of this post
Install and open OllyDbg.
Click File>Open or press F3
Navigate to the folder Shaiya is installed in. (this is probably in C:\AERIA GAMES\Shaiya, depending on install)
Open game.exe
STEP 2
In the big section that pops up, do the following:
Right Click>Search For>All intermodular Calls
In the window that appears /fills up with information, sort the results by destination. (this can be done by clicking on the column header)
Now remember that procedure. In the rest of this tutorial i will only be referring to it as searching for IC's.
STEP 3
So search for IC's and scroll down until you find kernel32.CreatMutexA. (in the destination column)
Double click on the first kernel32.CreatMutexA
3 lines under the line that is now highlighed (the kernel32.CreatMutexA), you should see JNZ SHORT game. in the middle column.
Double click the JNZ bit, and in the small window that pops up, change JNZ to JMP and click Assemble
Code:
1: Search for All intermodular calls
2: Sort by Destination
3: Scroll down till u find USER32.FindWindowA, and double click on it
4: Under the command TEST EAX,EAX change 1st JE to JMP
STEP 4
Search for IC's
Scroll to find kernel32.GetCurrentProcessId, and double click on the first one.
A couple of lines up in the middle column should be JNZ game.(numbers)
Double click on it, and change the JNZ to JMP, and click Assemble.
STEP 5
Search for IC's
Scroll to find kernel32.CreateProcessA, and double click on the second last one.
Above that, about 5 or 6 lines up, will be PUSH 1, and InheritHandles = TRUE.
Double click on it, and change the PUSH 1 to PUSH 0, and click Assemble
STEP 6
Press Ctrl+F
In the Find Command window that appears, copy in MOV EAX,262
In the line that Olly navigates to, double click it, and change to the MOV EAX,262 to MOV EAX,755 then click Assemble
STEP 7
Right Click>Search for>All referenced text strings
Scroll to find ASCII "start game", and double click on it
About 5 lines under you should see JE game.(numbers)
Double click on it, and change the JE to JMP
STEP 8
Right Click>Search for>All referenced text strings
Scroll to find ASCII "nProtect GameGuard", and double click on it
Directly under it you should see JNZ SHORT game.(numbers)
Double click on it, and change the JNZ to JMP
STEP 9
Right Click>Copy to executable>All modifications
In the new window that appears, Right Click>Save File and save it in the Shaiya folder.
STEP 10
Make a copy of the shorcut on your desktop/start menu, and called it "No GG Shaiya" or something. You probably shouldnt delete the original shortcut, so that you can update shaiya when you need to. Sometimes an update will not patch the game.exe, but when it does then just follow the above steps again.
In the new shortcut you made, Right Click>Properties
In the bit that says "C:\Aeria Games\Shaiya\game.exe", add start game to the end.
Your new shortcut should look like "C:\Aeria Games\Shaiya\game.exe" start game
Click Ok and you are done!
...............................................
I was trying to do something similar to this but I got stuck at step 3 lol I dont know what to change thou or something like TSE what do I change it to? ( note i am using TSE just an example its not really there )so far I get that we need to change command lines that call the client and that instead of loading 1 client, we can change those commands to load them again or freeze them i guess by changing their values. Please do correct me if i am wrong. and if i am in the wrong section please do forgive me.
Best Regards
elpedoloco.
