Request

[HOOSIER73]

I am in need of some advice/help.
I have been analyzing the wolfteam.bin with Olly and I am trying to locate the xingcode initialization. I have found this in other games with the same anti cheat but have not been able to find it in the wolfteam.bin. Could anyone help me find this area of the games memory? I have used my normal method but am unable to locate anything.

Thank's

[Ⓜiku Ⓗatsune]

Do you saw already this the posted source to prevent xc from initialization?

 Spoiler

PBYTE FindStartOfFunc(PBYTE Addy)
{
if (!Addy) return Addy;
while (true) if (compare((PBYTE)"\x55\x8B\xEC", "xxx", Addy--)) return ++Addy;
}

PBYTE FindPush(PBYTE sig, PCHAR mask, DWORD dwBase, DWORD dwLen)
{
if (!dwBase) return nullptr;
BYTE PushSig[5] = { 0x68, 0, 0, 0, 0 };
*(PDWORD)(&PushSig[1]) = FindSignature(sig, mask, dwBase, dwLen, 0);
if (*(PDWORD)(&PushSig[1]) == NULL) return NULL;
return (PBYTE)FindSignature(PushSig, "xxxxx", dwBase, dwLen, 0);
}

bool bTriggered = false, bSuccess = false;
void bypass()
{
DWORD dwCShell = FindCShell();
if (dwCShell != NULL)
{
PBYTE BypassSig = FindPush((PBYTE)"XIGNCODE", "xxxxxxxxx", dwCShell, 5000000);
if (BypassSig != nullptr)
{
PBYTE BypassFunc = FindStartOfFunc(BypassSig);
if (BypassFunc && !memcmp(BypassFunc, (PBYTE)"\x55\x8B\xEC", 3))
{
Wrt((PBYTE)BypassFunc, (PBYTE)"\xB0\x01\xC3", 3);
bSuccess = true;
}
}
}
bTriggered = true;
}
cBreakpoint* bp = NULL;
PBYTE pcheck = 0;
LONG WINAPI ExceptionHandler(EXCEPTION_POINTERS* e)
{
if (e->ExceptionRecord->ExceptionCode != EXCEPTION_SINGLE_STEP) return EXCEPTION_CONTINUE_SEARCH;
if (e->ContextRecord->Eip == (DWORD)pcheck)
{
e->ContextRecord->Esp -= 4;
*(PDWORD)(e->ContextRecord->Esp) = e->ContextRecord->Eip + 0x2;

e->ContextRecord->Eip = e->ContextRecord->Edx;
bypass();
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}

void Start()
{
Sleep(1000);
AntiHWIDBan();
while (pcheck == nullptr)
{
Sleep(30);
pcheck = FindPush((PBYTE)"DIRECTSHOW\x00", "xxxxxxxxxx", (DWORD)GetModuleHandleA("wolfteam.bin"), 5000000);
}
pcheck -= 2;
bp = new cBreakpoint(ExceptionHandler);
bp->SetBP((DWORD)pcheck);
while (!bTriggered) Sleep(1000);
delete bp;
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
if (ul_reason_for_call == DLL_PROCESS_ATTACH)
{
//int iStaticModule = MessageBoxA(0, "Static CShell/Obj?", "", MB_YESNO);
//if (iStaticModule == IDYES) Hook((PBYTE)GetProcAddress(GetModuleHandleA("kerne l32"), "GetTempFileNameA"), (PBYTE)&xGetTempFileNameA, 5);
HANDLE hThread = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)&Start, NULL, NULL, NULL);
if (hThread != NULL) CloseHandle(hThread);
}
return TRUE;
}

[HOOSIER73]

Originally Posted by Ⓜiku Ⓗatsune

Do you saw already this the posted source to prevent xc from initialization?

 Spoiler

PBYTE FindStartOfFunc(PBYTE Addy)
{
if (!Addy) return Addy;
while (true) if (compare((PBYTE)"\x55\x8B\xEC", "xxx", Addy--)) return ++Addy;
}

PBYTE FindPush(PBYTE sig, PCHAR mask, DWORD dwBase, DWORD dwLen)
{
if (!dwBase) return nullptr;
BYTE PushSig[5] = { 0x68, 0, 0, 0, 0 };
*(PDWORD)(&PushSig[1]) = FindSignature(sig, mask, dwBase, dwLen, 0);
if (*(PDWORD)(&PushSig[1]) == NULL) return NULL;
return (PBYTE)FindSignature(PushSig, "xxxxx", dwBase, dwLen, 0);
}

bool bTriggered = false, bSuccess = false;
void bypass()
{
DWORD dwCShell = FindCShell();
if (dwCShell != NULL)
{
PBYTE BypassSig = FindPush((PBYTE)"XIGNCODE", "xxxxxxxxx", dwCShell, 5000000);
if (BypassSig != nullptr)
{
PBYTE BypassFunc = FindStartOfFunc(BypassSig);
if (BypassFunc && !memcmp(BypassFunc, (PBYTE)"\x55\x8B\xEC", 3))
{
Wrt((PBYTE)BypassFunc, (PBYTE)"\xB0\x01\xC3", 3);
bSuccess = true;
}
}
}
bTriggered = true;
}
cBreakpoint* bp = NULL;
PBYTE pcheck = 0;
LONG WINAPI ExceptionHandler(EXCEPTION_POINTERS* e)
{
if (e->ExceptionRecord->ExceptionCode != EXCEPTION_SINGLE_STEP) return EXCEPTION_CONTINUE_SEARCH;
if (e->ContextRecord->Eip == (DWORD)pcheck)
{
e->ContextRecord->Esp -= 4;
*(PDWORD)(e->ContextRecord->Esp) = e->ContextRecord->Eip + 0x2;

e->ContextRecord->Eip = e->ContextRecord->Edx;
bypass();
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}

void Start()
{
Sleep(1000);
AntiHWIDBan();
while (pcheck == nullptr)
{
Sleep(30);
pcheck = FindPush((PBYTE)"DIRECTSHOW\x00", "xxxxxxxxxx", (DWORD)GetModuleHandleA("wolfteam.bin"), 5000000);
}
pcheck -= 2;
bp = new cBreakpoint(ExceptionHandler);
bp->SetBP((DWORD)pcheck);
while (!bTriggered) Sleep(1000);
delete bp;
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
if (ul_reason_for_call == DLL_PROCESS_ATTACH)
{
//int iStaticModule = MessageBoxA(0, "Static CShell/Obj?", "", MB_YESNO);
//if (iStaticModule == IDYES) Hook((PBYTE)GetProcAddress(GetModuleHandleA("kerne l32"), "GetTempFileNameA"), (PBYTE)&xGetTempFileNameA, 5);
HANDLE hThread = CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)&Start, NULL, NULL, NULL);
if (hThread != NULL) CloseHandle(hThread);
}
return TRUE;
}

Nice .dll did not answer my question though I am trying to locate it in the .bin