[Help] Real Vindictus Hacking

Real Vindictus Hacking

So... I'm just gunna start right at Ollydbg.

I've decided to delete the HShield folder, and trace the error.

I traced the error...

Code:

CPU Disasm
Address   Hex dump          Command                                  Comments
00402930  /$  8B4C24 04     MOV ECX,DWORD PTR SS:[ARG.1]             ; Vindictus.00402930(guessed Format...)
00402934  |.  8D4424 08     LEA EAX,[ARG.2]
00402938  |.  50            PUSH EAX
00402939  |.  51            PUSH ECX
0040293A  |.  68 00080000   PUSH 800
0040293F  |.  68 00080000   PUSH 800
00402944  |.  68 F8E74F00   PUSH OFFSET 004FE7F8                     ; ASCII "HackShield Update - Failed, HSUpdate.env ??? ???? ????
"
00402949  |.  E8 E0120800   CALL 00483C2E
0040294E  |.  68 F8E74F00   PUSH OFFSET 004FE7F8                     ; /Arg1 = ASCII "HackShield Update - Failed, HSUpdate.env ??? ???? ????
"
00402953  |.  E8 48FFFFFF   CALL 004028A0                            ; \Vindictus.004028A0
00402958  |.  83C4 18       ADD ESP,18
0040295B  \.  C3            RETN

Checked all the calls/jumps
Found it doing this:

Code:

CPU Disasm
Address   Hex dump          Command                                  Comments
004032DB     /0F85 A8000000 JNE 00403389
004032E1  |. |68 D03D4D00   PUSH OFFSET 004D3DD0                     ; Format = "CheckVersionAndDoPatch - OK
"
004032E6  |. |C745 FC FFFFF MOV DWORD PTR SS:[LOCAL.1],-1
004032ED  |. |E8 3EF6FFFF   CALL 00402930

Swapped JNE to JE obviously to test, and no error, but vindictus does not continue to run... am I going the wrong way with this ?

Not sure if you can simply stop hackshield

Originally Posted by Nico

Not sure if you can simply stop hackshield

I would imagine so, there is a whole slew of case tests further down.. just push them to success offsets and hackshield already running.. I'll post it up when I debug a bit more.

Code:

CPU Disasm
Address   Hex dump          Command                                  Comments
00402BC0  /.  8B4C24 04     MOV ECX,DWORD PTR SS:[ARG.1]
00402BC4  |.  81F9 00010000 CMP ECX,100                              ; Switch (cases 0..803, 35. exits)
00402BCA  |.  B8 88364D00   MOV EAX,OFFSET 004D3688
00402BCF      7F 48         JG SHORT 00402C19
00402BD1  |.  74 40         JE SHORT 00402C13
00402BD3  |.  83F9 07       CMP ECX,7
00402BD6  |.  0F87 50010000 JA 00402D2C
00402BDC  |.  FF248D 302D40 JMP DWORD PTR DS:[ECX*4+402D30]
00402BE3  |>  B8 54364D00   MOV EAX,OFFSET 004D3654                  ; UNICODE "Function call successful.", case 0 of switch Vindictus.402BC4
00402BE8  |.  C3            RETN
00402BE9      B8 10364D00   MOV EAX,OFFSET 004D3610                  ; UNICODE "An unknown HSError has occurred."
00402BEE  |.  C3            RETN
00402BEF  |>  B8 E8354D00   MOV EAX,OFFSET 004D35E8                  ; UNICODE "Invalid parameter.", case 2 of switch Vindictus.402BC4
00402BF4  |.  C3            RETN
00402BF5      B8 90354D00   MOV EAX,OFFSET 004D3590                  ; UNICODE "HackShield module has not been initialized."
00402BFA  |.  C3            RETN
00402BFB  |>  B8 20354D00   MOV EAX,OFFSET 004D3520                  ; UNICODE "The current process is running in compatibility mode.", case 4 of switch Vindictus.402BC4
00402C00  |.  C3            RETN
00402C01  |>  B8 68344D00   MOV EAX,OFFSET 004D3468                  ; UNICODE "After uninitialization has been performed, it must be initialized after rerunning the game.", case 5 of switch Vindictus.402BC4
00402C06  |.  C3            RETN
00402C07  |>  B8 20344D00   MOV EAX,OFFSET 004D3420                  ; UNICODE "Unicode string conversion failed.", case 6 of switch Vindictus.402BC4
00402C0C  |.  C3            RETN
00402C0D  |>  B8 EC334D00   MOV EAX,OFFSET 004D33EC                  ; Case 7 of switch Vindictus.402BC4
00402C12  |.  C3            RETN
00402C13  |>  B8 C0334D00   MOV EAX,OFFSET 004D33C0                  ; UNICODE "Invalid license key.", case 100 of switch Vindictus.402BC4

Code:

CPU Disasm
Address   Hex dump          Command                                  Comments
00402C19  |> \81F9 00020000 CMP ECX,200
00402C1F  |.  7F 4E         JG SHORT 00402C6F
00402C21  |.  74 46         JE SHORT 00402C69
00402C23  |.  81C1 FFFEFFFF ADD ECX,-101
00402C29  |.  83F9 07       CMP ECX,7
00402C2C  |.  0F87 FA000000 JA 00402D2C
00402C32  |.  FF248D 502D40 JMP DWORD PTR DS:[ECX*4+402D50]
00402C39  |>  B8 40334D00   MOV EAX,OFFSET 004D3340                  ; UNICODE "Invalid file has been installed. Please reinstall the program.", case 101 of switch Vindictus.402BC4
00402C3E  |.  C3            RETN
00402C3F  |>  B8 F0324D00   MOV EAX,OFFSET 004D32F0                  ; UNICODE "Failed to start the HackShield driver.", case 102 of switch Vindictus.402BC4
00402C44  |.  C3            RETN
00402C45  |>  B8 80324D00   MOV EAX,OFFSET 004D3280                  ; UNICODE "Another game or process is already using HackShield.", case 103 of switch Vindictus.402BC4
00402C4A  |.  C3            RETN
00402C4B  |>  B8 20324D00   MOV EAX,OFFSET 004D3220                  ; UNICODE "HackShield module has already been initialized.", case 104 of switch Vindictus.402BC4
00402C50  |.  C3            RETN
00402C51  |>  B8 70314D00   MOV EAX,OFFSET 004D3170                  ; UNICODE "Debugger has been detected on your computer. Stop running the debugger and try again.", case 105 of switch Vindictus.402BC4
00402C56  |.  C3            RETN
00402C57  |>  B8 28314D00   MOV EAX,OFFSET 004D3128                  ; UNICODE "Executable file code is cracked.", case 106 of switch Vindictus.402BC4
00402C5C  |.  C3            RETN
00402C5D  |>  B8 E4304D00   MOV EAX,OFFSET 004D30E4                  ; UNICODE "ADMIN privileges are required.", case 107 of switch Vindictus.402BC4
00402C62  |.  C3            RETN
00402C63  |>  B8 B8304D00   MOV EAX,OFFSET 004D30B8                  ; Case 108 of switch Vindictus.402BC4
00402C68  |.  C3            RETN
00402C69  |>  B8 50304D00   MOV EAX,OFFSET 004D3050                  ; UNICODE "Unable to start the hack program detection engine.", case 200 of switch Vindictus.402BC4

Code:

CPU Disasm
Address   Hex dump          Command                                  Comments
00402C6F  |> \81F9 01030000 CMP ECX,301
00402C75  |.  7F 48         JG SHORT 00402CBF
00402C77  |.  74 40         JE SHORT 00402CB9
00402C79  |.  81C1 FFFDFFFF ADD ECX,-201
00402C7F  |.  83F9 06       CMP ECX,6
00402C82  |.  0F87 A4000000 JA 00402D2C
00402C88  |.  FF248D 702D40 JMP DWORD PTR DS:[ECX*4+402D70]
00402C8F  |>  B8 00304D00   MOV EAX,OFFSET 004D3000                  ; UNICODE "HackShield service is already running.", case 201 of switch Vindictus.402BC4
00402C94  |.  C3            RETN
00402C95  |>  B8 B02F4D00   MOV EAX,OFFSET 004D2FB0                  ; UNICODE "Cannot create a HackShield driver file.", case 202 of switch Vindictus.402BC4
00402C9A  |.  C3            RETN
00402C9B  |>  B8 682F4D00   MOV EAX,OFFSET 004D2F68                  ; UNICODE "Cannot register HackShield driver.", case 203 of switch Vindictus.402BC4
00402CA0  |.  C3            RETN
00402CA1  |>  B8 282F4D00   MOV EAX,OFFSET 004D2F28                  ; UNICODE "Cannot start HackShield driver.", case 204 of switch Vindictus.402BC4
00402CA6  |.  C3            RETN
00402CA7  |>  B8 D02E4D00   MOV EAX,OFFSET 004D2ED0                  ; UNICODE "HackShield test thread cannot be started.", case 205 of switch Vindictus.402BC4
00402CAC  |.  C3            RETN
00402CAD  |>  B8 802E4D00   MOV EAX,OFFSET 004D2E80                  ; Case 206 of switch Vindictus.402BC4
00402CB2  |.  C3            RETN
00402CB3  |>  B8 382E4D00   MOV EAX,OFFSET 004D2E38                  ; Case 207 of switch Vindictus.402BC4
00402CB8  |.  C3            RETN
00402CB9  |>  B8 F02D4D00   MOV EAX,OFFSET 004D2DF0                  ; UNICODE "HackShield service is not running.", case 301 of switch Vindictus.402BC4

Rather then just to disable hackshield, I would rather love to see you get rid of the debugger protection.

Originally Posted by DanK

Rather then just to disable hackshield, I would rather love to see you get rid of the debugger protection.

That is a bit more complex.

HelpReal Vindictus Hacking

Similar Threads

Tags for this Thread