XTrap Concept

Hello guys !
Lets discuss some theories of how XTrap works so we can have better chance to to bypass it.
Here is my theory (i drew it bcs it is easier to understand):

My idea is that if HGWC doesn't connect to Z8Games's server it will send hack tool to the client.

We have the lock now we need the key ! Discuss

Or it could be
(CrossFire Server ->) XTrap Client -> XTrap Server -> Z8Games CF server
The XTrap Client sends information about your client to the XTrap Server. It could then forward that information to the Cross Fire server. The XTrap Server could also send whether your client is "good" or "bad" by evaluating this information. The "good" or "bad" mark is sent to the CF server so it can make a decision based on that.

Fact: The packets are sent to XTrap about every 2 minutes. I guess the XTrap Server tells you when to send, and if it receives foul data in return (or nothing at all), it will "tell" the CF server to mark you for hack tool.

I don't feel the HGWC does much.

Originally Posted by TrollerCoaster

maybe... but when hgwc gives me error that it timed oth waiting the xtrap engine i get hack tool so... maybe there are more connection between the servers

what if i we make a Virtual xtrap server who doesn't send report's to HGW or z8 server..
and make Xtrap dll's like the original but with the virtual server?????
seems hard and interesting.

Originally Posted by ..x_X_x..

what if i we make a Virtual xtrap server who doesn't send report's to HGW or z8 server..
and make Xtrap dll's like the original but with the virtual server?????
seems hard and interesting.

seems hour's and hour's of packet recording

This isn't completely correct.

However, an emulator that directly sends packets to the servers (**** made this) isn't legal as far as I know.

i make (C+P and modif am a leency u know) a Virtual xtrap server and work, but dont forget for HGWC ceking file if not u will get"FILE IS CHANGE bla bla bla", and u have to outsmart that.

Originally Posted by derh.acker

This isn't completely correct.

However, an emulator that directly sends packets to the servers (**** made this) isn't legal as far as I know.

ok if this is not completely correct give some advice ? or other theory ? fix the scheme ?

Originally Posted by kmanev073

ok if this is not completely correct give some advice ? or other theory ? fix the scheme ?

XTrapVa.dll and XTrap.xt don't directly contact a XTrap Server.

Originally Posted by derh.acker

XTrapVa.dll and XTrap.xt don't directly contact a XTrap Server.

so how do they speak with HGWC ? there is one main Aniti cheat server?

Originally Posted by derh.acker

This isn't completely correct.

However, an emulator that directly sends packets to the servers (**** made this) isn't legal as far as I know.

The emulator is 100% Legal,Cauz is something you do!
Now if u use it for sending packets to xTrap is not legal cauz you dont have autoritation!!!

Thats 2 Differents things,Emulator & The Use you gift for it!!!

Regards,
Migue

Originally Posted by kmanev073

Hello guys !
Lets discuss some theories of how XTrap works so we can have better chance to to bypass it.
Here is my theory (i drew it bcs it is easier to understand):

My idea is that if HGWC doesn't connect to Z8Games's server it will send hack tool to the client.

We have the lock now we need the key ! Discuss

XtrapVa.Dll
and Xtrap.Xt

They are both communicating with the client, and the client comminucating with them... (i mean double head arrow)
Also, crossfire.exe is start with a special starting parameter (a long brain-fuck code), HGWC.exe start with separate code too... I could start HGWC.exe without patcher_cf.exe but when i started crossfire.exe with the hobo-way (start.bat -> crossfire.exe -longbrainfuckcode) i get error, that the shield not loaded properly (or something similar)...

Well, i'm not the best at theese things but:
What about:
Start CrossFire
Make a copy of the running process's memory as a new process...
The HGWC and other shit still watching the original Cf
And we can interupt the Xtrap injected Dlls from the copy client.
(Its just an idea)

After the latest Cf-Eu bypass, HGWC send spacial packets to the server, so they can catch, if its dont running normally.

Originally Posted by rabir007

XtrapVa.Dll
and Xtrap.Xt

They are both communicating with the client, and the client comminucating with them... (i mean double head arrow)
Also, crossfire.exe is start with a special starting parameter (a long brain-fuck code), HGWC.exe start with separate code too... I could start HGWC.exe without patcher_cf.exe but when i started crossfire.exe with the hobo-way (start.bat -> crossfire.exe -longbrainfuckcode) i get error, that the shield not loaded properly (or something similar)...

Well, i'm not the best at theese things but:
What about:
Start CrossFire
Make a copy of the running process's memory as a new process...
The HGWC and other shit still watching the original Cf
And we can interupt the Xtrap injected Dlls from the copy client.
(Its just an idea)

After the latest Cf-Eu bypass, HGWC send spacial packets to the server, so they can catch, if its dont running normally.

yea i know that "crossfire --HGWSK and after that hash" this is send by the server... but how do xtrapva and xtrap xt speak eachother ?

Originally Posted by kmanev073

yea i know that "crossfire --HGWSK and after that hash" this is send by the server... but how do xtrapva and xtrap xt speak eachother ?

IDK if the both communicating, i meant they communicating with the client (crossfire.exe)

Even if we distanced from CF haxxoring, I'll give you guys a hand. Your concept is total bullshit.

Here, have one I quickly put together just now.

Code:

 _____________________________________________________________________________
| HGWC.exe                                                                    |
|                                                                             |
| => Establishes connection to HGWC server                                    |
| => Receives tons of CRCs of common 'bad tools' and detected hacks           |
| => Validates integrity of .rez files with CRCs from server                  |
| => Receives the HGWC server-key passed as parameter to the game             |
|     - Key is sent in CF's login-packet                                      |
|     - Invalid key -> kick after server selection                            |
| => Launches the game process                                                |
| => Keeps alive connection to HGWC server, regularly sends trivial heartbeat |
|    packets                                                                  |
| => Connection is encrypted with a static key, key is later changed to one   |
|    provided by the server                                                   |
| => Tunnels heartbeat-packets from XTrap.lib/XTrapVa.dll in CF process       |
| => Protocol consists of ~ 35 server- and ~ 15 client-opcodes                |
| => Sending incorrect response packets to the server results in a disconnect |
| => Manages bans of specific kinds (didn't dive into that further, emulated  |
|    whole HGWC/XT anyway, so didn't care about the banning stuff)            |
|_____________________________________________________________________________|
                                     |
                                     |
                                     v
 _____________________________________________________________________________
| crossfire.exe                                                               |
|                                                                             |
| => calls 4 (not sure, but I think it were 4) callbacks to assure XTrap.lib  |
|    is initialized correctly (in WinMain, post window creation, post login,  |
|    WndProc - nopping these prevents XT from loading, DC after ~2 min inc)   |
|  _____________                                                              |
| | XTrap.lib   |                                                             |
|   => Establishes encrypted named pipe connection to HGWC                    |
|   => Loads XTrapVa.dll                                                      |
|   => XT-heartbeat packet generation                                         |
|     - 7 server-, 5 client packet types                                      |
|     - obfuscated opcodes                                                    |
|     - static packet length (0x80 bytes)                                     |
|     - receives check requests from server, generates response data          |
|       validated by the server, so nopping does not help, as the server      |
|       expects correct data (checksums, for instance)                        |
|     - on a special opcode, requests heartbeat data generated by XTrapVa.dll |
|   => Statically linked into crossfire.exe                                   |
|  _____________                                                              |
| | XTrapVa.dll |                                                             |
|   => Generates a heartbeat data block validated by the server when asked    |
|   => Performs actual AC stuff (detour checks, ...)                          |
|_____________________________________________________________________________|

As you can see above, HGWC is not only a tiny part of the AC, but the main gateway between the XT-server and the XT-client, adding some additional functionality. The above 'diagram' is far from being complete. I don't want to provide stuff that kids can turn into an emulator, I just give skilled reversers a hand by showing them the main structure and give them a point to start. Whatever XTrap.xt does, it is not involved in heartbeat generation, so I didn't dive into that any further.

PS: Don't ask me stuff about ****, I won't tell you more than you probably already found out from public sources.
PS2: I typed that together in a few minutes, might add/correct some stuff later. I'm sure I missed something important.

XTrap Concept

Post a Reply

Similar Threads

Tags for this Thread