elitepvpers - Cracking SV

elitepvpers (https://www.elitepvpers.com/forum/)

- CO2 Guides & Templates (https://www.elitepvpers.com/forum/co2-guides-templates/)

- - Cracking SV (https://www.elitepvpers.com/forum/co2-guides-templates/75858-cracking-sv.html)

(This post is just for your study purpose only. I don't know original of this file. Someone send it to me. Please use it as your own risk.

If you agree to use it for study purpose here is guide to crack SV. There so many versions SV but only new SV can work with patch 4347.

** If you successfully crack Script Vessel and want to using it work as CO2 business (Smooth and Safe) . I suggest you support 9net9 who is creator of SV by buy it from website. **

Strategy to crack this program is finding way to hook process to keyboard and bypass all protection and random timer checker. You can read how to crack from step 1-6 or jump to step 7 to make your own cracked bot.

Revised May 17,2007

1) Normally SV do it's self like read/write process memory. They hook up conquer process and check value then determine bot action like click,pick,move or jump.

When you activate bot it's will check your current window is conquer that match with bot version or not. If yes they will activate bot.

During bot activate they have timer that synchronize between SV.exe and bot client on each conquer window. So our solution is finding what they talk each other and prevent criteria check that make bot slow or not respond. The most way to trace is using IDA pro for reference and using Cheat Engine for debug software. This program encrypt with UPX 3.0 try download from [Only registered and activated users can see links. Click Here To Register...] to unpack them before analyze with IDA pro.

After expand countrymakeinus.dll and analyze with IDA pro. We must analyze 2 things on this DLL.

2) One thing is SV bot process. Normally it's start with some kind of command like this"

Quote:

PUSH EBP
MOV EBP,ESP
MOV EAX,FS:[00000000]
PUSH FF

Just searching from "Search>Find assembly code" to find address of above command.

3) Second, Push your hook tiny code to execute file. I push this code in main loop program

Quote:

004049FB:
PUSH EBP
PUSH EBX
PUSH ECX
PUSH EAX
PUSH EDX
PUSHFD
PUSH EAX
PUSH ESI
PUSH EDI
PUSH 00000000

Using Search>Find assembly code to find it again then you must using hook command in next step.

4) Hook command, Using function call to trap key stroke is SetWindowsHookExA it's locate in User32.dll. Here is command to hook up process.

Quote:

push 00000000
push 10000000
push 100039d0* * //* address first command from step 2
push 02
call SetWindowsHookExA

5) Now it's time to inject code with current SV bot. It's same as SV inject conquer.exe, we using cheat engine to make enable/disable and inject together. Press CTRL,A at memory view window in cheat engine then click Template>Cheat Table framework code at address you will inject in step3. You will got some kind like below. For example, I using return process at address 004049FB and inject to new memory address to run hook process.

Quote:

[ENABLE]
//code from here to [DISABLE] will be used to enable the cheat

alloc(newmem,2048) //2kb should be enough
label(Loop)
label(exit)

004049FB:
jmp newmem

newmem: //this is allocated memory, you have read,write,execute access
//place your code here
cmp [10044004],ff
je exit
mov [10044000],00
pushad
pushfd
push 00000000
push 10000000
push 100039d0
push 02
call SetWindowsHookExA
mov [10044004],ff
popfd
popad

exit:
push ebp
push ebx
push ecx
push eax
push edx
pushfd
push eax
push esi
push edi

jmp 00404A04

[DISABLE]
//code from here till the end of the code will be used to disable the cheat
004049FB:
push ebp
push ebx
push ecx
push eax
push edx
pushfd
push eax
push esi
push edi

6) Last part is finding protection and place to push obcode,
SV will disable all hook event by call UnhookWindowsHookEx, So just disable unhook process by set this in enable process,

Quote:

UnhookWindowsHookEx:
ret 0004

Insert protection check that you will not activate hook process again and again by checking memory address like below,

Quote:

[ENABLE]
cmp [10044004],ff** // is bot is already activate or not?
je exit* * * * * * * * * * * // Yes jump exit
mov [10044000],00 // No set variable wait state to Loop
pushad* * * * * * * * * * // Save all register
pushfd* * * * * * * * * ** // Save flag register

// ** Put Hooking process here

mov [10044004],ff* // Set bot already activate
Loop:* * * * * * * * * * * // Loop until uncheck to disable by checking variable
mov eax,000000ff
push eax
call SleepEx
push eax
cmp [10044000],90 // Check variable is Loop or not Loop
jne Loop
popfd* * * * * * * * * * ** // return all register
popad* * * * * * * * * * * // return flag
exit:

// ** Code from original code

[DISABLE]
10044000:* * * * * * * // Set variable to not Loop
nop

UnhookWindowsHookEx:
ret 0004* * * * * * * ** // Prevent unhook process

There is routine to call internet open socket. So i find place that open internet connection and replace with code from newmem.

Quote:

004275C1:
..
..
Call InternetOpenA
..
ret

7) Here is instruction to make standalone version,

Quote:

1) Start 1.10 and Cheat Engine.
here is infomation link for SV 1.10
[Only registered and activated users can see links. Click Here To Register...]
2) Load CheatEngine with cheatengine script then select ScriptVessel process and check box on SV 1.08-1.10
3) Start Conquer program and login normally and press F11 to activate bot.

Stand Alone version of SV with CheatEngine (No internet connection)
1) Load SV V1.10
2) Check box at SV V1.08-1.10 then exit Cheat Engine.
3) Start conquer and press F11 to activate bot.

DIY hexedit Scriptvessel (No need CheatEngine)
1) Open Hexedit and goto offset $49FB (by press Ctrl ,G and insert at hexadecimal box) then replace existing value XX XX XX ... with code E9 C1 2B 02 00
2) goto offset $275C1 (by press Ctrl + G and insert at hexadecimal box) then replace existing value XX XX XX ... with BOLD value code below.

Quote:

81 3D 04 40 04 10 FF 00 00 00* * CMP [10044004],000000FF
74 25* * * * * * * * * * * * * * * * * * * * * * JE 004275F2
60* * * * * * * * * * * * * * * * * * * * * * * ** PUSHAD
9C* * * * * * * * * * * * * * * * * * * * * * * ** PUSHFD
68 00 00 00 00** * * * * * * * * * * * * * PUSH 00000000
68 00 00 00 10* * * * * * * * * * * * * ** PUSH 10000000
68 D0 39 00 10* * * * * * * * * * * * * ** PUSH 100039D0
6A 02* * * * * * * * * * * * * * * * * * * * * * PUSH 02
FF 15 64 E4 42 00* * * * * * * * * * * * CALL DWORD PTR [0042E464]
C7 05 04 40 04 10 FF 00 00 00* * MOV [10044004],000000FF
9D* * * * * * * * * * * * * * * * * * * * * * * ** POPFD
61* * * * * * * * * * * * * * * * * * * * * * * ** POPAD
55* * * * * * * * * * * * * * * * * * * * * * * ** PUSH EBP
53* * * * * * * * * * * * * * * * * * * * * * * ** PUSH EBX
51* * * * * * * * * * * * * * * * * * * * * * * ** PUSH ECX
50* * * * * * * * * * * * * * * * * * * * * * * ** PUSH EAX
52* * * * * * * * * * * * * * * * * * * * * * * ** PUSH EDX
9C* * * * * * * * * * * * * * * * * * * * * * * ** PUSHFD
50* * * * * * * * * * * * * * * * * * * * * * * ** PUSH EAX
56* * * * * * * * * * * * * * * * * * * * * * * ** PUSH ESI
57* * * * * * * * * * * * * * * * * * * * * * * ** PUSH EDI
E9 04 D4 FD FF* * * * * * * * * * * * * ** JMP 00404A04

3) Save then start program

How-to find obcode (from code above) and hexedit SV V1.10 (1.6 MB)
[Only registered and activated users can see links. Click Here To Register...]
or
[Only registered and activated users can see links. Click Here To Register...]

There is bug in orig SV that let you waste pot by using MP Pot.

Here is How to fix bug toaist alway using MP pot(Edit your conquer.exe) for SV 1.10

1) Open unpack Conquer.exe with Hex Editor. Check size of conquer.exe should more than 1 MB. If not goto step 4 to unpack it.
2) Goto offset 7AEC4 replace existing XX XX XX XX XX XX with E9 0A 65 01 00 90.
3) Goto offset 913D3 replace existing XX XX XX XX XX XX XX XX XX XX XX XX XX XX with FF 92 80 00 00 00 8B C8 E9 EA 9A FE FF.
4) Download UPX.exe from [Only registered and activated users can see links. Click Here To Register...] then unpack your conquer.exe with this command "UPX -d conquer.exe" *Don't miss to backup file*

Or try load this script to fix bug toaist alway using MP pot

1) Run cracked Scriptvessel, CheatEngine and Conquer.exe then Load below script then select conquer process.

[Only registered and activated users can see links. Click Here To Register...]

2) Check box "Fix SV 1.10 for MP bug"
3) Play conquer and activate bot as normally

*New* Stand alone SV 1.11 add Follower can jump and fix MP bug
1) Open SV with hexeditor (XVI32) then press Ctrl + G goto Hexadecimal offset $2596D replace existing 5 bytes with E9 CF 1B 00 00

2) then Press Ctrl + G goto Hexadecimal offset $27541 replace 48 bytes with 60 9C 68 00 00 00 00 68 00 00 00 10 68 D0 39 00 10 6A 02 E8 78 9C 00 7E 9D 61 85 C0 0F 84 49 E4 FF FF 85 FF 0F 84 18 E4 FF FF E9 05 E4 FF FF 90

3) Save file then start SV and don't press anything. Goto game and press F11 to activate bot.
Enjoy!

my cracked SV still works

Quote:

Originally posted by (GAME)Master@Feb 24 2007, 18:12
my cracked SV still works

Yes, Old SV is still work. But new one had new function and more protection. Just try for experience.

I just wish you good luck on your new quest to conquer. :)

wht new function has 4339 version of sv?

why does _countrymakeinUS.dll have

Dr.Web
Found Trojan.PWS.Lenmir.30

i might just be a nub though and missed something befor said o.o

its safe to use the older working version ?

The New Script Vessel 4339 is a piece of isht anastasia, you shouldn't waste your time trying to crack the 4339 for sure I would wait for the next release and try for that one, 4339 crashes regardless of whether post mortem debugger is disabled and regardless of whether you changed your explorer shells.

Also certain people with ATI get VPU errors because of it.

But what youre doing is good and +k for your hard work.

i got botjailed >< rofl

@EvolutionHK:
I found this after stripper. If you not sure try other expander to uncompress countrymakeinus.dll.

@thechaoshydra:
Old SV still working. I just get new one and train my experience to crack it.

@angelbear:
Thx for your suggestion. Just for learning by cracking. I'm sure that it's just improve little on bot.

Finally I crack it.
There is new screen and new function that useful.

Picture of SV V1.10 for patch 4347

that new function rocks! can u pls tell me how to make it work?

<hr>Append on Feb 26 2007, 14:09<hr> im trying to follow your steps but i dont understand wht u mean with unhook...
and those first 4 steps set window hooked.... i do nothing? thats just info?

<hr>Append on Feb 26 2007, 14:33<hr> ill ask once more and tell wht im doing wrong thank u in advice

so these are your steps:
this 4 steps i didnt do anything... thats just getting pass and id if im right
/*
10003664 call dword ptr [10033390] <- set hook window
10003707 call dword ptr [10033178]
100038b5 call dword ptr [100333a0] <- get window text
100038dd call dword ptr [100333a0] <- get window text
*/

here i changed to that jump but thats 2bit operation so 6 bits left i changed with 90
0040F310 <-BP and JMP 40F31E

same
0040F34D <-BP and JMP 40F360

here i just changed
0040F489 call 4144DE

here i didnt do anything it was there written just this way
004144DE jmp dword ptr 100035b0

nop 90
100035B0 <-BP

jmp and nop
100037D4 <-BP and JMP 100037DF

this one i dont understand... u mean put there nop?
100037DD call esi <- Unhook *avoid*

jmp and nop
1000383B <- BP and JMP 10003846

this i dunno also... u mean nop to all call esi? cause there is like alot call esi
1000XXXX call esi <- Unhook *avoid*

im not great at assembly codes but i understand it a little... so if u could help me i would be very thankfull :)

Quote:

Originally posted by Lake292@Feb 26 2007, 19:33
that new function rocks! can u pls tell me how to make it work?

<hr>Append on Feb 26 2007, 14:09<hr> im trying to follow your steps but i dont understand wht u mean with unhook...
and those first 4 steps set window hooked.... i do nothing? thats just info?

<hr>Append on Feb 26 2007, 14:33<hr> ill ask once more and tell wht im doing wrong thank u in advice

so these are your steps:
this 4 steps i didnt do anything... thats just getting pass and id if im right
/*
10003664 call dword ptr [10033390] <- set hook window
10003707 call dword ptr [10033178]
100038b5 call dword ptr [100333a0] <- get window text
100038dd call dword ptr [100333a0] <- get window text
*/

here i changed to that jump but thats 2bit operation so 6 bits left i changed with 90
0040F310 <-BP and JMP 40F31E

same
0040F34D <-BP and JMP 40F360

here i just changed
0040F489 call 4144DE

here i didnt do anything it was there written just this way
004144DE jmp dword ptr 100035b0

nop 90
100035B0 <-BP

jmp and nop
100037D4 <-BP and JMP 100037DF

this one i dont understand... u mean put there nop?
100037DD call esi <- Unhook *avoid*

jmp and nop
1000383B <- BP and JMP 10003846

this i dunno also... u mean nop to all call esi? cause there is like alot call esi
1000XXXX call esi <- Unhook *avoid*

im not great at assembly codes but i understand it a little... so if u could help me i would be very thankfull :)

** This dll still infected with Trojan.PWS.Lenmir.30 please use as your own risk **

/*
10003664 call dword ptr [10033390] <- set hook window
10003707 call dword ptr [10033178]
100038b5 call dword ptr [100333a0] <- get window text
100038dd call dword ptr [100333a0] <- get window text
*/
Above is address that call function in user32.dll. It's just info for reference

here i changed to that jump but thats 2bit operation so 6 bits left i changed with 90
0040F310 <-BP and JMP 40F31E

I'm not sure what command on this but u can change it to JMP 40F31E (2 obcode)

same
0040F34D <-BP and JMP 40F360

here i just changed
0040F489 call 4144DE
No change here just info to set break point and trace to 4144DE

here i didnt do anything it was there written just this way
004144DE jmp dword ptr 100035b0

nop 90
100035B0 <-BP

jmp and nop
100037D4 <-BP and JMP 100037DF

this one i dont understand... u mean put there nop?
100037DD call esi <- Unhook *avoid*

If u jump from above command it's will jump above 100037DD. Just for your info that why i jump this instruction code.

jmp and nop
1000383B <- BP and JMP 10003846

this i dunno also... u mean nop to all call esi? cause there is like alot call esi
1000XXXX call esi <- Unhook *avoid*

Same as above it's only change 2 jmp on countrymakeinus.dll

If u read and understand 1-6 in first post. I think u can know what i say.

i understand wht u mean... i do it way like u said and i dunno why it but when press start it just crashes SV i think ill rather wait for some guide :)

New function in gamble.

Put your bet in box number 3 just like
4-17 , 111,222,333,444,555,666 , Big , Small

it's will automate bet 3 of your coin selection.

is this trick working to anyone? or didnt try?

This SV version contain virus Trojan PWS (password stealer). Sorry I can't distribute this file or suggestion how to crack it until find way to get rid of it.

<hr>Append on Feb 27 2007, 11:02<hr> After try kill virus with DrWeb. It's can't clean infect file only delete.

After download new chinese SV version from [Only registered and activated users can see links. Click Here To Register...] date Feb 23,2007

Try unpack and scan it's still infect with Trojan.PWS.Lenmir.30.

That mean original file from 9net9 had infect with this trojan.

If anyone wanna try it. Please PM me i will send link to download to try crack your self.

I have uploaded the latest english release. Jotti doesnt return anything but you guys can double check.

[Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally posted by Botter2daMax@Feb 27 2007, 23:07
I have uploaded the latest english release. Jotti doesnt return anything but you guys can double check.

[Only registered and activated users can see links. Click Here To Register...]

It's seem properly if u didn't unpack it.

If you unpack it with stripper on both file scriptevessel.exe and countrymakeinus.dll

After scan with virustotal u will got trojan virus.

Older version didn't contain any virus.

Quote:

Originally posted by (GAME)Master@Feb 24 2007, 12:12
my cracked SV still works

same >.>

it works but its missing new functions

well mine SV dont work and ive cracked it on the right way
i dont know whats happend but someone help me !

well try it on other computer... that sometimes helps and if not u did somethin wrong :rolleyes:
try to follow this guide [Only registered and activated users can see links. Click Here To Register...]

hey ppl ... what is the ScriptVesel ID and password ?

Quote:

Originally posted by Smoky@Feb 28 2007, 02:10
hey ppl ... what is the ScriptVesel ID and password ?

omg thats lame question... when u dont know whts id and pass go and buy it they will tell u...

nice, but just for your info (all of u), theres a new bot 100x better than sv :D

oh, i am outdated. Which one would be better?

Quote:

Originally posted by Peach@Feb 28 2007, 09:31
nice, but just for your info (all of u), theres a new bot 100x better than sv :D

Yes, No bot is perfect as play by your self.

Sometime i used macro to play instead of using SV.

LoL nothing to 100% perfect.

As I said at starting thread. I try for my experience.

I need help i cracked SV on like all the ways i could find that has been posted.... but my trainer still wont work..
it workd perfectly fine before.. but i had to reinstall everything on my computer.. and now when i cracked SV again the trainer suddenly wont work.. Someone Please help me!!!
add me on msn if u can help me...
[Only registered and activated users can see links. Click Here To Register...]

Quote:

Originally posted by anantasia+Feb 28 2007, 15:26--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (anantasia @ Feb 28 2007, 15:26)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin--Peach@Feb 28 2007, 09:31
nice, but just for your info (all of u), theres a new bot 100x better than sv :D

Yes, No bot is perfect as play by your self.

Sometime i used macro to play instead of using SV.

LoL nothing to 100% perfect.

As I said at starting thread. I try for my experience. [/b][/quote]
im not saying about play urself -.- im saying theres a bot out there 100x better than sv

anantasia could u add me and help me cause i dont know what the problem is... it used to work for me......

Quote:

Originally posted by fedja1337@Feb 28 2007, 18:50
I need help i cracked SV on like all the ways i could find that has been posted....* but my trainer still wont work..
it workd perfectly fine before.. but i had to reinstall everything on my computer.. and now when i cracked SV again the trainer suddenly wont work.. Someone Please help me!!!
add me on msn if u can help me...
[Only registered and activated users can see links. Click Here To Register...]

May i ask you some question?

1) Did you follow on guide in step 7 on starting thread?

2) If yes, What file you using with CE and make trainer?
There a link on start thread for about SV 4339. Please follow link to download it. (If you have problem on download pls let me know.)

3) What kind of message or error when u try run trainer?
In this trainer guide u will not get message "press F11 or * to start bot" but u can running bot properly.

I suggest you try redownload and crack by follow cucurucho DIY thread to make sure that old one still working. Due to new version and untest you must try this version as your own risk.

Quote:

Originally posted by Peach@Feb 28 2007, 03:31
nice, but just for your info (all of u), theres a new bot 100x better than sv :D

Why its better than SV? whats the difference?

Quote:

Originally posted by Peach+Feb 28 2007, 13:38--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (Peach @ Feb 28 2007, 13:38)</td></tr><tr><td id='QUOTE'>

Quote:

Originally posted by -anantasia@Feb 28 2007, 15:26
<!--QuoteBegin--Peach

Quote:

@Feb 28 2007, 09:31
nice, but just for your info (all of u), theres a new bot 100x better than sv :D

Yes, No bot is perfect as play by your self.

Sometime i used macro to play instead of using SV.

LoL nothing to 100% perfect.

As I said at starting thread. I try for my experience.

im not saying about play urself -.- im saying theres a bot out there 100x better than sv [/b][/quote]
What is the name of the bot you talk of?

Hi , Anatasia can you just post the cracked files + the trainer ...
i'm pretty messy with this and it aint working for me :(

can u just post the worked files in one winrar file or something

thanks alot :)

ill give u +k ^^ ;d

Quote:

Originally posted by Childish@Feb 28 2007, 20:33
Hi , Anatasia can you just post the cracked files + the trainer ...
i'm pretty messy with this and it aint working for me :(

can u just post the worked files in one winrar file or something

thanks alot :)

ill give u +k ^^ ;d

i would apreciate that too... tried it few times but no success :( and i dont that mind that virus in...

Quote:

Originally posted by Lake292+Mar 1 2007, 02:49--></span><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (Lake292 @ Mar 1 2007, 02:49)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin--Childish@Feb 28 2007, 20:33
Hi , Anatasia can you just post the cracked files + the trainer ...
i'm pretty messy with this and it aint working for me :(

can u just post the worked files in one winrar file or something

thanks alot :)

ill give u +k ^^ ;d

i would apreciate that too... tried it few times but no success :( and i dont that mind that virus in... [/b][/quote]
After you work along the guide. You can't see message "Returns to Game and press Key F11 or * to start the Parner!" but your Save ID and Edit Password is gray and can't click that mean you crack it succesfully.

Try Run Conquer and press F11 to activate SV panel.

Hope you gét it.