Recently purchased it but not sure how to get into contact with Plox to acquire it. Any tips?

gotta add him on skype and talk to him and give him conmfirmation of your donation

How quickly does he respond to the add on skype? I donated about 30-40 minutes ago still no response on skype. I realize hes probably super busy today so not angry or anything.

Everyone who is bombing me with messages an asking an requests, please be patient, I'am trying to work & answer people & work a real job at the same time.

There is a temporary solution uploaded now for those who have access, use it & let me know - I've been ingame now with that bit for over 4 hours now an not an issue.

No bans as of yet.

Also I don't see how the uninstall isn't working considering it is the original files from the update?

Just sent payment. awaiting contact.

add me too plox ;)

I've been getting gods have disconnected, you for over 5 hours until I uninstalled the mod. Now it works no problem at all. So the game is detected some part of your mod just not sure which part.

same - was getting disconnected by the gods popup fairly frequently before I uninstalled the mod today. Hadn't updated for awhile though, I'll try the latest update and see if I still have an issue.

well which features are available with the lastest version?

Ah and does the 1 click housing still work with the version where you get disconnected every few minutes?

How does one un-install this in its entirety? When I use the un-install it removes a lot of the features, but some things stay in, particularly the background images.

What's in it now is what is currently working, will piece it back together over the weekend.

You realize I'am by myself doing this, so please - be patient :(

Always before installing mods, make a backup of your archeage folder, simply paste over your backed up files, that has been the only way I've found to fully remove all mods.

I can't get back in

I did everything I could to remove any trace, I don't have a backup

I would normally agree, except in this case I did do this, I have a backup of the entire game on another drive. I even reinstalled from scratch, I continue to have some of the changes in the game.

They were literally talking about this 2 pages prior. Please read before posting. Seems to be the alb files that theyre specifically looking for.

For everyone else, just uninstall until further notices. Even though newest version seems to be okay.

Well, I'm not sure what exactly does and doesn't uninstall. After running the uninstall.bat, I noticed some small things still left in the game(server select and loading screen backgrounds, the little icon in the bottom right corner of the screen, anything else could be unnoticed because it's not an UI change that is apparent. But that's really it and unsure as to why it doesn't work fully. Lol

I always just copy my game_pak and override the modded one.

I got disconnected after like 2 hours of gameplay, jumped back in, so far not running into many issues.

What exactly is your point? I was sharing what was going on with me too so people know its not only them. If you don't like the post don't read it.

@Ploxasarus:

What makes you think that its not a CRC check but a simple compression check? (Actually its not compression, the original files are compiled Lua code where previous hacks were uncompiled lua code)

Since I thought that AA was just checking if the lua scripts were compiled or plain, i decided to make the changes(mod) to lua files and recompile them. There is no problem with that. But still AA detects that they are modified and disconnects me...

So, its obviously not a compression/compile check but something slightly more advanced...

I would love your feedback...

EDIT: I did a simple test, changing 1 byte in common.alb causes instant DC after login (FYI the changed byte is a debug info in the compiled lua file about the starting line of that function in the source code, so it doesnt cause any problems or errors, but still AA detects that the file is modified)

Any way to overcome a CRC check?

You can spoof CRC. I'll test it when I get home. Still have a CRC spoofer/fixer from my mat hacks days.

Mod doesn't work at all, disconnects on login.

Well, the cvars work but they aren't CRC checked.

Donated and Sent a email, thanks a12s24d55f6

I was about to argue with you, but instead I will apologise, I thought you were responding to my post about uninstalling. I thought it was a backhanded comment aimed at me, and it is apparent to me now that you were not even talking to me. Sorry.

This. Exactly this. I have been trying to uninstall so that I can do some recording for a friend, and that symbol remains in the bottom right. and I don't know how to remove it. (I have tried replacing the game_pak with the one I saved on another drive)

Could this game_pak have been edited as well considering it was also inside an archeage folder which was in an archeage folder?

See [Only registered and activated users can see links. Click Here To Register...] (to remove the bottom right patron symbol)

Plox has already stated that anything outside the scriptsbin folder is not checked by the game.

still awaiting response :)...

try sending a PM if skype or email havent worked for you. At the moment the mod is mostly down until he finishes a workaround for the new patch. Just have to be patient as its just him working on this. He's pretty good about responding to ppl but he's getting bombarded due to the patch and this is just one of those things where you wont receive instant customer support.

It has nothing to do with a CRC, it is specific file checks within the scriptsbin.

The loginstage skip and some others do not cause any over-time dc while others are checked. It has to do with the file compression true/false an it being checked in the client end ( hackshield isnt the problem ).

I'm trying to match the compression and build but thats like a shot in the dark on some things.

I'll respond to whom I can when I can, worse case I'll just take some time making a client from the ground up since you can sandbox everything with the cryengine sandbox.

It just delays progress, is all, but anything out of x2ui is fine, the options folder is fine, aswell. I do know that hackshield is super sensitive, I've been dc'd even just looking on the forums since it is checking more process title names now.

Thanks for the update dude. For now I'm good without the x2ui folder, just let us know when it works again :D The only thing I even miss is the instant arena queue lol

I dont mean its CRC checking game_pak, what i mean is its CRC checking certain files like auction/common.alb since even a single byte change in it causes disconnect.

As for compression I do not understand what you mean, there is no compression. The ALB files in scriptsbin are COMPILED LUA BYTECODE. Normally you can replace them with uncompiled code like you did and LUA automatically compiles them while loading.

First, I thought they were just checking if the loaded script is compiled or not and flagging hack if its not compiled bytecode. But this isnt the case since even when you replace them with modified compiled lua code it still fails. So they must be CRC checking certain script files in game_pak.

EDIT: I wonder where it keeps the CRCs for the files it checks, probably in "db/compact.sqlite3" but standard viewrs dont display its contents. Can anyone check inside it to see if it has a table with CRCs of certain files it checks?

They are compiled obfuscated lua, which is what I was meaning by the compression. They could also check the file on load against they're own version on the server end which would explain the long downtime an look at the lua package an see its been modified in length, check an notice excessive --'s or else wise.

I updated the pack with what is functional an has not dc'd me overnite, not much but meh, we're working on this ( me an a friend ) an should have something done in time. I can say again though bypassing hackshield, is irrelevant.. I can bypass it and run CE/Olly/IDA an not have a single hiccup, but the internal scanning an where it is, which i think is in the 2xgame.dll, is the problem. Anybody feel like unpacking themida? ;)

Hi Plox, is the current one updated after the new patch?

They are compiled but not obfuscated. They use luac5.1 to compile them but their luac is a modified one using 4 bytes for LUA_NUMBER instead of default 8 BYTES.

I can uncompile change code and recompile them with no problems. The compiled ALB files also have debug information in them like which function is at what line in the original source file etc, which are irrelevant to script's execution. When i change 1 byte in compiled code, like the debug information of a function from lines 8-11 to lines 7-11 which has no effect on script execution and would not cause any errors in lua, they still can detect that the compiled code is changed. So I assume they either compare it with their own version like you said or they have CRC values for each ALB file and client checks the CRC to validate they are not modified.

Its kinda overkill to compare whole file with their own version at server side. So its more likely that they have the CRC values for each ALB file stored somewhere (probably in db/compact.sqlite3) and they check it client side...

Still DCed
 

Just a heads up. using the new update and still got a DC. after about an hour of game play. Just a user update.

Plox if you could please provide update/patch notes on your main post that would be very helpful. Seeing as you now have over 55 pages of comments it gets hard to track down your posts

Regardless of a compression check, or a CRC, the easiest thing to do would be to eliminate the problem. Since he is able to bypass HS and use an assembly analyzer (Olly, CE, etc), I'm pretty sure he could step through the loading process until it catches the function that kicks you. Buttttt, doing just that is probably a pain in the ass. But you know what? Be happy this is something that can be literally NOP'd on the client-side of things.

I'm sort of wondering if Trion has AA utilize Hackshield to the point of detecting memory modifications done directly to the libraries initialized. While I could very well check, I'm assuming Plox has checked this himself. o:

At the moment, HS looks like plain ol' wrapper for this game.

-----------------

On a side note, it might be in someone's best interest to go find the switch which enables folder data load -- I mean who enjoys packing this shit? It'd make on-the-fly tests easier too. I won't ask for it though, I'm just a player! :)

click on his username, find posts by this user

There is, actually, a few obfuscated ones in it that I was playing with an might be something they plan to do with the rest. The chat_msg_event aswell, is strange.. You might want to look at that one..

I can see in the x2game.dll where the checking is done, as I said it was probally there, the problem is there is an additional check somewhere else that I cannot seem to find. I can make the auctionhouse functional, have about a 45min grace period, but then after that something is catching else were. It is progress, though, considering modifying anything in auction house is usually an insta kick.


Wrapper an process/driver check/rotating memory check, not shit else an nothing to do with the files. You can see the check like i said in x2game.dll, just look for it, its in plain view.

Oh an also the only reason it checks for memory modifications is cause you can jump into the process before the wrapper an edit as needed so that is why it checks after the fact.

P.S.: It only checks the x2ui folder an any contents inside, anything outside of it, it doesn't care. It seems like on the major lua check on initiate world it does the most obvious, ah/housing/arena, then does the other shit since it isnt as important an game changing.

if you can make the auction house functional with a 45 min grace period, i would be happy with that... can you upload the mod pack with this temporary "fix"?

chat_msg_event perfectly decompiles (to lua assembly at least, didnt try unluac.jar) meaning its valid file format without any obfuscations.

btw gratz on finding the source of the check =)

EDIT: There is one anomaly in chat_msg_event though:
usually main block has 1 entry for each file_scope constant plus 1 for each function name, but in that file there is less constants than the number of functions meaning some function names are not in the list somehow, so a decompiler may not function well if it assumes the function names must exist in constants table...