[Momentum] Arcade Clear Script

[emre186]

crash (Game instance failed) (EAC-3)

[Micracoli]

outdate

[emre186]

Micracoli ???

i had to inject your dorq on CE with my bypass [Momentum] BE but don't work

its ok i have inject the dll on s4 client and i have no message but the game crash ...

[schleicher00]

Originally Posted by emre186

Micracoli ???

i had to inject your dorq on CE with my bypass [Momentum] BE but don't work

its ok i have inject the dll on s4 client and i have no message but the game crash ...

this shiet is outdated (doesnt work) and s4 doesnt even use be anymore the switched to eac

[emre186]

so a bypass work donsn't exist now ?

[schleicher00]

Originally Posted by emre186

so a bypass work donsn't exist now ?

no there is no public bypass

[Micracoli]

lol there is a easy why to bypass s4 but ok

[emre186]

its easy for you not me

[remtomcam]

crash (Game instance failed) (EAC-3)


not work

[osama.yones.oy]

play this game without any hacks and you will be happy

[TheBloodyReturn]

Originally Posted by SilverEmerald

Nothing special but still.. S4 devs could never put a decent security system into this since 10 years. (Check if user killed enough amount of mobs. [Score_Kill_Req] If did, it can clearstage. if not, do something against it. simple huh) *****

That's why this forum is almost dead, bc doesnt have a good security xD

[Tabino]

Originally Posted by TheBloodyReturn

That's why this forum is almost dead, bc doesnt have a good security xD

its dead because nobody would bother releasing an actual EAC bypass to some random leechers, smh

[kingbro123]

Originally Posted by RingleRangleRob

Praise the god RingleRangleRob, son!

You need to install Cheat Engine!
Where can i get it?

[Tutorial]

Hint: You can remove the "BE Service Disconnect" messagebox by pressing escape (ESC)

- Start Bypass.exe
- Start S4League
- Start Cheat Engine, attach Cheat Engine to S4Client.exe and open the *.ct file
- Check the "Arcade Clear Script!"
- Create an arcade room
- Select a stage and start the match
- Wait one minute and it will end automatically

Important

To deactivate the script use the address below the script and change the value to 1
after this you can uncheck the script

If S4League starts with Battleye close the process and start the Bypass.exe at the login window (S4EuLogin.exe)



[Script]

[ENABLE]
Alloc(Thread,512)
GlobalAlloc(StopScript,4)

label(continue)

CreateThread(Thread)

StopScript:
dd 0

S4Client.exe+2D6448:            // Disable the Mob Creation
db EB

Thread:
push #10
call Kernel32.Sleep             // Sleep(10);

cmp [StopScript],00
je continue
mov [continue],00
ret

continue:
mov ebx,[S4Client.exe+1749338] // CGameManager
mov eax,[ebx+B8]               // CGameManager->CClientRoomAgent
cmp [eax+5C],00                // The user isnt in a room!
je Thread

mov eax,[eax+5C]               // CGameManager->CClientRoomAgent->CClientRoom
cmp [eax+0C],07                // Is the room a arcade room?
jne Thread

mov eax,[ebx+138]              // MultiPlay::Mode (look in reclass for more informations ;))
cmp eax,00
je Thread

mov eax,[eax+0C]               // MultiPlay::Mode->MultiPlay::ModeState (CArcadeCV_Wait for example)
cmp eax, 00
je Thread

cmp [eax+08],02                // Is roomstate equal ingame/gameplay?
jne Thread

cmp [eax+24], #60000           // MultiPlay::Mode->MultiPlay::ModeState->Playtime < 1 minute
jb Thread                      // If playertime below 60000 milliseconds (60 seonds -> 1 minute)

call S4Client.exe+2D8C40       // Get the instance of
                               // CArcadeSystem::CSceneController::CScriptHostController
mov ecx,eax
call S4Client.exe+2EECC0       // Send Acarde_StageClear_Req in any subfunction
jmp Thread

[DISABLE]
Dealloc(StopScript)
Dealloc(Thread)

S4Client.exe+2D6448:           // Enable the Mob Creation
db 74

[Pseudocode]

auto stopScript = 0;

while(stopScript == 0)
{
    Sleep(10);

    if (CGameManager->ClientRoomAgent->CClientRoom)
        if (CGameManager->ClientRoomAgent->CClientRoom->ModeId == 7)
            if (CGameManager->Mode)
                if (CGameManager->Mode->State)
                    if (CGameManager->Mode->State->Id == 2)
                        if (CGameManager->Mode->State->Timer >= 60000)
                            ArcadeSystem->SceneController->ScriptHostController->ClearStage();
}

You can make it much cleaner by using:
- Functions
- Variables types like bool (true/false)
- continue keyword
...

but i just want to show you one option how it could work!

[Extension]

Instead of using CGameManager->ClientRoomAgent->CClientRoom you can use CGameManager->Mode->State->ModeCryption (State+0x34)

struct s_ModeCryption
{
    uint8_t value_00;
    uint8_t value_01;
    uint8_t value_02;
};

uint8_t modeId = CGameManager->Mode->State->ModeCryption.value_00 ^ CGameManager->Mode->State->ModeCryption.value_02;

in ASM it will be

mov ecx,[S4Client.exe+1749338] // CGameManager
mov ecx,[eax+138]              // MultiPlay::Mode
add ecx,34                     // MultiPlay::Mode->s_ModeCryption
movzx eax,byte ptr [ecx]
movzx ebx,byte ptr [ecx+02]
xor eax,ebx                    // The Mode Id is now in al

[Virustotal]



[Credits]
Momentum: ,

[Note]
When someone make a video tutorial i will link it here
forgot to comment we access on MultiPlay::Mode by CGameManager

cya soon my fans

[Kelboas]

Currently, doesnt work.

[Alize_]

Originally Posted by Kelboas

Currently, doesnt work.

A serious case of Sherlock Holmes-itis...