[Release]ObverseFlyff-Bypass

[/Aiden\]

I was playing around with the Client of . was working fine as i expected it to work. The "normal" Cheat Engine was not working at all. The strange thing about their "Antihack-System" is that they are not only using an internal client Antihack. They use "" in addition. I never saw this before so i decided to look into that. I found out that it connects to a remote server and sends data:





I don´t like that at all. So i decided to create a bypass as solution for this "problem". It is based on "Senpai greyb1t´s ( ͡° ͜ʖ ͡°)" .

Quick "How to use":


In case someone wants to know the IP&Port "Shark Shield" connects to:

Don't you dare to fire any packets to that destination

Here you can see how simple it is to use (with the same explanation):

Sorry if this gets patched :<




exe is packed.

 Spoiler

For those who want so take a look into "Shark Shield". I know you want it, Mootie Here are the 3 exe files extracted from the Client:

Have fun,
-/Aiden\

[greyb1t]

It's easy to tell they're not experienced at all. If you're allowed to kill their so called "Anti-Cheat" with a simple TerminateProcess call, you know they don't know **** =)

Creating an "Anti-Cheat" in .NET is not a good idea either ;/

Good job!

[Devisory]

Putting so much effort in something u can bypass way easier.

Just make a shortcut of the Game.exe and add the word 'release' at the end like this:



and now you are free to use all hacktools.

You can just use a customized cheat engine as well and it wont detect it or even Sandboxie.

Probably there are more methods to use cheat engine but what would you expect of server hosted by EvilSlayer? XD

[greyb1t]

Originally Posted by Devisory

Putting so much effort in something u can bypass way easier.

Just make a shortcut of the Game.exe and add the word 'release' at the end like this:



and now you are free to use all hacktools.

You can just use a customized cheat engine as well and it wont detect it or even Sandboxie.

Probably there are more methods to use cheat engine but what would you expect of server hosted by EvilSlayer? XD

Using that method you descibed above will not bypass their internal "anti-cheat", only the Shark Shield.
The reason he put such effort into bypassing it was not only to bypass Shark Shield, but also the internal in-game anti-cheat for those who do not have an undetected cheat engine. That was just a guess, not sure if that's why.

[Devisory]

Originally Posted by greyb1t

Using that method you descibed above will not bypass their internal "anti-cheat", only the Shark Shield.
The reason he put such effort into bypassing it was not only to bypass Shark Shield, but also the internal in-game anti-cheat for those who do not have an undetected cheat engine. That was just my guess, not sure if that's why

Yup.
Still trying to block cheat engine is almost impossible.
Its better to fix the bugs then putting up some useless shield.

There are still so many critical bugs working on this server.


I just figured out he added a string-check.
So for those trying to bypass the anti-hack with my method, should title change the cheat engine window to something else.

[/Aiden\]

Originally Posted by greyb1t

Creating an "Anti-Cheat" in .NET is not a good idea either ;/
Good job!

Well if there is a crypted synch between the Game & the "Anti-Cheat" then you can use any language. Some years ago i used to do that with my guard too. Of course you could still try to emulate packets and create a "GG-Emulator" as the *** himself nForce aka. dBased did with the Official GG.

Oh and i forgot to mention this: I had a bit trouble at the beginning with your source code. The client was always frozen. I had to exclude one thread suspension:

I know it is pretty obvious to exclude that one
You may want to add that feature to your Base Source aswell

[greyb1t]

Originally Posted by /Aiden\

Well if there is a crypted synch between the Game & the "Anti-Cheat" then you can use any language. Some years ago i used to do that with my guard too. Of course you could still try to emulate packets and create a "GG-Emulator" as the God himself nForce aka. dBased did with the Official GG.

Oh and i forgot to mention this: I had a bit trouble at the beginning with your source code. The client was always frozen. I had to exclude one thread suspension:

I know it is pretty obvious to exclude that one
You may want to add that feature to your Base Source aswell

What I meant with .NET being bad in that case, was that anyone's able to view the raw code and simply edit the IL code to break it. Of course, you're able to do that with any language just by asm, it's just that .NET languages are the most vulnerable ones regarding the simplicity to do it.

Now the issue you had was probably due to using the method on a different server than I did.
Now regarding the issue you had, it was probably due to you using the same method I used on Thai, on Obverse.
As you can see from the code, I filtered out the good and bad threads by the module name and the wait reason.

if (modInfo.name.find("Neuz") != std::string::npos)
	if (thread.getWaitReason() == DelayExecution)
		SuspendThread(thread.getHandle().getRaw());

By viewing the image you attached, I can see that the main thread also has the wait reason set to DelayExecution.
Meaning that the method I used, will not work it'll suspend the main thread aswell. But I guess you fixed the issue by not suspending the one thread that has the earliest Create Time?

I won't bother adding a comment saying that the method to filter the good and bad threads might vary based on server, if you're experienced enough, you should be able to figure it out on your own.

[Sammyz]

I'm happy you bypassed this, i don't play on this server but...

The person who created this anti-hack is prolly the most egotistical ***** in the world who backdoors and rootkits people for his MAC bans. He has even bragged about it and claims its unbypassable.

Great release lol.

[/Aiden\]

Originally Posted by greyb1t

By viewing the image you attached, I can see that the main thread also has the wait reason set to DelayExecution.
Meaning that the method I used, will not work it'll suspend the main thread aswell. But I guess you fixed the issue by not suspending the one thread that has the earliest Create Time?

I won't bother adding a comment saying that the method to filter the good and bad threads might vary based on server, if you're experienced enough, you should be able to figure it out on your own.

Your code loops throuh all threads. Windows is giving always the same information about threads. This means that when you list all the threads with ProcessThreadsView the loop of your Source will get the same information in the same row. I just needed to add a blacklist filer to it and "blacklist" the first suspension loop. With this method the main thread keeps running, while all the other "DelayExecution" threads get suspended.

Originally Posted by Sammyz

I'm happy you bypassed this, i don't play on this server but...

The person who created this anti-hack is prolly the most egotistical prick in the world who backdoors and rootkits people for his MAC bans. He has even bragged about it and claims its unbypassable.

Great release lol.

You are welcome

Edit: Ladies and gentlemen, I wish you a good weekend

[macroseller]

How is this connecting to remote server.
Its obviously function to send event messages to app windows. For example killing window, sending clicks...

[/Aiden\]

Originally Posted by macroseller

How is this connecting to remote server.
Its obviously function to send event messages to app windows. For example killing window, sending clicks...

You are absolutely right. That happens when you do stuff at 6 am
Used the wrong Screenshot. But as you can see from the other screenshot it is connecting to a remote server, wich can send commands to the client. Such as listing the clients process list etc. Wich is even shown in an advertisement?! video:

[greyb1t]

Originally Posted by /Aiden\

Your code loops throuh all threads. Windows is giving always the same information about threads. This means that when you list all the threads with ProcessThreadsView the loop of your Source will get the same information in the same row. I just needed to add a blacklist filer to it and "blacklist" the first suspension loop. With this method the main thread keeps running, while all the other "DelayExecution" threads get suspended.

That was basically what I said in the following quote:

But I guess you fixed the issue by not suspending the one thread that has the earliest Create Time?

The code runs through each thread in order of the create time, with the first thread being the first created.
So I guess the answer to my question is yes since you're doing exactly what I asked if you did.
That can be proved with the following code.

	gWin::ProcessEnumerator procEnum;

	for (auto &process : procEnum.getProcesses()) {
		if (process.getName() == "Neuz.exe") {

			for (auto &thread : process.getThreads()) {
				auto modInfo = process.getAssociatedModule(&thread);

				FILETIME fileTime;
				fileTime.dwLowDateTime = thread.getPtr()->CreateTime.LowPart;
				fileTime.dwHighDateTime = thread.getPtr()->CreateTime.HighPart;

				SYSTEMTIME sysTime;

				FileTimeToSystemTime(
					&fileTime,
					&sysTime
				);

				printf("%d-%d-%d %d:%d:%d\n", sysTime.wYear, sysTime.wMonth, 
                                	sysTime.wDay, sysTime.wHour, sysTime.wMinute, sysTime.wSecond);
			}
		}
	}

[Pkersawboy]

Hey, thanks for the bypass , I know Obverse shutted down but I'm playing on a pserver called Dravelinex which basically is a copy with the same Sharkshield.
I was wondering which Cheat engine you were using for Obverse flyff and if you could develope a new one for Dravelinex flyff ( New server).

[/Aiden\]

Originally Posted by Pkersawboy

Hey, thanks for the bypass , I know Obverse shutted down but I'm playing on a pserver called Dravelinex which basically is a copy with the same Sharkshield.
I was wondering which Cheat engine you were using for Obverse flyff and if you could develope a new one for Dravelinex flyff ( New server).

Jesus, that server sucks even more than my ExGf. But well okay, some people just like nasty stuff.

1)Start Client - Do NOT log in
2)Start Bypass - AS ADMIN
3)Log in
4)Have Fun

Download:

[EliteGermanremix]

What can ido with cheat engine after that idont have any knowledge or ideas if any one could help me