Problem loader C#, text data in Media.pk2

tuandoi1 · 04/15/2013, 08:31

Hello i'm form vietnamese.

Some day i begin coder bot for Silkroad(Vsro have Xtrap and packet anti clientless).

1. I'm want create loader use C#. I'm find on this forum then not found solution for problem of me. I have download code souce bot of "zeteris"(ZBot), i'm found method call is "CaveCode" injector dll to process sro, but i'm use for Vsro then not working. anyone to know why, if i'm use not correctly way then please help me. If anyone have code source dll(C# and C++) and code C# injector. Please upload this topic help for me.

2. When i'm use tool extract file textdata in Media.pk2 then very have file txtdata(not in one file). I'm want need data skill, item, mobs. what need read file content data i'm need?.
i'm seen many skill not have translate, i'm have need this skill?.
textdata skill have two type. enc and not enc, content two this file different?
Final struct files textdata i'm unknown. Somebody provider information about struct file example file mob, skill, item...
Thank everybody lost time read this topic.
Sory english of me very bad. Hopes everybody understand.
Plese help me.

mss29 · 04/16/2013, 18:18

pk2reader.cs

pk2.cs

Blowfish.cs

compile it

example
(select your encoding type)

Quote:

pk2Reader pr=new pk2Reader(@"C:\Silkroad_1.401\media.pk2");
string str=ASCIIEncoding.Unicode.GetString(pr.getFile("itemdata_5000.txt"));

tuandoi1 · 04/17/2013, 08:29

Quote:

Originally Posted by mss29

pk2reader.cs

pk2.cs

Blowfish.cs

compile it

example
(select your encoding type)

Thanks reply. You can help about dll C++ hook to sro. Thanks

miamidolphin · 04/17/2013, 09:07

You doesnt need to make injected dll like in zBot. That injected dlll doesnt have any special functions just redirect the sro_client to his own proxy, but you could redirect your client without injecting dll, so in that case thats totally useless right now. If you only want to make a loader, for vsro based servers you doesnt need proxy or redirect ip etc... just simply run the sro_client.exe with mutex. If you would like to add later functions and packet based things, than you need proxy and redirect ip.

To redirect your sro_client to a specific ip (for example to your proxy) check this:

PHP Code:


			
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace Loader
{
    public partial class Form1 : Form
    {
        [DllImport("kernel32.dll")]
        static extern IntPtr LoadLibrary(string dllToLoad);
        [DllImport("kernel32.dll")]
        static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, int dwProcessId);
        [DllImport("kernel32.dll")]
        static extern uint ReadProcessMemory(IntPtr hProcess, uint lpBaseAddress, uint lpbuffer, uint nSize, uint lpNumberOfBytesRead);
        [DllImport("kernel32.dll")]
        static extern uint WriteProcessMemory(IntPtr hProcess, uint lpBaseAddress, byte[] lpBuffer, int nSize, uint lpNumberOfBytesWritten);
        [DllImport("kernel32.dll")]
        static extern uint VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, uint flAllocationType, uint flProtect);
        [DllImport("kernel32.dll")]
        static extern IntPtr CreateMutex(IntPtr lpMutexAttributes, bool bInitialOwner, string lpName);
        [DllImport("kernel32.dll")]
        static extern IntPtr GetModuleHandle(string lpModuleName);
        [DllImport("kernel32")]
        static extern uint GetProcAddress(IntPtr hModule, string procName);
        [DllImport("kernel32.dll")]
        static extern uint WritePrivateProfileString(string section, string key, string val, string filePath);
        [DllImport("kernel32.dll")]
        static extern uint GetPrivateProfileString(string lpAppName, string lpKeyName, string lpDefault, StringBuilder lpReturnedString, int nSize, string lpFileName);

        public static IntPtr Handle;

        public Form1()
        {
            InitializeComponent();
        }

        private void Form1_Load(object sender, EventArgs e)
        {
            CreateMutex(IntPtr.Zero, false, "Silkroad Online Launcher");
            CreateMutex(IntPtr.Zero, false, "Ready");
            uint count = 0;
            Process SilkProcess;
            SilkProcess = new Process();
            SilkProcess.StartInfo.FileName = @"D:\Program Files\Creddy Avengers Loki\sro_client.exe";
            SilkProcess.StartInfo.Arguments = "0/22 0 0";
            SilkProcess.Start();
            Handle = OpenProcess((uint)(0x000F0000L | 0x00100000L | 0xFFF), 0, SilkProcess.Id);
            uint ConnectionStack = VirtualAllocEx(Handle, IntPtr.Zero, 8, 0x1000, 0x4);
            byte[] ConnectionStackArray = BitConverter.GetBytes(ConnectionStack);
            byte[] Connection = {
                                    0x02,0x00,
                                    0x3D, 0xA2, // PORT (15778)
                                    0x7F,0x00,0x00,0x01 // IP (127.0.0.1)
                                };
            uint Codecave = VirtualAllocEx(Handle, IntPtr.Zero, 16, 0x1000, 0x4);
            byte[] CodecaveArray = BitConverter.GetBytes(Codecave - 0x004B08A1 - 5);
            byte[] CodeCaveFunc = {
                                      0xBF,ConnectionStackArray[0],ConnectionStackArray[1],ConnectionStackArray[2],ConnectionStackArray[3],
                                      0x8B,0x4E,0x04,
                                      0x6A,0x10,
                                      0x68,0xA6,0x08,0x4B,0x00,
                                      0xC3
                                  };
            byte[] JMPCodeCave = { 0xE9, CodecaveArray[0], CodecaveArray[1], CodecaveArray[2], CodecaveArray[3] };
            WriteProcessMemory(Handle, ConnectionStack, Connection, Connection.Length, count);
            WriteProcessMemory(Handle, Codecave, CodeCaveFunc, CodeCaveFunc.Length, count);
            WriteProcessMemory(Handle, 0x004B08A1, JMPCodeCave, JMPCodeCave.Length, count);
        }
    }

Also you could write a dll like zeteris in c++ with this c# code need just a bit conversion to cpp, but making a dll and injecting just makes the things more complicated so doesnt worth it, since you wont got any other functions and you doesnt needed other functions from a dll.

tuandoi1 · 04/17/2013, 12:04

Quote:

Originally Posted by miamidolphin

You doesnt need to make injected dll like in zBot. That injected dlll doesnt have any special functions just redirect the sro_client to his own proxy, but you could redirect your client without injecting dll, so in that case thats totally useless right now. If you only want to make a loader, for vsro based servers you doesnt need proxy or redirect ip etc... just simply run the sro_client.exe with mutex. If you would like to add later functions and packet based things, than you need proxy and redirect ip.

To redirect your sro_client to a specific ip (for example to your proxy) check this:

PHP Code:

using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Linq; using System.Text; using System.Windows.Forms; using System.Runtime.InteropServices; using System.Diagnostics; namespace Loader { public partial class Form1 : Form { [DllImport("kernel32.dll")] static extern IntPtr LoadLibrary(string dllToLoad); [DllImport("kernel32.dll")] static extern IntPtr OpenProcess(uint dwDesiredAccess, int bInheritHandle, int dwProcessId); [DllImport("kernel32.dll")] static extern uint ReadProcessMemory(IntPtr hProcess, uint lpBaseAddress, uint lpbuffer, uint nSize, uint lpNumberOfBytesRead); [DllImport("kernel32.dll")] static extern uint WriteProcessMemory(IntPtr hProcess, uint lpBaseAddress, byte[] lpBuffer, int nSize, uint lpNumberOfBytesWritten); [DllImport("kernel32.dll")] static extern uint VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, int dwSize, uint flAllocationType, uint flProtect); [DllImport("kernel32.dll")] static extern IntPtr CreateMutex(IntPtr lpMutexAttributes, bool bInitialOwner, string lpName); [DllImport("kernel32.dll")] static extern IntPtr GetModuleHandle(string lpModuleName); [DllImport("kernel32")] static extern uint GetProcAddress(IntPtr hModule, string procName); [DllImport("kernel32.dll")] static extern uint WritePrivateProfileString(string section, string key, string val, string filePath); [DllImport("kernel32.dll")] static extern uint GetPrivateProfileString(string lpAppName, string lpKeyName, string lpDefault, StringBuilder lpReturnedString, int nSize, string lpFileName); public static IntPtr Handle; public Form1() { InitializeComponent(); } private void Form1_Load(object sender, EventArgs e) { CreateMutex(IntPtr.Zero, false, "Silkroad Online Launcher"); CreateMutex(IntPtr.Zero, false, "Ready"); uint count = 0; Process SilkProcess; SilkProcess = new Process(); SilkProcess.StartInfo.FileName = @"D:\Program Files\Creddy Avengers Loki\sro_client.exe"; SilkProcess.StartInfo.Arguments = "0/22 0 0"; SilkProcess.Start(); Handle = OpenProcess((uint)(0x000F0000L | 0x00100000L | 0xFFF), 0, SilkProcess.Id); uint ConnectionStack = VirtualAllocEx(Handle, IntPtr.Zero, 8, 0x1000, 0x4); byte[] ConnectionStackArray = BitConverter.GetBytes(ConnectionStack); byte[] Connection = { 0x02,0x00, 0x3D, 0xA2, // PORT (15778) 0x7F,0x00,0x00,0x01 // IP (127.0.0.1) }; uint Codecave = VirtualAllocEx(Handle, IntPtr.Zero, 16, 0x1000, 0x4); byte[] CodecaveArray = BitConverter.GetBytes(Codecave - 0x004B08A1 - 5); byte[] CodeCaveFunc = { 0xBF,ConnectionStackArray[0],ConnectionStackArray[1],ConnectionStackArray[2],ConnectionStackArray[3], 0x8B,0x4E,0x04, 0x6A,0x10, 0x68,0xA6,0x08,0x4B,0x00, 0xC3 }; byte[] JMPCodeCave = { 0xE9, CodecaveArray[0], CodecaveArray[1], CodecaveArray[2], CodecaveArray[3] }; WriteProcessMemory(Handle, ConnectionStack, Connection, Connection.Length, count); WriteProcessMemory(Handle, Codecave, CodeCaveFunc, CodeCaveFunc.Length, count); WriteProcessMemory(Handle, 0x004B08A1, JMPCodeCave, JMPCodeCave.Length, count); } }

Also you could write a dll like zeteris in c++ with this c# code need just a bit conversion to cpp, but making a dll and injecting just makes the things more complicated so doesnt worth it, since you wont got any other functions and you doesnt needed other functions from a dll.

Thank you, i'm very happy when you share code redirect. But when i try it isn't working. You can recheck. ip vsro 123.30.200.5 and 123.30.200.6. Note when i'm try wiht private sro then it working. (vsro have xtrap). do you know this problem?

miamidolphin · 04/17/2013, 12:19

So it doesnt work with isro and it is working with vsro based servers? Because to isro you need other things too but this should work at vsro based servers coz i used that on my project. Explain me more the problem.

tuandoi1 · 04/17/2013, 12:47

Quote:

Originally Posted by miamidolphin

So it doesnt work with isro and it is working with vsro based servers? Because to isro you need other things too but this should work at vsro based servers coz i used that on my project. Explain me more the problem.

Oh no. i use on vsro private(source private from server test of vsro). But when use server vsro(not private) then not working. i understand this problem. You can explain for me about code you write. Thanks

miamidolphin · 04/17/2013, 12:59

I understand what u say, yes the code i posted working only on pservers. To make something work on original servers, you may have to change something. I doesnt really have solution for that coz i stopped coding for silkroad and now im out of date. But the main purpose is to find out the problem, and check if there are some other solutions working. You could also check out bots working loaders or dlls or just simply try out some public solutions, may they are working . Does zbot work there? Also could you load the client with that? If yes just make a loader.dll in cpp. You could write that easy. You should check this out to make a dll in cpp to redirect your client:

As i said, im out of date of silkroad right now, but there are maybe some working proxies like nuconnector or idk. If they are working and you have some loader to redirect to them check their source code. I think your problem comes from xtrap or hackshield.

tuandoi1 · 04/17/2013, 13:44

Quote:

Originally Posted by miamidolphin

I understand what u say, yes the code i posted working only on pservers. To make something work on original servers, you may have to change something. I doesnt really have solution for that coz i stopped coding for silkroad and now im out of date. But the main purpose is to find out the problem, and check if there are some other solutions working. You could also check out bots working loaders or dlls or just simply try out some public solutions, may they are working . Does zbot work there? Also could you load the client with that? If yes just make a loader.dll in cpp. You could write that easy. You should check this out to make a dll in cpp to redirect your client:
As i said, im out of date of silkroad right now, but there are maybe some working proxies like nuconnector or idk. If they are working and you have some loader to redirect to them check their source code. I think your problem comes from xtrap or hackshield.

you can help me a project dll VC++. i'm very bad C++.

qkuh · 04/17/2013, 13:46

Use MS Detours to redirect the WS2_32 Connect func.

tuandoi1 · 04/17/2013, 14:03

Quote:

Originally Posted by qkuh

Use MS Detours to redirect the WS2_32 Connect func.

i try but error
my code

Code:

// dllmain.cpp : Defines the entry point for the DLL application.
#include "stdafx.h"
#include <winsock2.h>
#include <stdio.h>
#include <windows.h>
#include <Detours.h>

#pragma comment(lib, "Detours.lib")
#pragma comment(lib, "ws2_32.lib")

typedef int (WINAPI * trampoline_connect)(SOCKET s, const sockaddr *name, int namelen);
trampoline_connect orginal_connect;


int WINAPI my_connect(SOCKET s, const sockaddr *name, int namelen)
{
	sockaddr_in si;
	memcpy(&si, name, sizeof(sockaddr_in));

	si.sin_addr.S_un.S_addr = inet_addr("127.0.0.1");
	si.sin_port = 15778;
	return orginal_connect(s, (sockaddr*)&si, sizeof(sockaddr_in));
}


BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		{
			orginal_connect = (trampoline_connect)DetourFunction((PBYTE)GetProcAddress(GetModuleHandle((LPCWSTR)"ws2_32.dll"),"connect"), (PBYTE)my_connect);
		}
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}