[Release & Source] Flyff Webzen Bow Hack

[cookie69]

Originally Posted by iSuperman

For the noobs.. : How are we supposed to use this?

Put it in a DLL, adapt it a little bit and inject the dll in neuz

[iSuperman]

i still dont get it

[DerSanu]

was easy to build an injector, but to hard for me to build the dll, if you dont now c++ than u have to play normal xD

[Ræið]

Simple code for anyone intressted in how the DLL could look!


Thanks to Omdi for the slight modification helps, also thanks to cookie69 for helping me with DLL's previously

bool AlreadyHooked = false;
UINT32 gRWXBuf = NULL;
UINT32 gSendActMsgOrig = NULL;
UINT32 gStrongBowEnabled = NULL;


void BowHack()
{
	UINT32 GameBase = (UINT32)GetModuleHandleA(0);
	if (!GameBase)
	{
		return;
	}

	// SendActMsg: Neuz.exe + 19B780 | 55 8B EC F6 41 08 08 74 ??
	// Inject shellcode if not already done
	if (!AlreadyHooked)
	{
		// Get CActionMover Object
		UINT32 Ptr1 = *(UINT32*)(GameBase + 0x004FFA94);
		if (Ptr1)
		{
			UINT32 CActionMoverObj = *(UINT32*)(Ptr1 + 0x33C);
			if (CActionMoverObj)
			{
				std::cout << "CActionMoverObj" << CActionMoverObj << std::endl;
		

				// First 16 Bytes used for Shadow VMT
				UINT32 CActionMoverObjVtable = *(UINT32*)CActionMoverObj;
				if (CActionMoverObjVtable)
				{
					std::cout << "CActionMoverObj" << CActionMoverObjVtable << std::endl;
		

					// Allocate space for vmt & shellcode
					/*
					16 bytes - ShadowVMT
					4  bytes - Used for Settings
					?  bytes - Shellcode
					*/
					if (gRWXBuf == NULL)
					{
						SIZE_T RWXBufSize = 4096;
						gRWXBuf = (UINT32)VirtualAlloc(NULL, RWXBufSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
						std::cout << "gRWXBuf  " << gRWXBuf << std::endl;
					}

					memcpy((void*)gRWXBuf, (void*)CActionMoverObjVtable, 16);

					// Save SendActMsg 
					gSendActMsgOrig = *(UINT32*)(CActionMoverObjVtable + 4);
					std::cout << "gSendActMsgOrig  " << gSendActMsgOrig << std::endl;

					// Save gStrongBowEnabled Ptr
					gStrongBowEnabled = (UINT32)(gRWXBuf + 16);

					// Setup shellcode
					unsigned char Shellcode[] =
					{
						0x50,				// push eax
						0x8B, 0x45, 0xDC,	// mov eax, [ebp-0x24] | eax now holds dwItemId
						0x83, 0xF8, 0x00,	// cmp eax, 0
						0x75, 0x11,			// jne $JMPBACK

						0xA1, 0xAA, 0xAA, 0xAA, 0xAA, // mov eax, [StrongBowEnabled]
						0x83, 0xF8, 0x01,   // cmp eax, 1

						0x75, 0x07,			// jne $JMPBACK
						0xC7, 0x45, 0xDC, 0x04, 0x00, 0x00, 0x00, // mov [ebp-0x24], 4

						// $JMPBACK
						0x58,  // pop eax
						0xE9, 0xBB, 0xBB, 0xBB, 0xBB, // jmp [gSendActMsgOrig]
					};

					*(UINT32*)(Shellcode + 10) = (UINT32)gStrongBowEnabled; // StrongBowEnabled
					*(UINT32*)(Shellcode + 28) = (UINT32)(gSendActMsgOrig - (gRWXBuf + 47) - 5); // jmp back

					// Copy Shellcode
					memcpy((void*)(gRWXBuf + 20), Shellcode, sizeof(Shellcode));

					// Patch VMT Ptr
					*(UINT32*)(CActionMoverObjVtable + 4) = gRWXBuf + 20;

					std::cout << "VMT Hook placed :)" << std::endl;
					AlreadyHooked = true;
				}
			}
		}

	}

	if (AlreadyHooked)
	{
		*(UINT32*)gStrongBowEnabled = 1;		
	}

}

INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)
{
	switch (Reason)
	{
	case DLL_PROCESS_ATTACH:
	{
		DisableThreadLibraryCalls(hDLL);
		//g_hModule = hDLL;
		BowHack();
		break;
	}
	case DLL_THREAD_ATTACH:
	case DLL_PROCESS_DETACH:
	{
		break;
	}
	case DLL_THREAD_DETACH:
		break;
	}
	return TRUE;
}

[Paraguz]

gosh just compile that **** and release it for the users
why always those BS posts where no one can use it ?
dont claim to release a hack if its just a source that 99% of the population can not use.
no everyone wants to spend hours on learing c++ and compiling programms or DLLs and injecting them.
People have other hobbys and a life too, its just a game so if you release something like that, then make it usable for everyone.

[/Aiden\]

Originally Posted by Paraguz

gosh just compile that **** and release it for the users
why always those BS posts where no one can use it ?
dont claim to release a hack if its just a source that 99% of the population can not use.
no everyone wants to spend hours on learing c++ and compiling programms or DLLs and injecting them.
People have other hobbys and a life too, its just a game so if you release something like that, then make it usable for everyone.

1. The binaries were included, they are just patched yet. You are too late.
2. Indeed ppl have other hobbys thats why they do not have the time to update everything for free for leechers.
3. Releasing a source for others is a way to learn how to do such things. You can give someone that is hungry food all the time but if you teach him how to grow his own food it is worth way more.
4. If you are too lazy to learn coding or your mind is not evolved enough to understand: it is the same as in RL -> bad luck.
5. If you really want someone to release a working, updated binary that badly show some love to the community and release it yourself.
6. You won the FlameChampion and LeecherChampion trophy with a single post.

[netHoxInc]

Originally Posted by Paraguz

gosh just compile that **** and release it for the users
why always those BS posts where no one can use it ?
dont claim to release a hack if its just a source that 99% of the population can not use.
no everyone wants to spend hours on learing c++ and compiling programms or DLLs and injecting them.
People have other hobbys and a life too, its just a game so if you release something like that, then make it usable for everyone.

Somehow i got the feeling that you're just angry that you can not get it to work by urself, and now you blame Omdi for that?

Also, you need 0% knownledge of anything to download VS and simply compile it. There's even a given response of a regular dll file to use it inside. (No need to go r0 like Omdi did).

So now we're at the point that you most likely dont even know what VS is, or ure unable to install an application and hit a button.

Hooray. I love the Flyff Community.

[Paraguz]

Originally Posted by netHoxInc

Somehow i got the feeling that you're just angry that you can not get it to work by urself, and now you blame Omdi for that?

Also, you need 0% knownledge of anything to download VS and simply compile it. There's even a given response of a regular dll file to use it inside. (No need to go r0 like Omdi did).

So now we're at the point that you most likely dont even know what VS is, or ure unable to install an application and hit a button.

Hooray. I love the Flyff Community.

no im not mad.
im not even playing official flyff.
but i dont get why people release something without making it available to use for everyone?

[Hömer]

Originally Posted by netHoxInc

Somehow i got the feeling that you're just angry that you can not get it to work by urself, and now you blame Omdi for that?

Also, you need 0% knownledge of anything to download VS and simply compile it. There's even a given response of a regular dll file to use it inside. (No need to go r0 like Omdi did).

So now we're at the point that you most likely dont even know what VS is, or ure unable to install an application and hit a button.

Hooray. I love the Flyff Community.

Hello Sir, please make video sir.

[netHoxInc]

Originally Posted by Paraguz

no im not mad.
im not even playing official flyff.
but i dont get why people release something without making it available to use for everyone?

As Aiden told you before, and the first view of the first post should tell you:
There were easy 2 use binaries. They simply got removed due to them being outdated.

The rtfm smiley btw isnt a thing you should use if you cannot read urself.

Cheers

[Omdi]

Originally Posted by Paraguz

no im not mad.
im not even playing official flyff.
but i dont get why people release something without making it available to use for everyone?

just imagine flyff gets updated and the binaries do not work anymore who is going to update it since "im not even playing official flyff"? thats why i released the source and dude you should be thankful that i released this for free (+ source) instead of charging money for it.

[drogba300]

Originally Posted by iSuperman

For the noobs.. : How are we supposed to use this?

this ^^ I dont understand all that coding lol

[drogba300]

Originally Posted by Omdi

just imagine flyff gets updated and the binaries do not work anymore who is going to update it since "im not even playing official flyff"? thats why i released the source and dude you should be thankful that i released this for free (+ source) instead of charging money for it.

I'd pay you to update it

[deathkidkira]

Teach me how to put the codes please

[Liamtot]

Please show how to use this in flyff im a biginner it would be awsome if you can help new players