Page 1 of 2 12 LastLast
Results 1 to 15 of 19
  1. #1
    TheRealVB's Avatar
    Join Date
    Oct 2009
    Gender
    male
    Location
    Missouri
    Posts
    191
    Reputation
    -51
    Thanks
    23
    My Mood
    Busy

    NexonGuard Unpacked & Cracked

    :: Info ::

    well here yall go so enjoy it aint fully unpacked but itll give yall some useful info maybe? (: i unpacked it n encrypted it using AESCrypt n then unencrypted afterwards so enjoy it the password is 123abc if ya got AESCrypt just right click n unencrypt it n enter the pass n then view it in notepad (: k thanx


    :: Virus Scans ::

    Virus Total

    No Virus Thanks


    :: Download ::



    See Attachment

    @whit

    @Dave84311
    @Crash
    @Disturbed
    @AVGN
    @supercarz1991
    @Bombsaway707
    @Jabuuty671
    Last edited by TheRealVB; 05-06-2011 at 03:44 AM.
    Raging On CA Under VB-ReBoRn

  2. The Following 3 Users Say Thank You to TheRealVB For This Useful Post:

    Gawyn (05-14-2011),luverbwoy (07-03-2012),shispir (08-02-2012)

  3. #2
    Dave84311's Avatar
    Join Date
    Dec 2005
    Gender
    male
    Location
    The Wild Wild West
    Posts
    27,856
    Reputation
    3541
    Thanks
    36,158
    My Mood
    Devilish
    Seems clean. Approved.





    THE EYE OF AN ADMINISTRATOR IS UPON YOU. ANY WRONG YOU DO IM GONNA SEE, WHEN YOU'RE ON MPGH, LOOK BEHIND YOU, 'CAUSE THATS WHERE IM GONNA BE


    "First they ignore you. Then they laugh at you. Then they fight you. Then you lose.” - Dave84311HAD VIRTUAL DETOX

  4. The Following User Says Thank You to Dave84311 For This Useful Post:

    TheRealVB (05-06-2011)

  5. #3
    FUKO's Avatar
    Join Date
    Aug 2010
    Gender
    male
    Location
    PBlackout.exe /mhu
    Posts
    11,132
    Reputation
    1103
    Thanks
    3,842
    DONT DOWNLOAD

    THIS BIRUS!!!

  6. #4
    TheRealVB's Avatar
    Join Date
    Oct 2009
    Gender
    male
    Location
    Missouri
    Posts
    191
    Reputation
    -51
    Thanks
    23
    My Mood
    Busy
    lmao @Fuko its clean u nerd n u kno it is
    Raging On CA Under VB-ReBoRn

  7. #5
    HellSpider's Avatar
    Join Date
    Jun 2010
    Gender
    male
    Posts
    103
    Reputation
    30
    Thanks
    125
    My Mood
    Asleep
    Why are most people talking about some AES encrypted NexonGuard? The extension .aes is just to fool people, it has nothing to do with AES encryption.

    The NexonGuard.aes file is a DLL file. Just change .aes to .dll and everything will be clear.

    Furthermore, the file is not packed, only certain parts of the code are virtualized by Oreans CodeVirtualizer (to prevent modifications and code research).

  8. #6
    Cryptonic's Avatar
    Join Date
    Apr 2010
    Gender
    male
    Location
    United Provinces of Canada
    Posts
    1,221
    Reputation
    44
    Thanks
    176
    My Mood
    Bored
    Quote Originally Posted by Fuko View Post
    DONT DOWNLOAD

    THIS BIRUS!!!
    Quote Originally Posted by TheRealVB View Post
    lmao @Fuko its clean u nerd n u kno it is
    Don't worry, Fuko said it had a BIRUS, (who knows what that means) not a virus
    My Projects

    Basic Nexon Account Generator | [Source]FvClickBot | UltimateClean - Advanced CA Cleaner




     
    Quote Originally Posted by traiphoenix View Post
    this hack not working
    Quote Originally Posted by CAFlames View Post
    your brain not working
    Quote Originally Posted by iReapzi View Post
    What about the horny 15 year olds?
    Quote Originally Posted by PepsiXHacker View Post
    Well, they're the ones with mods of naked viper.
    Quote Originally Posted by iReapzi View Post
    Why would they want mods of naked viper, not like the can see her body in game
    Quote Originally Posted by AVGN View Post
    http://www.mpgh.net/forum/210-combat...exy-viper.html
    Quote Originally Posted by iReapzi View Post
    Brb questioning my sexuality.
    Quote Originally Posted by AVGN View Post
    Quote Originally Posted by PepsiXHacker View Post
    Dat bod.


    Previous name "PepsiXHacker"

  9. #7
    Stephen's Avatar
    Join Date
    Jun 2009
    Gender
    male
    Location
    Engine.exe
    Posts
    4,690
    Reputation
    184
    Thanks
    1,147
    My Mood
    Aggressive
    VIRUS. DO NOT DOWNLOAD. sup RealVB.

  10. #8
    FUKO's Avatar
    Join Date
    Aug 2010
    Gender
    male
    Location
    PBlackout.exe /mhu
    Posts
    11,132
    Reputation
    1103
    Thanks
    3,842
    I killed the thread

  11. #9
    Stephen's Avatar
    Join Date
    Jun 2009
    Gender
    male
    Location
    Engine.exe
    Posts
    4,690
    Reputation
    184
    Thanks
    1,147
    My Mood
    Aggressive
    Quote Originally Posted by Fuko View Post
    I killed the thread
    ...As always...

  12. #10
    TheRealVB's Avatar
    Join Date
    Oct 2009
    Gender
    male
    Location
    Missouri
    Posts
    191
    Reputation
    -51
    Thanks
    23
    My Mood
    Busy
    Quote Originally Posted by HellSpider View Post
    Why are most people talking about some AES encrypted NexonGuard? The extension .aes is just to fool people, it has nothing to do with AES encryption.

    The NexonGuard.aes file is a DLL file. Just change .aes to .dll and everything will be clear.

    Furthermore, the file is not packed, only certain parts of the code are virtualized by Oreans CodeVirtualizer (to prevent modifications and code research).

    actually it is packed (: thats why its AES its Encrypted+Packed its packed using Themedia + encrypted usin AESCrypt WIN OS version (: if we can figure out the actual main pw for nexons we can easily unencrypt it n find out exactly wut all it does cuz mine that i uploaded isnt showing the full thing >,<
    Raging On CA Under VB-ReBoRn

  13. #11
    Death751's Avatar
    Join Date
    Apr 2011
    Gender
    male
    Posts
    373
    Reputation
    3
    Thanks
    144
    My Mood
    Flirty
    Looks good .

  14. #12
    HellSpider's Avatar
    Join Date
    Jun 2010
    Gender
    male
    Posts
    103
    Reputation
    30
    Thanks
    125
    My Mood
    Asleep
    Quote Originally Posted by TheRealVB View Post
    actually it is packed (: thats why its AES its Encrypted+Packed its packed using Themedia + encrypted usin AESCrypt WIN OS version (: if we can figure out the actual main pw for nexons we can easily unencrypt it n find out exactly wut all it does cuz mine that i uploaded isnt showing the full thing >,<
    Which CA client do you have? I got CA EU and it's not packed, just change the .aes extension to .dll without any external programs. Then disassemble or debug the file, you'll land directly on the Microsoft Visual C++ 9.0 DLL entry.


    Code:
    3AFF0521 >/$  8BFF          mov edi,edi
    3AFF0523  |.  55            push ebp
    3AFF0524  |.  8BEC          mov ebp,esp
    3AFF0526  |.  837D 0C 01    cmp [arg.2],1
    3AFF052A  |.  75 05         jnz short NexonGua.3AFF0531
    3AFF052C  |.  E8 C9490000   call NexonGua.3AFF4EFA
    3AFF0531  |>  FF75 08       push [arg.1]
    3AFF0534  |.  8B4D 10       mov ecx,[arg.3]
    3AFF0537  |.  8B55 0C       mov edx,[arg.2]
    3AFF053A  |.  E8 ECFEFFFF   call NexonGua.3AFF042B
    3AFF053F  |.  59            pop ecx
    3AFF0540  |.  5D            pop ebp
    3AFF0541  \.  C2 0C00       retn 0C

    Yes it's true that some parts are "hidden", they're virtualized as I said earlier. Themida and CodeVirtualizer uses the same virtual machine, but the difference is that CodeVirtualizer does not have antidumps in it's virtual machine and CodeVirtualizer wont do anything else than virtual machines, while Themida can mess up the whole file really good.


    Code:
    3AFE15B0   .  55            push ebp
    3AFE15B1   .  8BEC          mov ebp,esp
    3AFE15B3   .  6A FF         push -1
    3AFE15B5   .  68 28D8FF3A   push NexonGua.3AFFD828
    3AFE15BA   .  64:A1 0000000>mov eax,dword ptr fs:[0]
    3AFE15C0   .  50            push eax
    3AFE15C1   .  81EC 50020000 sub esp,250
    3AFE15C7   .  A1 5020003B   mov eax,dword ptr ds:[3B002050]
    3AFE15CC   .  33C5          xor eax,ebp
    3AFE15CE   .  8945 F0       mov dword ptr ss:[ebp-10],eax
    3AFE15D1   .  50            push eax
    3AFE15D2   .  8D45 F4       lea eax,dword ptr ss:[ebp-C]
    3AFE15D5   .  64:A3 0000000>mov dword ptr fs:[0],eax
    3AFE15DB   .  898D A4FDFFFF mov dword ptr ss:[ebp-25C],ecx
    3AFE15E1   .- E9 7AAB0300   jmp NexonGua.3B01C160
    The code above is an example of a jump to the CodeVirtualizer virtual machine. There are some junk bytes at the place of the real instructions below the jump (those wont get executed).

    There are almost 30 virtualized functions, nothing else to worry about.
    Last edited by HellSpider; 05-08-2011 at 05:07 AM. Reason: Red color...

  15. #13
    TheRealVB's Avatar
    Join Date
    Oct 2009
    Gender
    male
    Location
    Missouri
    Posts
    191
    Reputation
    -51
    Thanks
    23
    My Mood
    Busy
    @HellSpider msg me ur msn so we can figure out this NexoNGuard bs (:
    Raging On CA Under VB-ReBoRn

  16. #14
    vietboy's Avatar
    Join Date
    Oct 2008
    Gender
    male
    Posts
    384
    Reputation
    5
    Thanks
    25
    My Mood
    Doubtful
    sum 1 just tell me what NexonGuard.aes is, if its a screen wacther, hacking is basicly over ?!?!?!, well nt offically, u'll just b banned lol tell me wut tht is plz

  17. #15
    TheRealVB's Avatar
    Join Date
    Oct 2009
    Gender
    male
    Location
    Missouri
    Posts
    191
    Reputation
    -51
    Thanks
    23
    My Mood
    Busy
    its not a screen watcher rofl thats jus a rumor goin around trust me
    Raging On CA Under VB-ReBoRn

Page 1 of 2 12 LastLast