*HOT* My solution to Kill GameGuard

[mauiz]

FU************ YOU GAME GUARDDDDDD!!!!!!!

[Move_Wind]

and then u can launch the game without Nprotect and then u can use SRO bots. but it only last for 10 mins and then SRO will shut down. The only way to get that off is by... figuring out which .dat or any other kind of format sends to SRO_client to look for gameguard and if it isnt on shut down. then modify it and make it so it doesnt shut down SRO, thats only way we can.

whats this<---------------

[seller1]

Originally posted by jMerliN@Mar 8 2006, 05:54




Well I got the bot to load around gameguard ( yes that image is with gamegaurd running )...

But apparently it needs its client running because it can't "login" or whatever...

The autopotting doesn't work.. if I hit Insert/Home/End it gives me that "Bot Login Failure" error and disconnects me from the server. So I'm gonna need to figure out why the hack does that ( I need to unpack the actual hack and the silkbot loader ).

But the good news -- I can inject past gameguard.

i recommand u to try the chinese bot.
i believe theres a redirection in the english bot thats created for future pay to bot system.
they could have taken that redirection down and that could cause the bot to fail.

all just speculations though so please do not flame at me =))

[DamoniousB]

i dont know if you already thought about that. but how about adding the content of the silk.dll to another dll thats used by the client itself ?

[jMerliN]

Apparently the client itself ( silkbot ) interfaces with the .dll via the driver when it is loaded into SRO. The bot calls this action a 'login'.. and since my injecting silk.dll into the game successfully does not allow the dll and the client to establish said link, it cannot 'login' as it says. I'm working on my driver-based hooking interface but if anyone else wants to give it a shot, here's what I'd suggest trying:

Inject your own .dll file into the sro_client.exe when it is loaded ( hijack silkroad.exe.. or launch it yourself using CreateProcess.. look at the ASM to see what cases it fails under and make it work.. and inject a .dll into it which intercepts calls made to CreateProcess and when the call is made on sro_client.exe, simply create it in a suspended state then inject your dll into the suspended process and resume it ). Once your file is injected into sro_client, hijack control of CreateProcess and when the gamegaurd.des process is created, append the suspended flag to the creation flags and leave it suspended ( in the preliminary test ). Watch to see how long it takes silkbot to attach to the sro_client.exe application while it's naked and vulnerable. Recode the .dll which suspends gameguard to sleep for so many seconds as necessary for silkbot to attach and then just run silkroad.exe with your dll injected in it each time and you should have a working sro bot.

[2wire]

are you working of a program that help us do this, because i can follow some parts but some other parts i dont understand it

[DamoniousB]

i guess ill wait for the driver-basd hooking interface :P

**** i wish id be able to do somethin ^^

[jMerliN]

my driver driven hooking interface is a project i'm working on to bypass security tools to debug and/or extend functionality of software ( ie i could make a simple debugger plugin for it using an open-souce debugger similar to OllyDbg and debug games protected by nProtect or powerful packers like ASProtect ).. nothing to do with this game however, it will be used to make my 2D client and my server emulator

[Khyl]

Hmm... When do we can bot again ? Or what...

[crome]

I have a complete noob question:
GG provide some kind of protection of game, it does not allow third party software to interfere with game.
it has to be away around, it has to be a backdoor. I understand a normal macro cannot function. Is there another way
to make a macro functioning , in another programming language ?
I mean, not to make those macro to function, make a complete new macro who gg cannot block it.

[terryho]

why 5-10min auto shut down? why??"

[mx0]

Originally posted by terryho@Mar 9 2006, 15:38
why 5-10min auto shut down? why??"

LOL... try to read here first before posting ****

[jMerliN]

Since people have been asking me how to do what I said up there, here's some simple C++ talk on how to do it:

First download the detours package from microsoft ( google "microsoft detours" ). Include the detour header & C++ file accompanying that into your .dll project.

In the first .dll project, use the CreateProcess API ( google "msdn CreateProcess" ) to launch silkroad.exe ( the silkroad loader ) and make sure the CREATE_SUSPENDED flag is specified as a flag in the dwCreationFlags parameters. An example of this CreateProcess call would look like this:

PROCESS_INFORMATION pi;
ZeroMemory( pi, sizeof( PROCESS_INFORMATION ) );

if( FALSE == CreateProcessW( NULL, L"C:\\Program Files\\Silkroad\\silkroad.exe", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, NULL, &pi ) )
{
MessageBoxW( NULL, L"Unable to create the silkroad process.", L"Silkbot Error.", MB_OK );
return FALSE;
}

Next, since the process is created in a suspended state and not even the first byte has been executed and the PROCESS_INFORMATION structure has been filled with a handle to the process & the primary thread, you can proceed to inject the .dll you want into the suspended process and finally resume the process.

//Write the buffer/parameter to LoadLibraryW
wchar_t* LibraryFile = L"C:\\Program Files\\Silkroad\\Silkbot\\silkroadhijack.dll";

//First allocate the memory
void* DataPointer = VirtualAllocEx( pi.hProcess, NULL, MAX_PATH * sizeof( wchar_t ), MEM_COMMIT, PAGE_READWRITE );
if( DataPointer == NULL )
{
MessageBoxW( NULL, L"Unable to allocate memory in the target process. Closing process.", L"Silkbot Error.", MB_OK );
TerminateProcess( pi.hProcess, 0 );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
return FALSE;
}

//Next write the data in
DWORD Written = 0;
if( FALSE == WriteProcessMemory( pi.hProcess, DataPointer, (void*)LibraryFile, lstrlenW( LibraryFile ) * sizeof( wchar_t ), &Written ) || Written != ( lstrlenW( LibraryFile ) * sizeof( wchar_t ) ) )
{
MessageBoxW( NULL, L"Unable to write library file name into allocated memory. Closing process.", L"Silkbot Error.", MB_OK );
TerminateProcess( pi.hProcess, 0 );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
return FALSE;
}

//Next load the library
DWORD LibraryThreadId = 0;
HANDLE LibraryThread = CreateRemoteThread( pi.hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryW, DataPointer, 0, &LibraryThreadId );
if( LibraryThread == NULL )
{
MessageBoxW( NULL, L"Unable to create thread. Closing process.", L"Silkbot Error", MB_OK );
TerminateProcess( pi.hProcess, 0 );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
return FALSE;
}

//Wait for the thread to terminate so we can clean up
WaitForSingleObject( LibraryThread, INFINITE );

//Clean up
VirtualFreeEx( pi.hProcess, DataPointer, MAX_PATH * sizeof( wchar_t ), MEM_DECOMMIT );

//Close unneeded handles
CloseHandle( LibraryThread );
CloseHandle( pi.hProcess );

//Resume the process we created in a suspended state
ResumeThread( pi.hThread );

//Close handle
CloseHandle( pi.hThread );

=o.

A similar method ( use the detours to create a detour on CreateProcess ( i believe the loader will use CreateProcessA but you can detour both A and W ) then append the CREATE_SUSPENDED flag onto the attributes using the or ( |= ) operand ) can be used to keep the sro_client.exe process suspended until the user presses a certain key at which time the process will resume and load gameguard.

[Move_Wind]

dunt understand

[Khyl]

When its gonna work without crashing ?