New method bypass client error 28_3 and 31_0, shorter :D

Posts 115 of 35 · Page 1 of 3
New method bypass client error 28_3 and 31_0, shorter :D
This bypass is the shortest, i think
Bypass 28_3:
Code:
Pattern: 83 F8 FF 0F 84 ?? ?? ?? ?? 56 50 E8
105D1C2A      | 83 F8 FF                 | cmp eax,-01                             |
105D1C2D      | C7 44 24 14 00 00 00 00  | je 105D1E2A                             |
105D1C33      | 56                       | push esi                                |
105D1C34      | 50                       | push eax                                |
105D1C35      | E8 86 CD DB FF           | call 1038E9C0                           | -> function called to check
105D1C3A      | 8B F0                    | mov esi,eax                             |
105D1C3C      | 83 C4 04                 | add esp,04                              |
105D1C3F      | 85 F6                    | test esi,esi                            |
105D1C41      | 0F 84 E2 01 00 00        | je 105D1E29                             | He's here, now change je -> jmp
105D1C4D      | D9 86 58 10 00 00        | fld dword ptr [esi+00001058]            |
105D1C54      | 0F B6 86 BC 0B 00 00     | movzx eax,byte ptr [esi+00000BBC]       |
Bypass 31_0:
Code:
Pattern: 53 50 8B 42 2C FF D0
105D261E      | 83 C4 08                 | add esp,08                              |
105D2621      | 85 C0                    | test eax,eax                            |
105D2623      | 74 48                    | je 105D266D                             | He's here, change into "jmp 105D2637 + 4F"
105D2625      | 8B 0D A4 4F C0 10        | mov ecx,[10C04FA4]                      |
105D262D      | 8B 11                    | mov edx,[ecx]                           |
105D2631      | 8D 5C 24 10              | lea ebx,[esp+10]                        |
105D2636      | 05 70 17 00 00           | add eax,00001770                        |
105D2637      | 53                       | push ebx                                | -> Search return here. Value=105D2637+4F
105D2638      | 50                       | push eax                                |
105D1C54      | 8B 42 2C                 | mov eax,[edx+2C]                        |
.....////.... |                          |                                         |
105D2637 + 4F | 5F                       | pop edi                                 |
Have fun! Thanks if i helped!
Test CFVN:
cshell.dll+572623 - jmp cshell.dll+572636 + 4F

cshell.dll+571C35 + C - jmp cshell.dll+571E29
Other way for bypass client error 31_0
Code:
10572659  	|.  6A 10         	|push    0x10
1057265B  	|.  FFD0          	|call    eax
1057265D  	|.  50            	|push    eax                             ; |src
1057265E  	|.  57            	|push    edi                             ; |dest
1057265F  	|.  FF15 8C269110 |call    dword ptr [0x1091268C]          ; \strncpy
10572665  	|.  83C4 0C       	|add     esp, 0xC
10572668  	|.  EB 03         	|jmp     short 1057266D
1057266A  	|>  C607 0A       	|mov     byte ptr [edi], 0xA
1057266D  	|>  B8 01000000  |mov     eax, 0x1
10572672  	|.  0046 19       	|add     byte ptr [esi+0x19], al
10572675  	|.  83C5 20       	|add     ebp, 0x20
10572678  	|.  83C7 10       	|add     edi, 0x10
1057267B  	|.  294424 14     	|sub     dword ptr [esp+0x14], eax
1057267F   |  90                  |nop
10572680   |   90                 |nop
10572681   |  90                  |nop
10572682   |  90                  |nop
10572683   |  90                  |nop
10572684   |  90                  |nop
10572685  	|.  5F            	|pop     edi
10572686  	|.  5E            	|pop     esi
10572687  	|.  5D            	|pop     ebp
10572688  	|.  5B            	|pop     ebx
10572689  	|.  81C4 D8000000|add     esp, 0xD8
1057268F  	\.  C3            	|retn
Thanks for share!
Quote Originally Posted by thanhhan31 View Post
Other way for bypass client error 31_0
Code:
10572659  	|.  6A 10         	|push    0x10
1057265B  	|.  FFD0          	|call    eax
1057265D  	|.  50            	|push    eax                             ; |src
1057265E  	|.  57            	|push    edi                             ; |dest
1057265F  	|.  FF15 8C269110 |call    dword ptr [0x1091268C]          ; \strncpy
10572665  	|.  83C4 0C       	|add     esp, 0xC
10572668  	|.  EB 03         	|jmp     short 1057266D
1057266A  	|>  C607 0A       	|mov     byte ptr [edi], 0xA
1057266D  	|>  B8 01000000  |mov     eax, 0x1
10572672  	|.  0046 19       	|add     byte ptr [esi+0x19], al
10572675  	|.  83C5 20       	|add     ebp, 0x20
10572678  	|.  83C7 10       	|add     edi, 0x10
1057267B  	|.  294424 14     	|sub     dword ptr [esp+0x14], eax
1057267F   |  90                  |nop
10572680   |   90                 |nop
10572681   |  90                  |nop
10572682   |  90                  |nop
10572683   |  90                  |nop
10572684   |  90                  |nop
10572685  	|.  5F            	|pop     edi
10572686  	|.  5E            	|pop     esi
10572687  	|.  5D            	|pop     ebp
10572688  	|.  5B            	|pop     ebx
10572689  	|.  81C4 D8000000|add     esp, 0xD8
1057268F  	\.  C3            	|retn
Thanks for share!
I like the shortest way, my way, LOL,
By the way, you have any ideas to bypass 22_1 (onehit)? The function is at cshell.dll+32E4CC, I've bypassed it but the gun can't shoot or 1 bullet /1hp
Quote Originally Posted by thedemons View Post
I like the shortest way, my way, LOL,
By the way, you have any ideas to bypass 22_1 (onehit)? The function is at cshell.dll+32E4CC, I've bypassed it but the gun can't shoot or 1 bullet /1hp
Can you show us how did bypass error please
POP to NOP
10572685 90 90 90 90
1057267F | 90 |nop
10572680 | 90 |nop
10572681 | 90 |nop
10572682 | 90 |nop
10572683 | 90 |nop
10572684 | 90 |nop
10572685 |. 5F |pop edi
10572686 |. 5E |pop esi
10572687 |. 5D |pop ebp
10572688 |. 5B |pop ebx
Good job!
Quote Originally Posted by jhetro1254 View Post
what the string of 28_3?
It has no string bro, just scan the error message box then set break point to trace them
Quote Originally Posted by thedemons View Post
It has no string bro, just scan the error message box then set break point to trace them
do you have a client28_3 for CFPH?
Can you bypass error 30_0 ?
do you have a client28_3 for CFPH?
Give me your cshell.dll and i will give you a client bypass 28_3 for CFPH
Quote Originally Posted by thanhhan31 View Post
Give me your cshell.dll and i will give you a client bypass 28_3 for CFPH
how? i can't send a pm on you.....

- - - Updated - - -

anyone have client28_3 bypass?? i need guide how to find it.....
Quote Originally Posted by jhetro1254 View Post
anyone have client28_3 bypass?? i need guide how to find it.....
Just look up, a little bit, you'll see the post, which guided you the way to do it, noobs
yup im noob thats why im asking cause you dont want to show step by step how to find and get it feeler pro.....
Posts 115 of 35 · Page 1 of 3

Post a Reply

Similar Threads

Tags for this Thread

None

Need help?