
Originally Posted by
muriwo
Hey there,
Thanks for taking the time to analyse my tool!
First things first,
yes, I deliberately did NOT upload the v3.0.0 here on MPGH to sort of distance my tool from the real "cheats", as that got mentioned alot on reddit / realmeye. That is the only reason version 3.0.0 is not here to beginn with.
Regarding the virustotal false-positives: I am not sure why they fire, but at least 2 of them are due to the ping checker (which opens alot of tcp/ip connections to the realmeye servers on an "uncommon" port (game port is 2050) - real icmp-pings are blocked by the servers).
The other ones I can't explain, but I do vouche that all my releases are NO malware / virus / trojan or similar.
After all, the whole source code is open for everyone to look into or even fork it and make your own version with my EAM as it's base.
The Notification center is the GUI for the daily logins, it shows you the current progress / status of it. That's actually all.
EDIT:
I just saw that 8 of that 10 detections come form the "EAM Notification Center.exe" - which is ridiculous to say the least - haha.
After checking the code again (which is only about 300 lines btw.), I am still not quite sure why. But let me take an educated guess here:
1. There is a timer on it, which first checks if the "EAM Daily Login Service.exe" is running (so, monitoring the process)
- That step is to ensure the Notification Center closes itself if it is not needed anymore / check if the daily logins failed.
2. If the process is found, the real work is starting: Check if a file with the current login state exsits, if yes read it, deserialize that data and update the GUI accordingly.
So the only "suspicious" looking stuff (imo) going on here is the process monitoring.
But as I said, this is only a guess - even though the tool itself does not alot more than that alongside using the Windows-API to send Windows-Toast notifications like this one:
EDIT_END
And I don't really understand your last question "where does it send the uploaded info?", so I take a guess at the meaning of it:
All your data is saved localy ONLY, it is even encrypted via the Windows Data Protection API.
The only time your email and password are "send" is during the token generation, which is necessary.
The process works like this:
- EAM (as well as the deca-launcher) does an API-Request to "https://www.realmofthemadgod.com/account/verify" with parameters (including your email, password and HWID) - all just URL-Encoded.
- The Server answers (on successfull authentication) with some information (including accountname, the login-tokens etc.)
- EAM / Deca-Launcher stores these data (at least the token)
- Upon User request to start the game, the Unity-Client is started with certain parameters - including the token.
Other Web-Requests require the login-token as user authentication (for example: "https://www.realmofthemadgod.com/char/list")
The EAM only makes requests to official deca servers OR my git-repository (like the Notification Messages found in "ExaltAccountManager/NotificationMessages/" (Can't link you here as the site (git) is not allowed to mention).
To sum it up: EAM does NOT send any data to non deca-official websites. It only requests data from deca-official sites, with one exception: my git repository (for notification messages, 3 Vault peeker files (hash of the other 2 files to compare, items.cfg and renders.png - both are used as the name suggests as metadata for the items of rotmg) or the download of the HWID-Tool).
I hope that answered all your questions about my tool, if you still have new ones, please just ask.
Happy to answer on my dc aswell, if you prefere faster way of communication.
Best regards,
Maik8