Cheat v.42

Posted by Hide­
2007.07.09 23:57 Security/Reversing

http://coderant.egloos.com/3442367


Cheat v.42 MSEA


어떤 외국 해커가 올린 치트엔진 v.42 MSEA이 핵심 치트 기능을 어셈블러로 친절하게 해석한 코드입니다. 
게임회사에게는 가장 큰 위협이 아마도 치트엔진일겁니다. 최근에는 오리지널 치트엔진를 튜닝한 전용 치트엔진들이 많이 만들어 지고 있습니다.

m?Story의 Protect에서 무결성 체크를 위해서 CRC 체크를 하게되는데 그 체크를 우회하는데 사용된 기법입니다.

[enable]
alloc(newmem,2048)
alloc(blaaaa,3670018)
label(originalcode)
loadbinary(blaaaa,v42.CEM)

newmem:
cmp ecx,00400000
jb originalcode

cmp ecx,00780000
ja originalcode

mov eax,blaaaa
sub eax,00400000
add ecx, eax

originalcode:
mov eax,[ebp+10]
push esi
push edi
jmp 00466353 //asm mov eax,[ebp+10]

0046634e: //8b 45 10 56 57 8b 7d 0c 83 ff
jmp newmem

[disable]
0046634e:
mov eax,[ebp+10]
push esi
push edi
dealloc(newmem)
dealloc(blaaaa)

Godmode

[Enable]
00689d24: //0f 84 8c 0e 00 00 e8 by NT_xvmon
jne 0068abab

[Disable]
00689d24:
je 0068abab

Vac right

[Enable]
006C22F9: //0f 86 83 00 00 00 8b bf by NT_xvmon
jae 006c2382

[Disable]
006C22F9:
jbe 006c2382

Vac left

[Enable]
006C227C: //73 66 8B BF 10 01 00 00 by NT_xvmon
jbe 006c22e4

[Disable]
006C227C:
jae 006c22e4


Suck Up:

[Enable]
006C2195://73 6C DD 45 EC 8D 4E by NT_xvmon
jb 006c2203

[Disable]
006C2195:
jae 006c2203

Suck Dow

[Enable]
006C1427: //0f 86 8e 00 00 00 by NT_xvmon
jae 006c14bb

[Disable]
006C1427:
jbe 006c14bb


SHUTDOWN maple instint
 

 
[ENABLE]
7201bd: //25 ff 7f 00 00 c3 cc cc NT_XVMON Unrandomzier addy
jmp 00000000

[DISABLE]
7201bd:
and eax,00007fff

item filter

[Enable]
alloc(ItemEdit, 256)
label(CS)
registersymbol(counter)
alloc(counter, 64)

counter:
db 00 00

ItemEdit:
mov [counter], eax
cmp eax,1F72C8 //Arrow of Crossbow
je CS
cmp eax,1F6EE0 //Arrow of Bow
je CS
cmp eax,3D7E3C //MonsterCards
je CS
cmp eax,1F72C8 //Arrow of Crossbow
je CS
cmp eax,3D0979//plat helmet
je CS

cmp eax,3D7E3C //MonsterCards
je CS
cmp eax,3D8286 //Dark Chocolate
je CS
cmp eax,3D8285 //White Chocolate
je CS
//cmp eax,1E8C54 // Warrior Potion
//je CS
//cmp eax,F4A34 //White Potion
//je CS
//arrows
cmp eax,001F6EE0
je CS
cmp eax,001F6EE3
je CS
cmp eax,001F72C8
je CS
cmp eax,001F72CB
je CS
cmp eax,001F6EE1
je CS
cmp eax,001F72C9
je CS
cmp eax,001F6EE2
je CS
cmp eax,001F72CA
je CS
//arrows
cmp eax,003D09A6 //shrimp meat
je CS
cmp eax,003D09A5 //Flamboyant Petal
je CS
cmp eax,003D0970 //mechiancial heart
je CS
mov [edi+34],eax
mov edi, [ebp-14]
jmp 4a3c00 //jmp back two addy down

CS:
mov [edi+34],0
mov edi, [ebp-14]
jmp 4a3c00

004A3BFA:
jmp ItemEdit

[Disable]
004A3BFA: //89 47 34 8b 7d ec 8b by nt_xvmon
mov [edi+34], eax
mov edi, [ebp-14]

Wall Pointer: 7e1034 //8d 4f fc 1b c0 23 c1 89 by NT_xvmon
Left - Offset C
Top -Offset 10
Right - Offset 14
Bottom - Offset 18

lag hack

[Enable]
006BF74D: //74 0B 8B 06 6A 1E 8B CE by nt_xvmon
jne 006bf75a

[Disable]
006BF74D:
je 006bf75a

dice rolling state unrandomizer
 

 
[Enable]
Alloc(Unrandomizer,64)
Alloc(Value,32)

Registersymbol(Value)

Unrandomizer:
mov eax, [Value]
and eax,00007fff
jmp 7201c2 //Return one addy down

7201bd:
jmp Unrandomizer

[Disable]
7201bd: //25 ff 7f 00 00 c3 cc cc NT_XVMON
and eax,00007fff

Dealloc(Unrandomizer)
Dealloc(Value)

Unregistersymbol(Value)

camel's attack spd

 
[ENABLE]

6e1a69://83 46 18 1e 8b 46 NT_XVMON
DB 83 46 18 01// Change 01 to 7e to turn it into lag hack and 1e is normal speed.

[DISABLE]
6e1a69:
DB 83 46 18 1E

levitate

[enable]
6c0b10://0f 84 ed 01 00 00 8b NT_XVMON
jNe 006c0d03
[disable]
6c0b10:
je 006c0d03

FLY HACK

[Enable]
006BFCA2: //0F 84 D0 00 00 00 FF B6 48 01 NT_XVMON
jne 006bfd78
[Disable]
006BFCA2:
je 006bfd78

slow dupe

Quote:
[enable]
alloc(hvc,32)

alloc(havoc,32)
registersymbol(havoc)
label(hvoc)

hvc:
mov [havoc],esi
mov [esi+00000114],edi
jmp hvoc


006C23B9: //89 BE 14 01 00 00 E8 0E 83 7D 0C 00 74 nt_xvmon
jmp hvc //mov [esi+00000114],edi
nop
hvoc:

[disable]
006C23B9:
mov [esi+00000114],edi

dealloc(hvc)
dealloc(havoc)
unregistersymbol(havoc)

super tubi

Quote:
[Enable]
0049B6F6://75 36 83 7c 24 0c 00 nt_xvmon
nop
nop

[Disable]
0049B6F6:
jne 0049b72e

Instant drop

Quote:
[Enable]
00775D60: //00 00 00 00 00 40 8f 40 cd xvmon
add [eax],al
add [eax],al
add [eax],al
add [eax],al

[Disable]
00775D60:
add [eax],al
add [eax],al
add [eax-71],al
inc eax

Teleport left

Quote:
[enable]
6c2095: //73 53 dd 45 ec 8b ce by nt_xvmon
jbe 006c20ea

[disable]
6c2095:
jae 006c20ea

teleport right

Quote:

Quote:
[enable]
006C2104: //76 72 DD 45 EC 8B CE by nt_xvmon
db 73 72

[disable]
006C2104:
db 76 72

MesoDrop

Quote:
[enable]
Alloc(MesoDrop, 64)

MesoDrop:
mov eax, C80
mov [esi+000000bc] ,eax
jmp 6bc04c //1addy down

6bc046:
jmp MesoDrop

[disable]
6bc046: //89 86 bc 00 00 00 7d nt_xvmon
mov [esi+000000bc] ,eax
dealloc(MesoDrop)

nobreadth

Quote:
[Enable]
00672240: //7f 44 ff b6 xvmon
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

[Disable]
00672240:
mov [esi+00000304],00001388

selective wall

Quote:
[ENABLE]
alloc(begin,2048)
alloc(olddata,32)
alloc(pointer,4)
alloc(bool,4)
registersymbol(bool)
label(set)
label(ret)
label(end)

begin:
cmp [bool],1
je set
ret:
mov esi,olddata
movsd
movsd
movsd
movsd
pop edi
jmp end
set:

//=============LEFT
mov esi,[7e1034]
mov esi,[esi+0C]
mov [pointer], esi
mov esi,[pointer]
mov [olddata],esi
//=============TOP
mov esi,[7e1034]
mov esi,[esi+10]
mov [pointer], esi
mov esi,[pointer]
mov [olddata+04],esi
//=============RIGHT
mov esi,[7e1034]
mov esi,[esi+14]
mov [pointer], esi
mov esi,[pointer]
mov [olddata+08],esi
//============= Bottom
mov esi,[7e1034]
mov esi,[esi+18]
mov [pointer], esi
mov esi,[pointer]
mov [olddata+0C],esi

mov [bool],0
jmp ret

6bf32d: //A5 A5 A5 A5 5F 5E C2 04 by nt_xvmon
jmp begin
end:

olddata:
DB 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
pointer:
DB 00 00 00 00
bool:
DB 01 00 00 00

[DISABLE]
dealloc(begin)
dealloc(olddata)
dealloc(pointer)
dealloc(bool)
unregistersymbol(bool)

6bf32d:
movsd
movsd
movsd
movsd
pop edi

all offset i find myself 
char Y: 007e1b10 offset:5c4
Char X: 007e1b10 offset:5c0
item X: 007e1b10 offset:5c8
item y: 007e1b10 offset:5cc

NT_Real miss godemode

Quote:
[enable]
006E8295://0f 84 be 09 00 00 8b 45 by nt_xvmon
db 0f 85 //mov [esi+00002d40],00000001
[disable]
006E8295:
db 0f 84

cef_Real miss godmode

Quote:
[Enable]
00689E01: //0f 84 ae 09 00 00 8b xvmon
jne 0068a7b5 //mov eax,[ebp+18]

[Disable]
00689E01:
je 0068a7b5

ua version2

Quote:
[Enable]
00685482:
and [ebx+00001294],00000100
nop
nop
nop
//74 09 e8 a2 db d7 ff 83 xvmon
[Disable]
00685482:
and dword ptr [ebx+00001294],00






CS_ME
add address "YourDmg"
input ur wanted damage to value

Quote:
[Enable]
registersymbol(YourDmg)
alloc(YourDmg,4)
alloc(Dmg,32)

YourDmg:
add [edi],al
add [edi],al

Dmg:
mov edi, [YourDmg]
mov [ecx],edi
jmp 693028

693026: //89 39 46 83 c1 04 eb e7 xvmon
jmp Dmg
nop

[Disable]
unregistersymbol(YourDmg)
dealloc(YourDmg)
dealloc(Dmg)
693026:
mov [ecx],edi

mElee dice

Quote:
[enable]
alloc(dICE,64)
label(return)


dICE:
pushad
//=========================
mov edx, [007e1b10]
mov ebx, [edx+5c0]
mov ecx,[edx+5c4]
//============================
mov eax,[007e1034]
mov [eax+C],ebx
mov [eax+14],ebx
mov [eax+10],ecx
mov [eax+18],ecx
popad

mov [ebx], eax
mov edi,[ebp+10]
jmp return


//============================
006C35B7: //89 03 8b 7d 10 85 ff 74 5e XVMON
jmp dICE
return:

006c5f19: //0f 85 62 01 00 00 ff 77 30 83 XVMON
db 0f 84

006bfa06: //74 05 e8 25 02 00 00 39 b3 XVMON
db 75

006bfca2: //0f 84 d0 00 00 00 ff b6 XVMON
db 0f 85
//============================
[disable]
006C35B7:
mov [ebx], eax
mov edi,[ebp+10]

006c5f19:
db 0f 85

006bfa06:
db 74

006bfca2:
db 0f 84

dealloc(dICE)

swim

Quote:
[enable]
0057F848:
db 74 04

[disable]
0057F848:
db 75 04


다른 사람들이 많이 읽은 글

'Security > Reversing' 카테고리의 다른 글

바람의나라 템복사  (0) 2007.12.01
아래 XTrap 바이패스 만드는 법  (0) 2007.07.09
Cheat v.42  (0) 2007.07.09
GameGuard Nop 처리 부분  (1) 2007.07.09
How to way Bypass CRC Check  (0) 2007.07.09
Shield from DLL Injection  (0) 2007.07.09
이 댓글을 비밀 댓글로

티스토리 툴바