Lol.
I was having lots of fun exploiting the execute order of gameguard.
As I stated in my other thread, I had unbelievable success injecting a hack into the game by simply freezing gameguard.. but since the main game process waits for the gameguard.des ( the actual gameguard loader ), it must resume or the game will hang there and terminating the process will make the process cry.
Well I decided to exploit this and dump out the gameguard code from the actual sro_client, where it actually loads the gameguard loader and checks to see if anything bad happened. I'll post the unpacked sro_client.exe and the code showing where gameguard gets loaded & checked after I finish messing with it.
So much fun fucking up gameguard ^^.
Any of these errors look familiar guys? =D
Code:
00564150 E8 EB3E2A00 CALL sro_clie.00808040
00564155 3D 55070000 CMP EAX,755
0056415A 0F84 BD000000 JE sro_clie.0056421D
00564160 83F8 7C CMP EAX,7C
00564163 56 PUSH ESI
00564164 77 35 JA SHORT sro_clie.0056419B
00564166 74 50 JE SHORT sro_clie.005641B8
00564168 8D48 92 LEA ECX,DWORD PTR DS:[EAX-6E]
0056416B 83F9 0A CMP ECX,0A
0056416E 77 79 JA SHORT sro_clie.005641E9
00564170 33D2 XOR EDX,EDX
00564172 8A91 3C425600 MOV DL,BYTE PTR DS:[ECX+56423C]
00564178 FF2495 24425600 JMP DWORD PTR DS:[EDX*4+564224]
0056417F BE 48C49100 MOV ESI,sro_clie.0091C448 ; ASCII "GameGuard is already running. Try rebooting first and executing the game again."
00564184 EB 68 JMP SHORT sro_clie.005641EE
00564186 BE D8C39100 MOV ESI,sro_clie.0091C3D8 ; ASCII "There are multiple events of game execution or GameGuard is already running. Close the game then try again."
0056418B EB 61 JMP SHORT sro_clie.005641EE
0056418D BE 58C39100 MOV ESI,sro_clie.0091C358 ; ASCII "GameGuard initialization error. Try rebooting and executing the game or close the program considered to cause a collision."
00564192 EB 5A JMP SHORT sro_clie.005641EE
00564194 BE E8C29100 MOV ESI,sro_clie.0091C2E8 ; ASCII "Failed to load virus and hacking tool scanning module. Possibly due to lack of memory or virus infection"
00564199 EB 53 JMP SHORT sro_clie.005641EE
0056419B 8D88 6AFFFFFF LEA ECX,DWORD PTR DS:[EAX-96]
005641A1 81F9 E6000000 CMP ECX,0E6
005641A7 77 40 JA SHORT sro_clie.005641E9
005641A9 33D2 XOR EDX,EDX
005641AB 8A91 68425600 MOV DL,BYTE PTR DS:[ECX+564268]
005641B1 FF2495 48425600 JMP DWORD PTR DS:[EDX*4+564248]
005641B8 BE 90C29100 MOV ESI,sro_clie.0091C290 ; ASCII "GameGuard file does not exist or is corrupted. Please install the GameGuard setup file."
005641BD EB 2F JMP SHORT sro_clie.005641EE
005641BF BE 38C29100 MOV ESI,sro_clie.0091C238 ; ASCII "Window system files might be corrupted. Please reinstall the Internet Explorer(IE)."
005641C4 EB 28 JMP SHORT sro_clie.005641EE
005641C6 BE F0C19100 MOV ESI,sro_clie.0091C1F0 ; ASCII "Fail to run GameGuard. Please reinstall the GameGuard setup file."
005641CB EB 21 JMP SHORT sro_clie.005641EE
005641CD BE 98C19100 MOV ESI,sro_clie.0091C198 ; ASCII "Illegal program detected. Close all the unnecessary programs before running the game."
005641D2 EB 1A JMP SHORT sro_clie.005641EE
005641D4 BE 00C19100 MOV ESI,sro_clie.0091C100 ; ASCII "GameGuard update has been aborted. Please check the status of Internet network or personal firewall settings when unable to connect continuously."
005641D9 EB 13 JMP SHORT sro_clie.005641EE
005641DB BE 80C09100 MOV ESI,sro_clie.0091C080 ; ASCII "Fail to connect the GameGuard update server. Please try again after a while, or check personal Firewall settings if any."
005641E0 EB 0C JMP SHORT sro_clie.005641EE
005641E2 BE E8BF9100 MOV ESI,sro_clie.0091BFE8 ; ASCII "Fail to complete GameGuard update. Suspend Anti-Virus program temporarily and try the game, or check the settings of PC management programs if any."
005641E7 EB 05 JMP SHORT sro_clie.005641EE
005641E9 BE 70BF9100 MOV ESI,sro_clie.0091BF70 ; ASCII "Error occurred while running GameGuard. Please send all *.erl files in GameGuard folder to [email]
.kr[/email] via email."
005641EE 50 PUSH EAX
005641EF 68 4CBF9100 PUSH sro_clie.0091BF4C ; ASCII "GameGuard execute error : %lu"
005641F4 68 C8389400 PUSH sro_clie.009438C8 ; ASCII "GameGuard execute error : 0"
005641F9 FF15 14348A00 CALL DWORD PTR DS:[8A3414] ; USER32.wsprintfA
005641FF 83C4 0C ADD ESP,0C
00564202 6A 00 PUSH 0
00564204 68 C8389400 PUSH sro_clie.009438C8 ; ASCII "GameGuard execute error : 0"
00564209 56 PUSH ESI
0056420A 6A 00 PUSH 0
0056420C FF15 60348A00 CALL DWORD PTR DS:[8A3460] ; USER32.MessageBoxA
00564212 C605 D9399400 01 MOV BYTE PTR DS:[9439D9],1
00564219 33C0 XOR EAX,EAX
0056421B 5E POP ESI
0056421C C3 RETN
0056421D B8 01000000 MOV EAX,1
00564222 C3 RETN
U r good!
