[Rodnia] How to unban yourself

[cookiechaser]

 Spoiler

Open regedit, go to HKEY_CURRENT_USER/SOFTWARE/R2HIK
You can just change the last HEX number of ComputerID to anything else than the current one example change 4 to 5.

Now go to HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Cryptography
Search for a GUID generator online, get a new GUID and change MachineGuid to it.

Done, your HWID ban is gone.
I will add a HWID spoofer to my Rodnia Multihack in the next update, so you don't have to actually change it.

How it works:

 Spoiler

Rodnia checks for these two keys, here is the actual function:


For those of you who want to reverse it:
55 8B EC 6A ? 68 ? ? ? ? 64 A1 ? ? ? ? 50 64 89 25 ? ? ? ? 81 EC ? ? ? ? 53 56 C7 45

For coders:

 Spoiler

The function gets called when you try logging in, and then continously after every ~20 seconds.



some c++ code:

std::string get_random_guid()
{
GUID guid;
CoCreateGuid(&guid);
char guidStr[37];
sprintf_s(
guidStr,
"%08lx-%04hx-%04hx-%02hhx%02hhx-%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx",
guid.Data1, guid.Data2, guid.Data3,
guid.Data4[0], guid.Data4[1], guid.Data4[2], guid.Data4[3],
guid.Data4[4], guid.Data4[5], guid.Data4[6], guid.Data4[7]);

return guidStr;
}

std::string get_random_computer_id()
{
char str[30 + 1] = { 0 };
const char* hex_digits = "0123456789abcdef";

for (auto i = 0; i < 30; i++) {
str[i] = hex_digits[g_math->random_int(0, 16)];
}

return str;
}

void __cdecl get_hwid_hooked(std::string* a1)
{
const auto original = g_hooks->get_hwid_hook->get_original_function<decltype(&
get_hwid_hooked)>();

static std::string random_guid;
static std::string random_computer_id_1;
static std::string random_computer_id_2;

g_hooks->get_hwid_hook->unhook();
original(a1);
g_hooks->get_hwid_hook->rehook();

g_log_manager->log(colors::red, "HWID: changing a1[0]: %s, a1[1]: %s, a1[2]: %s ->", a1[0].c_str(), a1[1].c_str(), a1[2].c_str());

if (random_guid.empty())
random_guid = get_random_guid();

if (random_computer_id_1.empty())
{
random_computer_id_1 = get_random_computer_id();

random_computer_id_2 = random_computer_id_1;
random_computer_id_2.push_back('f');
}

a1[0] = random_computer_id_2;
a1[1] = random_computer_id_1;
a1[2] = random_guid;

g_log_manager->log(colors::green, "\ta1[0]: %s, a1[1]: %s, a1[2]: %s ->", a1[0].c_str(), a1[1].c_str(), a1[2].c_str());
}

[AsylumShaco]

rude boy

[badmad21]

cant find: HKEY_CURRENT_USER/SOFTWARE/R2HIK, cant find R2HIK

[anderta41]

Thanks buddy

[yight21]

Could you explain how did you reach these functions? I mean which tools you used or a more clear explanation please?

[cookiechaser]

Originally Posted by yight21

Could you explain how did you reach these functions? I mean which tools you used or a more clear explanation please?

yeah, i used apimonitor first, then for dynamic bypass hooked CNetworkStream::Send printing _ReturnAddress to find the sendlogin function, and reversed the get_hwid function from there in IDA

[Angel01234]

is it possible to do for elveron2?

[trashcan99]

Originally Posted by badmad21

cant find: HKEY_CURRENT_USER/SOFTWARE/R2HIK, cant find R2HIK

same here, maybe its named different on Win11 idk

[Freaky420]

Unfortunately I can't find any of the folders either :/

HKEY_CURRENT_USER/SOFTWARE/R2HIK

[Neellix]

Probably yall that could not find the folder locations are trying to copy paste it, the slashes ( \ ) are the opposite, so try to find the location by yourselfs by reading the location names and opening them manually, it did work for me tbh, ty for this!

[babacnebun]

on origins2 u know that works?