Dragon Nest SEA: Disable Game Protect Kit patch

[antifoo]

This patch disables GPK (anticheat rootkit) for Dragon Nest SEA (Cherry Credits client).
It works by replacing the Game Protect Kit DLL.

Thought I'd share it in case anyone is interested.

Advantages over game executable patch:
Game .exe does not need to be repatched after updates.

(GPK can be disabled easily by patching the game executable, but I thought this is a nicer way and a longer term solution. Seems this DLL doesn't get updated so often.)

Usage:

1. Make a backup of your GPKitClt.dll just in case.
2. Replace the current GPKitClt.dll with my patched version.
3. Enjoy the game without GPK.

Note: You would probably also want to remove the GPK driver. This patch only prevents it from being used.

File: GPKitClt.dll
Size: 3072 B
CRC-32: cc46e781
MD5: 44cfe63d51b766ae5d99bc4964f2040d
SHA-1: fd36ac794bdffae0fc43bc28a288d20c42d24410

https://www.virustotal.com/file/ead8...is/1329312864/

Detection ratio:	0 / 42
Analysis date:	 2012-02-15 13:34:24 UTC

Source "GPKitClt.cpp":

#include "stdafx.h"

// Compile with /Zl
EXTERN_C BOOL WINAPI _DllMainCRTStartup(HINSTANCE hInstDll, DWORD fdwReason, LPVOID lpvReserved){
	return TRUE;
}

/*
dumpbin /exports "c:\Games\Dragon Nest\GPKitClt.dll"

File Type: DLL

  Section contains the following exports for GPKitClt.dll

    00000000 characteristics
    4B0E44B2 time date stamp Thu Nov 26 10:04:50 2009
        0.00 version
           1 ordinal base
           2 number of functions
           0 number of names

    ordinal hint RVA      name

          1      000010F0 [NONAME]
          2      00001020 [NONAME]

  Summary

        5000 .data
        4000 .data0
        C000 .data1
       A7000 .data2
       13000 .rdata
        1000 .reloc
       90000 .rsrc
       4A000 .text
*/


__declspec(dllexport) void API_init();
__declspec(dllexport) void API_unused();


void func3arg();
void func1arg();


typedef struct{
	void* link;
	void* func3a;
	void* unknown;
	void* func3b;
	void* func1;
} data;


data d;
data *dp;


__declspec(naked dllexport) void API_init()
{
	__asm{
		pop eax
		add esp, 8
		push eax
	}

	dp = &d;
	d.link = &(d.func3a);
	d.func3a = func3arg;
	d.func3b = func3arg;
	d.func1 = func1arg;

	//MessageBoxA(NULL, "API init", "GKP Patch", MB_OK);

	__asm{
		mov eax, dp
		retn
	}
}


__declspec(naked dllexport) void API_unused()
{
	__asm{
		pop eax
		//add esp, 12
		push eax
	}

	//MessageBoxA(NULL, "GPK patch: An unknown/unused GPK API function was called. This will probably cause an error.", "GKP Patch", MB_OK);

	__asm{
		mov eax, 1
		retn
	}
}



__declspec(naked) void func3arg()
{
	__asm{
		pop eax
		add esp, 12
		push eax
		mov eax, 1
		retn
	}
}


__declspec(naked) void func1arg()
{
	__asm{
		pop eax
		add esp, 4
		push eax
		mov eax, 1
		retn
	}
}

[gido]

nice one... waiting to for the attachments to be confirmed by mpgh.

[antifoo]

nice one... waiting to for the attachments to be confirmed by mpgh.

Or you could just compile the DLL your self. ;)
I'll post this direct link for now:

[Pie]

Hashes aren't matching...I'll rescan them myself
https://www.virustotal.com/file/8403...is/1329344657/

---------- Post added at 05:28 PM ---------- Previous post was at 05:20 PM ----------

Approved .

[antifoo]

Hashes aren't matching...I'll rescan them myself
https://www.virustotal.com/file/8403...is/1329344657/
Approved .

Hashes were of the one (and only) file contained in the archive. You can see that virus total gives the same hash for the file inside.
I guess I could have uploaded it without packing. ;)

[Pie]

Hashes were of the one (and only) file contained in the archive. You can see that virus total gives the same hash for the file inside.
I guess I could have uploaded it without packing.

Sorry but you have to scan the whole pack so that the scans have the same hash.

[kapitaninggo]

thanks for this bro.. its working but still under observation...

[cis300]

question xD
what is a + for it?
like i can do Gold hack with cheat engine now?!?!

[Kevin Atienza]

Thankz dude

[Time2hammer]

well done
I try to hack it but can't....
can't make a gold hack