Bypassing and hooking GameGuard
There are 2 ways to bypass GameGuard
this is the 1st one..
To bypass SSDT hook, you do it by allocating a section of memory to the size of KeServiceDescriptorTable->TableSize*4. TableSize returns the number of entries and you multiply that by four because each entry is 4 bytes long. So anyway, once you've got your memory allocated you copy the original table into the new table and then change the tables base address to that of the new address. And you do the same for the shadow table.
http://img266.imageshack.us/img266/2141/6d387684pp3.png
If GameGuard is so arrogant on the address of ServiceTable base address, we can change it, without them knowing. So this is what I will do:
1. Allocate KeServiceDescriptorTable->TableSize*sizeof( PVOID ) byte of memory
2. Copy KeServiceDescriptorTable->ServiceTable into the memory
3. Set KeServiceDescriptorTable->ServiceTable to point to the memory.
4. Wait for GameGuard to load, they will hook the memory allocated instead of the real SSDT
5. Restore KeServiceDescriptorTable->ServiceTable with the original address.
6. Do the same to KeServiceDescriptorTableShadow….
Ok thats what i got soo far:
credits: the_undead, ******ph and Surpintine
Another way..
Now on to what you've been waiting for
Here goes:
==========================
1) Download the Old GG Version
to get old GG you will have to redownload rakion and get the GG files BEFORE you update the game.
2) Extract the old GG files to the GameGuard Folder (NOTE: don't forget to back-up, just in case)
3) Select all GG files in the folder (including the hidden one)
4) Right-Click on any of the files-> Then click Properties
5) Select Read Only, then hit OK
6) Download PC Protect
7) Install (if you haven't done so already) PC Protect
8) (-=OPTIONAL=-)Patch PC Protect to unlock full version
9) Select all the GG files
10) Right Click on any of the files-> Mouse over PC Protect (this is only available after you install PC Protect) ->Click on Lock (in all 3 tabs select "Read-only") and hit OK
What all this does:
With the locked in files, GameGuard will try to update by downloading the files, however since all the files are read-only locked and cannot be overwritten, the Gameguard will just download the files and not do anything with them. However since the GG files are still considered to be proper, gameguard will consider them as the new ones. Now the only way they can stop this is to literally introduce a new version of the game
A few things I have noticed:
-------------------------
Occasionally you will notice that the game will exit saying something about the GameGuard folder, contact your administrator, bla bla bla.... Now unless you want to contact the GM and tell him that you're Bypassing Gameguard, preventing Gameguard from updating, hacking, and modifying the game, I suggest you just ignore this warning. It doesn't affect your gameplay at all (besides the fact you gotta re-load MU again)
--------------------------
You must have PC Protect running at all times, or the game will say "Gamehack detected" and boot you out of the game. This is why I recommend updating the Optional step 8 so that the program will always work (instead of expiring after 30 days)
just got this from other sites, (i hope im not breaking any rules here)
credits: romerdir047
http://www.virustotal.com/file-scan/...97a-1298082621
pcprotect.rar - Jotti's malware scan
this is the 1st one..
To bypass SSDT hook, you do it by allocating a section of memory to the size of KeServiceDescriptorTable->TableSize*4. TableSize returns the number of entries and you multiply that by four because each entry is 4 bytes long. So anyway, once you've got your memory allocated you copy the original table into the new table and then change the tables base address to that of the new address. And you do the same for the shadow table.
http://img266.imageshack.us/img266/2141/6d387684pp3.png
If GameGuard is so arrogant on the address of ServiceTable base address, we can change it, without them knowing. So this is what I will do:
1. Allocate KeServiceDescriptorTable->TableSize*sizeof( PVOID ) byte of memory
2. Copy KeServiceDescriptorTable->ServiceTable into the memory
3. Set KeServiceDescriptorTable->ServiceTable to point to the memory.
4. Wait for GameGuard to load, they will hook the memory allocated instead of the real SSDT
5. Restore KeServiceDescriptorTable->ServiceTable with the original address.
6. Do the same to KeServiceDescriptorTableShadow….
Ok thats what i got soo far:
Code:
ULONG size;
unsigned realTable;
NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
{
DbgPrint("Driver Loaded!");
PVOID *faekTable; size = KeServiceDescriptorTable->TableSize*4;
realTable = (unsigned)KeServiceDescriptorTable->ServiceTable;
faekTable = ExAllocatePoolWithTag(0, size, 0x31323334);
memcpy(faekTable, KeServiceDescriptorTable->ServiceTable, size);
(unsigned)KeServiceDescriptorTable->ServiceTable = (unsigned)&faekTable; //Found GG //Sleep(20000); (unsigned)KeServiceDescriptorTable->ServiceTable = realTable;
return STATUS_SUCCESS;
}
Another way..
Now on to what you've been waiting for
Here goes:
==========================
1) Download the Old GG Version
to get old GG you will have to redownload rakion and get the GG files BEFORE you update the game.
2) Extract the old GG files to the GameGuard Folder (NOTE: don't forget to back-up, just in case)
3) Select all GG files in the folder (including the hidden one)
4) Right-Click on any of the files-> Then click Properties
5) Select Read Only, then hit OK
6) Download PC Protect
7) Install (if you haven't done so already) PC Protect
8) (-=OPTIONAL=-)Patch PC Protect to unlock full version
9) Select all the GG files
10) Right Click on any of the files-> Mouse over PC Protect (this is only available after you install PC Protect) ->Click on Lock (in all 3 tabs select "Read-only") and hit OK
What all this does:
With the locked in files, GameGuard will try to update by downloading the files, however since all the files are read-only locked and cannot be overwritten, the Gameguard will just download the files and not do anything with them. However since the GG files are still considered to be proper, gameguard will consider them as the new ones. Now the only way they can stop this is to literally introduce a new version of the game
A few things I have noticed:
-------------------------
Occasionally you will notice that the game will exit saying something about the GameGuard folder, contact your administrator, bla bla bla.... Now unless you want to contact the GM and tell him that you're Bypassing Gameguard, preventing Gameguard from updating, hacking, and modifying the game, I suggest you just ignore this warning. It doesn't affect your gameplay at all (besides the fact you gotta re-load MU again)
--------------------------
You must have PC Protect running at all times, or the game will say "Gamehack detected" and boot you out of the game. This is why I recommend updating the Optional step 8 so that the program will always work (instead of expiring after 30 days)
just got this from other sites, (i hope im not breaking any rules here)
credits: romerdir047
http://www.virustotal.com/file-scan/...97a-1298082621
pcprotect.rar - Jotti's malware scan
pcprotect.rar
Originally Posted by Alen
He said he took it from elsewhere...
