Punkbuster Strings

I have a hotkey, and i hit it during gameplay...

Are you getting kicked or banned, and what reason does PB state?

blah i didnt pay attention that T.T
im running out of email addresses LOL

Originally Posted by *Marneus901*

blah i didnt pay attention that T.T
im running out of email addresses LOL

XD, Okay, well heres the problem. Everytime you logg pb, you get a constant Desc(String, third param, w\e you want to call it).

E.X I may log PB's MemCheck one time and get

A Scan

IEAX : 14878020

count : 56
STRING : B* d3d8.dll 10347 1_8bff558bec6aff6858c1aa6d64a10000
---------------------------------

Then close warrock, read it, and get a constant array of A Scan.
Then I start my next scan after rebooting warrock and rehooking, which I will name B Scan

B Scan

IEAX : 14878020

count : 56
STRING : B* J+
---------------------------------

And I get a constant array of B Scan. Etc.. However, what I think is happening is when where hooking the function, for some reason its not getting a reply from where ever it send it to, or something is wrong, thus it send it again(which would explain the array of the same string), and again, and again, after a while with no reply, it sent T6009. Again and again. Then kicked\banned us for : No Reply from PB queries.

Now what explains that Scan A and Scan B have a different strings? Well, if where hooking it at different times, its executing different commands at different times, thus when we hook it, its stuck at the command it was attempting to execute.

Overall, if we want a real log, where going to have figure out whats stopping the message from being sent\received.

meh, with what ive learned about detouring, doesnt it just NOP the first like 5 bytes to put in an unconditional JMP to our own function?
so....

Code:

.text:10055FC5                 push    ebp
.text:10055FC6                 lea     ebp, [esp-43Ch]

were fucking up these two lines... which may have something to do with it? so... thats why i was wondering if a DetourWithTrampoline() would have a better effect... or so i think, maybe i read it wrong (i was high, suprizingly, i code better in that state). But from what i do remember, the trampoline like puts the two lines of code into your own function, but at the end, then calls the third line of the original function...

Is there a way, that we can find out were the info is being stored, then just read the memory without having to detour? And then just strcpy from that address to our own string, then loggin the string?

Nevermind, DetourWithTrampoline wouldn't work.

Yea, i re-read up on it, i was obviously too high to remember now... anyways... You know of any other way? What is this "PB Logger" that i keep hearing about? I heard that it doesnt detour the function, but still logs the strings?

Well, with my other theory, with the MD5 thingy... the original MD5 of the PBCL.dll is - f2222ea29755b78dc00ce40db164a722
Which seems to be the right amount of characters for the PB Strings were looking at... sooo... which one of the corrupt MD5's are we looking for?
The MD5 hash for WarRock.exe is - 2c271d8e628357118a7742569ea9ffe8
So, one sec... Ah, well, i dont see the MD5 hash for WarRock.exe anywere in the log... So... i *think* PB checks itsself before the rest of the games modules...

Gah. I can't think strait right now, I'm going to get some rest, will take this up in the morning? In the meantime, I'm going to play around with this and do some research on PB.

Aight, i was going to do the same after i watch some Zoids =P (An old favorite TV show)

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 4
STRING : BC0
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : Dw"WR_US_18_2692364498" 9
---------------------------------

IEAX : 14878020

count : 26
STRING : T9006
---------------------------------

IEAX : 14878020

count : 26
STRING : T9006
---------------------------------

In my log : Dw"WR_US_18_2692364498" 9
Warrock.Exe's CRC is 2692364498 =0, so now we hook that, if the first
two chars are Dw in the third param, we return Dw"WR_US_18_2692364498" 9 Thats how you'd bypass the CRC check. Still doesn't explain how we can fix our kicks. But, what the fuck, I thought PB used MD5 Check's, so I'm probably wrong, just pointing it out if it means anything. Ugh, whatever, I'll figure this shit out tomorrow.

Well, we got that to bypass WarRocks memory check/MD5 check, now we just need one for the PBCL.dll

Good find though

didnt notice at first glance lol

The only problem i ran across is...
Dw"WR_US_18_2692364498" 9
how are we going to write the (") when the if statement would look like this...

Code:

		if(strcmp(Dest, "Dw"WR_US_18_??????????" 9")
			strcpy(Dest, "Dw"WR_US_18_2692364498" 9");

Similar to that at least, considering ? wont cut it.
Because, well, you cant use " in a string, itll cause syntax errors...

Ah, maybe we could use File I/O and write the string - Dw"WR_US_18_2692364498" 9 - to a text file, read from it, and initialize a string with that.
Then, just do

Code:

if(strcmp(Dest, "Dw"))
strcpy(Dest,newString);//were newString holds the string from the text file....

Originally Posted by *Marneus901*

Well, we got that to bypass WarRocks memory check/MD5 check, now we just need one for the PBCL.dll

Good find though

didnt notice at first glance lol

The only problem i ran across is...
Dw"WR_US_18_2692364498" 9
how are we going to write the (") when the if statement would look like this...

Code:

        if(strcmp(Dest, "Dw"WR_US_18_??????????" 9")
            strcpy(Dest, "Dw"WR_US_18_2692364498" 9");

Similar to that at least, considering ? wont cut it.
Because, well, you cant use " in a string, itll cause syntax errors...

\" Usually adding a \ will fix most of these issues.

Here's what I wrote.

blah, nvm, sorry, that was my coding >_>

But anyways, i need my sleep to. Ill be back tommorrow morning hopefully. Im feeling ub3r tired. Dam sex T.T

if(Dest[2] == '\"')
strcpy(Dest,"\"Dw\"WR_US_18_2692364498\" 9\"");

See you tomorrow, I'm packing in.

lol, no it was yours, you forgot a ) in your if statement

Code:

	if(strcmp((char*)Dest[2], """))
	strcpy(Dest,""Dw"WR_US_18_2692364498" 9");

btw, you had to typecast the Dest[2], because it was a char then, rather than comparing with a char*.

Punkbuster Strings

Post a Reply

Similar Threads

Tags for this Thread