Results 1 to 8 of 8
  1. #1
    master131's Avatar
    Join Date
    Apr 2010
    Gender
    male
    Location
    Melbourne, Australia
    Posts
    8,802
    Reputation
    3165
    Thanks
    73,323
    My Mood
    Breezy

    cshell.dll, blacklisted strings.

    Was browsing through cshell.dll in IDA today for fun and found a whole function dedicated to strings associated with hack sites and swear words that they've probably blacklisted including @TokolocoSK I've blurred out everything else because if I kept them as they were, that'd be considered advertising. I can't post a picture of the function cause it made my IDA lag hard and it took ages for the tab to close.







    I wonder how MPGH got there.
    Last edited by master131; 01-09-2013 at 03:46 AM.
    Donate:
    BTC: 1GEny3y5tsYfw8E8A45upK6PKVAEcUDNv9


    Handy Tools/Hacks:
    Extreme Injector v3.6.1 *NEW* Windows 10 compatible!
    A powerful and advanced injector in a simple GUI.
    Can scramble DLLs on injection making them harder to detect and even make detected hacks work again!

    Minion Since: 13th January 2011
    Moderator Since: 6th May 2011
    Global Moderator Since: 29th April 2012
    Super User/Unknown Since: 23rd July 2013
    'Game Hacking' Team Since: 30th July 2013

    --My Art--
    [Roxas - Pixel Art, WIP]
    [Natsu - Drawn]
    [Natsu - Coloured]


    All drawings are coloured using Photoshop.

    --Gifts--
    [Kyle]

  2. #2
    Saboteur's Avatar
    Join Date
    Mar 2010
    Gender
    male
    Location
    Great White North
    Posts
    29,408
    Reputation
    5235
    Thanks
    7,581
    My Mood
    Grumpy
    pu ta mutha mytit free vip mpgh n0otz



    VIP Support // May 2011
    CF Minion // January 2012
    Newsforce // August 2012
    Minion+ // March 2013
    Moderator // August 2014
    Former Staff // January 2015
    General Minion // July 2015
    Publicist // December 2015


  3. #3
    -Bl00d-'s Avatar
    Join Date
    Sep 2011
    Gender
    female
    Location
    Imma girl what about it?
    Posts
    481
    Reputation
    10
    Thanks
    53
    My Mood
    Twisted
    LOL!
    ive noticed these once but the list wasnt tha tlong
    it mostly just swear words when i saw it
    Successful buys: 20
    Successful sells: 4
    Successful trades: 9
    Scammed: 4

     
    http://www.mpgh.net/forum/490-vouches/560562-vouches.html

    ^^^^^^^^^^^
    vouche for me?

  4. #4
    master131's Avatar
    Join Date
    Apr 2010
    Gender
    male
    Location
    Melbourne, Australia
    Posts
    8,802
    Reputation
    3165
    Thanks
    73,323
    My Mood
    Breezy
    Quote Originally Posted by -Bl00d- View Post
    LOL!
    ive noticed these once but the list wasnt tha tlong
    it mostly just swear words when i saw it
    Yeah, there's WAY more, but I obviously can't post all of it.
    Donate:
    BTC: 1GEny3y5tsYfw8E8A45upK6PKVAEcUDNv9


    Handy Tools/Hacks:
    Extreme Injector v3.6.1 *NEW* Windows 10 compatible!
    A powerful and advanced injector in a simple GUI.
    Can scramble DLLs on injection making them harder to detect and even make detected hacks work again!

    Minion Since: 13th January 2011
    Moderator Since: 6th May 2011
    Global Moderator Since: 29th April 2012
    Super User/Unknown Since: 23rd July 2013
    'Game Hacking' Team Since: 30th July 2013

    --My Art--
    [Roxas - Pixel Art, WIP]
    [Natsu - Drawn]
    [Natsu - Coloured]


    All drawings are coloured using Photoshop.

    --Gifts--
    [Kyle]

  5. #5
    TokolocoSK's Avatar
    Join Date
    Feb 2011
    Gender
    male
    Location
    Comendo Peru Pato Frango Búrguer.
    Posts
    2,874
    Reputation
    65
    Thanks
    6,785
    My Mood
    Yeehaw
    Nexon hates me



  6. #6
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,695
    Reputation
    3319
    Thanks
    11,108
    My Mood
    Happy
    Just disable the function or write a jump and that should solve a lot of detection problems

    And Nexon has a lot of weird strings that they check for.


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


  7. #7
    Shadow`'s Avatar
    Join Date
    Nov 2011
    Gender
    male
    Location
    MN
    Posts
    643
    Reputation
    74
    Thanks
    2,999
    My Mood
    Relaxed
    Quote Originally Posted by Flengo View Post
    Just disable the function or write a jump and that should solve a lot of detection problems

    And Nexon has a lot of weird strings that they check for.
    I believe this guy already did that :3
    Currently coding applications in Java and C++.

    "It is change, continuing change, inevitable change, that is the dominant factor in society today. No sensible decision can be made any longer without taking into account not only the world as it is, but the world as it will be." -Isaac Asimov

  8. #8
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,695
    Reputation
    3319
    Thanks
    11,108
    My Mood
    Happy
    Quote Originally Posted by Shadow` View Post
    I believe this guy already did that :3
    Yeah I saw that a while ago too.

    Not going to look at it, gonna find more in with this. If its derived from a class, there could be more checks in there

    Oh well. I'll post it here with a scan once I do.


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


Similar Threads

  1. [Help Request] Strings in CShell.dll
    By _corn_ in forum Crossfire Coding Help & Discussion
    Replies: 7
    Last Post: 01-06-2013, 04:20 AM
  2. wanna know whats in cshell.dll ??? look here
    By lolz2much in forum Combat Arms Discussions
    Replies: 133
    Last Post: 11-20-2009, 11:31 PM
  3. Give me Cshell.dll
    By Katie_Perry in forum Combat Arms Discussions
    Replies: 15
    Last Post: 09-26-2009, 04:28 AM
  4. CShell.dll is malware packer.
    By XGelite in forum Combat Arms Discussions
    Replies: 4
    Last Post: 09-10-2009, 04:21 PM
  5. lol how do you use engine.rar and cshell.dll
    By czudej in forum Combat Arms Hacks & Cheats
    Replies: 6
    Last Post: 01-17-2009, 07:18 PM