MPGHThe Dark Arts
RegisterLog in

C++ GAMEGUARD SOURCE

Posts 1–15 of 31 · Page 1 of 3
C++ GAMEGUARD SOURCE


Here the full source to bypass GG all you need to do is change a addresses put all if you want too.. Open CE view memory address of gameMOD64.des and put all important address to terminate GG....


Code:
#include <windows.h>
#include <time.h>
#include "blowfish.h"

/////////////////////////////////////////////////////////////////////////
// GameGuard Namespace
// Description:
//        The namespace for GameGuard.
namespace GameGuard
{

/////////////////////////////////////////////////////////////////////////
// Blowfish inclusions
// Description:
//        For proper linking to blowfish functions
extern"C"
{
void Blowfish_Init(BLOWFISH_CTX *bf_CTX, unsignedchar *gg_pKey, int keyLen);
void Blowfish_Encrypt(BLOWFISH_CTX *bf_CTX, unsignedlong *xl, unsignedlong *xr);
void Blowfish_Decrypt(BLOWFISH_CTX *bf_CTX, unsignedlong *xl, unsignedlong *xr);
};

/////////////////////////////////////////////////////////////////////////
// INCA Salt
// Description:
//        The salt used by INCA with blowfish.
#define INCA_SALT "@SAU^T2*KY"

/////////////////////////////////////////////////////////////////////////
// GameGuard Key Struct
// Description:
//        The structure of the GameGuard packet.
typedefstruct GG_AUTH
{
unsignedlong dwIndex;
unsignedlong dwValue1;
unsignedlong dwValue2;
unsignedlong dwValue3;
}GG_AUTH,*PGG_AUTH;

/////////////////////////////////////////////////////////////////////////
// GameGuard Key Table
// Description:
//        Used in portions of the key generation.
staticlongint GG_KEY_TABLE[] =
{
        0x00478CAB, 0x0047D130, 0x00478E3C, 0x0047DC1F, 0x00475D40, 
        0x0047FA7B, 0x004764A5, 0x0047E7F4, 0x00477A8E, 0x0047FC4F, 
        0x00476D0B, 0x0047ED9A, 0x00477803, 0x00481662, 0x00476CDC, 
        0x00481361, 0x00476019, 0x00483348, 0x00477D9B, 0x004802BF, 
        0x004795AB, 0x0047AC70, 0x00477C74, 0x0047D072, 0x00477D63, 
        0x0047f0c7, 0x00474f2d, 0x0047c3d5, 0x004781b3, 0x0047eae1, 
        0x0047842a, 0x0047ff17, 0x00476afa, 0x0047f9e0, 0x00474d99, 
        0x004823d0, 0x004775c5, 0x004827f5, 0x00478d6e, 0x00482f9e, 
        0x00475d2d, 0x0047b02f, 0x00475fc1, 0x0047c98b, 0x004750b4, 
        0x0047ce4b, 0x00475b01, 0x0047d7a0 
};

/////////////////////////////////////////////////////////////////////////
// GameGuard Class
// Description:
//        Used to generate keys to send to the server.
    class CGameGuard
{
    protected:
        BLOWFISH_CTX blowfish_CTX;

/////////////////////////////////////////////////////////////////////////
// blowfish_Encrypt()
// Description:
//        Recreation of the encryption which uses the generic blowfish by INCA.
void blowfish_Encrypt(unsignedlong *pInKey);

/////////////////////////////////////////////////////////////////////////
// blowfish_Decrypt()
// Description:
//        Recreation of the decryption which uses the generic blowfish by INCA.
void blowfish_Decrypt(unsignedlong *pInKey);

/////////////////////////////////////////////////////////////////////////
// inca_FunctionDemangle()
// Description:
//        A recursive function called within the keygen used for demangling the index.
unsignedint inca_FunctionDemangle(unsignedint iIndex, unsignedint iLevel);

/////////////////////////////////////////////////////////////////////////
// inca_Rand()
// Description:
//        INCA's own version of rand().
longint inca_Rand();

    public:
/////////////////////////////////////////////////////////////////////////
// gameguard_KeyGen()
// Description:
//        The keygenerations for the server auth key from INCA.
        GG_AUTH gameguard_KeyGen(unsignedlong *pInKey);

/////////////////////////////////////////////////////////////////////////
// CGameGuard()
// Description:
//        The initialization to this class.
        CGameGuard();

/////////////////////////////////////////////////////////////////////////
// ~CGameGuard()
// Description:
//        The deconstructor to this class.
        virtual ~CGameGuard(){}
};


};




Code:
#include "GameGuard.h"

GameGuard::CGameGuard::CGameGuard()
{
    srand(time(NULL));
    memset(&blowfish_CTX, 0, sizeof(blowfish_CTX));
    Blowfish_Init(&blowfish_CTX, (unsignedchar*)INCA_SALT ,10);    
}

void GameGuard::CGameGuard::blowfish_Decrypt(unsignedlong *pInKey)
{
    Blowfish_Decrypt(&blowfish_CTX, &pInKey[1],&pInKey[3]);
    pInKey[2] ^= 0x64D84A;
    pInKey[3] ^= 0xF0F4C802;
    Blowfish_Decrypt(&blowfish_CTX, &pInKey[0],&pInKey[2]);
    pInKey[0] ^= 0xFD3A9D;
    pInKey[1] ^= 0x9D2DB902;
}


void GameGuard::CGameGuard::blowfish_Encrypt(unsignedlong *pInKey)
{
    pInKey[0] ^= 0xAFD349D;
    pInKey[1] ^= 0x9D28B918;
    Blowfish_Encrypt(&blowfish_CTX, &pInKey[0],&pInKey[2]);
    pInKey[2] ^= 0xB64D24A;
    pInKey[3] ^= 0xF674C8B9;
    Blowfish_Encrypt(&blowfish_CTX, &pInKey[1],&pInKey[3]);
}

unsignedint GameGuard::CGameGuard::inca_FunctionDemangle(unsignedint iIndex,unsignedint iLevel)
{
int iPtr14 = 0x61;
int iPtr18 = 0x62;
int iPtr1c = 0x63;
int iPtr20 = 0x64;
int iPtr24 = 0x45;
int iPtr4 = 0x46;
int iPtr8 = 0x47;
int iPtrc = 0x5A;

int itemporaryValue;

int edx = iLevel % 0xA;

int iFinal = 0;

if(edx == 1)
{
        itemporaryValue = iPtr14;
do
{
            iIndex -= itemporaryValue;
            iIndex++;
            itemporaryValue--;
}while(itemporaryValue > 0);
}
elseif(edx == 2)
{
        iIndex -= iPtr18;
        iIndex += iPtrc - iPtr14;
if( !(iLevel % 2))
            iIndex--;
}
elseif(edx == 3)
{
        iIndex++;
        iIndex -= iPtr20 * iPtrc;
        iIndex += 100;
}
elseif(edx == 4)
{
        itemporaryValue = iPtr18;
do
{
            iIndex += itemporaryValue;
            iIndex--;
            itemporaryValue--;
}while(itemporaryValue > 0);
}
elseif(edx == 5)
        iIndex -= (iPtr20 & iPtr8);
elseif(edx == 6)
        iIndex += (iPtr24 & iPtrc);
elseif(edx == 7)
{
        iIndex -= iPtr14 + iPtrc;
        iIndex += iPtr20;
}
elseif(edx == 8)
{
        itemporaryValue = iPtr1c;
do
{
            iIndex -= itemporaryValue;
            iIndex--;
            itemporaryValue--;
}while(itemporaryValue > 0);
}
elseif(edx == 9)
{
if( iLevel % 3)
{
if( iLevel %3 == 1)
                iIndex++;
else
                iIndex -= 2;
}
else
            iIndex--;
}
else
{
if(iLevel % 2)
            iIndex -= iPtr4 | iPtr1c;
else
            iIndex -= iPtr8 | iPtr24;
}

if(iLevel >= 2)
        iFinal = inca_FunctionDemangle(iIndex,iLevel-2);
else
        iFinal = iIndex;

return iFinal;
}

longint GameGuard::CGameGuard::inca_Rand()
{
longint iResult = 0;
for(int i = 0; i<8; i++)
{
longint m_temporaryValue = rand();
          m_temporaryValue = m_temporaryValue%0x10;
          iResult |= m_temporaryValue<<(i<<2);
}
return result;
}

GameGuard::GG_AUTH GameGuard::CGameGuard::gameguard_KeyGen(unsignedlong *pInKey)
{
    GameGuard::GG_AUTH gg_finalKey;

unsignedint itemporaryValue;
unsignedint iIndex;

unsignedshort itempVar1 = 8;
unsignedshort itempVar2 = 1;
unsignedchar *keyPtr1;
unsignedchar *keyPtr2;
unsignedchar keyPTR;

    blowfish_Decrypt(pInKey);

while(itempVar1)
{
        keyPtr1 = (unsignedchar *)pInKey;
        keyPtr2 = (unsignedchar *)pInKey + itempVar2;

for(unsignedshort i = 0; i < itempVar1; i++)
{
for(unsignedshort j = 0; j < itempVar2; j++)
{
                keyPTR = (keyPtr1[0] ^ keyPtr2[0]);

if(keyPTR & 0x80)
{
                    keyPTR *= 2;
                    keyPTR ^= 0xA9;
}
else
                    keyPTR *= 2;

                keyPtr1[0] ^= keyPTR;
                keyPtr1++;
                keyPtr2[0] ^= keyPTR;
                keyPtr2++;
}

            keyPtr1 += itempVar2;
            keyPtr2 += itempVar2;
}

        itempVar1 >>= 1;
        itempVar2 <<= 1;
}

    itemporaryValue = pInKey[2];
    pInKey[2] = pInKey[3];
    pInKey[3] = itemporaryValue;
    itemporaryValue = pInKey[1];
    pInKey[1] = pInKey[0];
    pInKey[0] = itemporaryValue;
    pInKey[0] = pInKey[3] ^ itemporaryValue;


unsignedlong pOutKey[4];

    pOutKey[0] = 0x10056;
    pOutKey[1] = inca_Rand();
    pOutKey[2] = inca_Rand();
    pOutKey[3] = inca_Rand();

if(pInKey[0])
{
        iIndex = pInKey[0];
        iIndex = GameGuard::GG_KEY_TABLE[(iIndex-1)%0x30];
}

    iIndex = inca_FunctionDemangle(iIndex, (pInKey[0]-1)%0x14+10);

for(unsignedint iPtr2C = 0; (iPtr2C <= pInKey[0]) && (pInKey[0] <= 0x3E8); iPtr2C++)
{
        iIndex = iIndex - 2 + (pInKey[2] ^ pInKey[3]) % 3;
}

/* Credits To Gene In This Portion - Polymorphic a bit of it needs to be changed */
    itemporaryValue = pInKey[2]-0x35f3a386;
    itemporaryValue ^= 0xad5656c6;
    itemporaryValue += 0xd97e3d52;
    itemporaryValue -= 0xdfe08b35;
    itemporaryValue += 0x1c9f236d;
    itemporaryValue ^= 0x03f74ad0;

    pOutKey[1]    = itemporaryValue;
    pOutKey[2]    = itemporaryValue ^ 0xf8805824;
/* End Credits to Gene */

    itemporaryValue = pOutKey[0] ^ pOutKey[3];
    pOutKey[3] = pOutKey[2] ^ pOutKey[1];
    pOutKey[2] = itemporaryValue;
    itemporaryValue = pOutKey[0] ^ pOutKey[1];
    pOutKey[0] = pOutKey[1];
    pOutKey[1] = itemporaryValue;

    blowfish_Encrypt(pOutKey);

    gg_finalKey.dwIndex  = pOutKey[0];
    gg_finalKey.dwValue1 = pOutKey[1];
    gg_finalKey.dwValue2 = pOutKey[2];
    gg_finalKey.dwValue3 = pOutKey[3];

return gg_finalKey;

}





Code:
 *

#include "blowfish.h"

extern "C"
{
    void Blowfish_Init(BLOWFISH_CTX *ctx, unsigned char *key, int keyLen);
    void Blowfish_Encrypt(BLOWFISH_CTX *ctx, unsigned long *xl, unsigned long *xr);
    void Blowfish_Decrypt(BLOWFISH_CTX *ctx, unsigned long *xl, unsigned long *xr);
};

#define INCA_SALT "@SAU^T2*KY"
#define LOG_FILE "GGDestroyer.txt"

BLOWFISH_CTX blowfish_CTX;
void Log(const char* lpcFmt, ...){
    char szBuf[0x4000];
    va_list vaArgs;
    va_start(vaArgs, lpcFmt);
    _vsnprintf(szBuf, sizeof(szBuf), lpcFmt, vaArgs);
    va_end(vaArgs);
    szBuf[0x4000-1] = 0;
    
    FILE* f = fopen(LOG_FILE,"a");
    fprintf(f,szBuf);
    fclose(f);
}

static long int keytable_a[] = 
{ 
    0xBB81C25F, 0x7B59CD33, 0x2CEEA53C, 0xA6F6D818, 0xB3CC25D6, 0x939EA3AA, 0xA80E9B0C, 0x89F289A9, 0x33754F81, 0xD4F3D2E7, 
    0xDFE08B35, 0xDB52D835, 0xC332A8E9, 0xD7EFE273, 0x591BEF5D, 0x129D4B53, 0xEB6DB874, 0xE40B4BD5, 0xA0084DFE, 0xB62B4B9B, 
    0x02AD07BD, 0xB3CE8586, 0x3A2E2E70, 0x31A46056, 0xA26B0C29, 0xABA0270D, 0x9115FA79, 0x3981123B, 0x512E4042, 0x35299AD2, 
    0x4B464853, 0x1859E8A2, 0x985E3B9F, 0xF9C2567D, 0xA03882B6, 0x54754C14, 0xDE946598, 0x6F12F367, 0x6A634E08, 0x867CC428, 
    0xAD5656C6, 0xFF72F827, 0xE05FF5C3, 0x15D6D946, 0x7B1F75B0, 0x3178CF46, 0xB9852F7E, 0x9B4B03F7, 0xD1545CCF, 0x9C9EFE2A, 
    0x4E7C4492, 0x8EC4DAB1, 0x47AF6199, 0xA96CFE6D, 0x27ADEBA6, 0x5748B50F, 0x35673D88, 0xE0495767, 0xCC9F8E22, 0x9E3F3D66, 
    0x23243733, 0xC9DD91CE, 0xB4DA939E, 0xBBF2CA50, 0xB87FF903, 0xCC8023FC, 0x68C6A373, 0x4528F454, 0x3EBFE99F, 0x70CA9668, 
    0x710C2548, 0xB63933FA, 0x5B7C905F, 0x5F3453BB, 0x35F3A386, 0x94AE1E9B, 0x784F86CC, 0xDF46EF5C, 0x4C3393C3, 0x68ED1FCE, 
    0x1C9F236D, 0x8976E5C3, 0x20258E69, 0x9A91AC1B, 0xC1D40FBA, 0xE44EBC89, 0x476FFC00, 0xB12F5EEB, 0x0DA7913B, 0x6A35DB14, 
    0x3B6C550E, 0x37119DD5, 0x497F6269, 0x81C4DBFE, 0x62A1210D, 0xA2EEF041, 0x0DC4FACB, 0xD27134AF, 0x64A80774, 0x7B2FE0D8, 
    0xE11FB1DA, 0xD5C76EAE, 0xBBD840CC, 0x3A3AF6F1, 0x3CD62F1C, 0xF23BF183, 0xCEDA959C, 0x67A99824, 0xA8B4DB1B, 0xC14754A6, 
    0x24255B5C, 0x79F45FEA, 0x9B0E4E3F, 0xB9821090, 0x46210D85, 0xE9B1B2BA, 0x8E5EE01F, 0x5354ADE8, 0xBC6632AD, 0x4F4A2B1C, 
    0x092B4913, 0x17569306, 0xEE6D613F, 0x13473088, 0x93FDD1D3, 0x8DEF5A63, 0x63AD03B0, 0xCD1E5A87, 0xA65D20B7, 0x2DA779A6, 
    0xA5BEA0AA, 0xE5591190, 0xC8A2BD58, 0x6E077A37, 0x3AF9B094, 0xF270FD3B, 0x6287F12E, 0xD976C38F, 0x9B05CAE6, 0x6DF955F1, 
    0x1C5C64AF, 0xE69CFD34, 0x3F4A4829, 0xBE4EE239, 0x5EB1AE55, 0x2DD17FB1, 0xA051C0E4, 0x7D060C8C, 0x9F0B06B7, 0x06BED38B, 
    0x54A1CB8F, 0x22AA4B70, 0x59E3364E, 0x19BA9F2C, 0xD5A2B1A3, 0x34A1177F, 0x22C09480, 0xDD5E2C1B, 0x99FD19B7, 0x3C8908F0, 
    0x832AA9F8, 0xBB1102D0, 0x29097D23, 0x92C8859C, 0xE38AFD1B, 0x3B7BC9F4, 0x0C5E5390, 0xEEF927CA, 0xDC66F863, 0xF504E9DE, 
    0xAC643475, 0xA87D6602, 0xC4494177, 0x4025D907, 0x9FB4784A, 0x47DCBACD, 0x44A831AF, 0xD6652215, 0x4EC5C687, 0x45AF9BA2, 
    0xD48D7094, 0x0D5C5C62, 0x412088B5, 0x484D9019, 0xECEF56AD, 0x5E53DF96, 0x003B445B, 0x995E329A, 0xF4C68B72, 0x51012307, 
    0x128073E2, 0xEF3BEABE, 0xA33B677C, 0x8DCEDF5F, 0xE1A79DE1, 0x848B3DDC, 0x43957112, 0x5C336DF6, 0x03F74AD0, 0x2EB6A68D, 
    0x8A8C42FC, 0x54C74362, 0xF108E247, 0x2635AC47, 0xC1695282, 0xFEF20A1D, 0x2262FC9F, 0x04AFB6A4, 0x8FD3194D, 0xC23C19AE, 
    0x208D015F, 0x607C6D0C, 0x5E421EB5, 0x382E0A8E, 0x61D2891F, 0x92253905, 0xB42FCB50, 0xD7304333, 0x7FF90C38, 0x31309209, 
    0x1A11B6A8, 0x19E86D48, 0xC0580251, 0xC6271FA0, 0xF8805824, 0x94C0E012, 0xED79F2E2, 0xCA722A50, 0xF6F4395C, 0xA13F343B, 
    0x5DD36564, 0x92B85983, 0x6BE6D0C9, 0xE7CDE12A, 0x8AFFC34E, 0xE94125D0, 0xF9DDA7D2, 0xD0F36E77, 0x0A54A428, 0x16B506B0, 
    0x0E42341F, 0xE258448B, 0x467A807A, 0xB09D73AA, 0x1BBCF019, 0xA744FCFD, 0xD6D9DEBD, 0x30400626, 0xB0A37337, 0x95600B25, 
    0x22FA1868, 0x2E6635BC, 0x64AF2511, 0x2413FCBC, 0xC164E404, 0xF25879D5, 0x91199D20, 0xDEF53609, 0x2D8F9B27, 0x33BD5A18, 
    0xDD8835DB, 0x4A6F40B4, 0xDCF4D42C, 0x5AFD50DE, 0x9184A3CA, 0xCF08C336, 0x571AF998, 0xE081E2AD, 0x65763066, 0x06480706, 
    0x1589A0F5, 0x6B0F8A1F, 0xB1F58436, 0x57A8B4AC, 0xA0AA43DA, 0x43A2CE8C, 0x1C7916B2, 0x6AAF2190, 0x7E14589F, 0x02AF279A, 
    0x006B5062, 0x96C5075B, 0x194F67DD, 0x4EC01CA3, 0xF362D8CF, 0x6482BF64, 0xF7B4FA0B, 0x51C6275F, 0x7EE61750, 0x6D6FBF44, 
    0xA1EA7791, 0xE12CCE14, 0xF86F859E, 0x16E3AF71, 0xAE497827, 0x57768B5C, 0x0B66A91F, 0xEA87D985, 0x68796326, 0x2A14E4BE, 
    0x1D620D3D, 0x60D1F3D8, 0x75F3D116, 0xE49E51A3, 0xB8EC2780, 0x0F3B57F1, 0x4E2E497D, 0x1B8B5CA2, 0x626B709E, 0x504DAB78, 
    0x6B9325C5, 0x28438B33, 0x937780C1, 0xDB6D48B5, 0x44C8FB85, 0xA37E38DE, 0xC598CFB1, 0xF835B550, 0x70374436, 0x0475190C, 
    0x9EF7C4D4, 0x3F1D8CC2, 0x6978985E, 0xD2EE7744, 0x588B0994, 0x27AB3373, 0xA5E15F67, 0x8724092F, 0xB98CF499, 0x4A593309, 
    0xBD2C10F9, 0xA9DC2903, 0x1A931E49, 0x0E9E14EE, 0x0891556A, 0xB1605D7A, 0xF2170F2E, 0xFC034E99, 0x20D68445, 0x27572E0C, 
    0xEBA01EBF, 0x8B1F5893, 0x8B55262F, 0x822A141F, 0x6BB7F475, 0x454ACC63, 0xB386C371, 0x4C50974D, 0xEBB30AE6, 0xB01C0081, 
    0x2E0FE2A4, 0xFB613F0E, 0xE34CC68D, 0x450E9D75, 0x654AFD50, 0x08D563C8, 0x0BDAC1DF, 0x8CA70BC8, 0xFFCE8AFB, 0x0B25BC25, 
    0x9AE68266, 0xED50D1D1, 0x460402FF, 0x6CE8A29C, 0x4AF77399, 0xF0AF7938, 0xE0820DF3, 0xB277AD96, 0x71861AF0, 0x2C2E7976, 
    0x46C30360, 0x766835AA, 0xA81A0014, 0x0A354AF2, 0xF05C7BCD, 0x1045F140, 0x673B9D5C, 0x026B7454, 0x6697DE92, 0x28763AF0, 
    0x35417950, 0xBC478EF5, 0x2F1BB557, 0x1691A833, 0x8CD50B89, 0x9044E27C, 0xA5609595, 0x7210A380, 0xE27ECC5E, 0x15D72641, 
    0x7EEFE9B3, 0xC36AB360, 0xC0844567, 0xC49AB3DD, 0x132F384A, 0x72286069, 0xBEA10C2C, 0x15F511C7, 0xFBB8F9D0, 0x07C121E5, 
    0x24397916, 0x907EE887, 0xA003B5CF, 0x0ACD9F8C, 0xA9D726BC, 0xBD9F8F95, 0x9887F4AF, 0xF3A502A4, 0xB7F38987, 0x04DF707A, 
    0x5DDC2E06, 0x49EF12E7, 0xC4142C0E, 0x0CB741AD, 0x556BDB5E, 0x850646AD, 0x69A275B9, 0x2EBD7BB7, 0x29BA720F, 0x2F8F188C, 
    0x0D450C10, 0xE25B760F, 0x40449CBF, 0xBFE4EEFE, 0x3A665BBC, 0xE019D92D, 0x249EA1D8, 0xBDBC617A, 0x668CD9F4, 0x7F8E0E99, 
    0x5B2239E1, 0x905FF989, 0x2B201D60, 0x49029BEC, 0x4E77BC63, 0xD2562DA2, 0xFFD98099, 0xB42DF97D, 0x8505B2D5, 0x0948675D, 
    0x4AFFBAE6, 0x4978B0E4, 0x8855B2BF, 0xAE8D3D12, 0x961A13FF, 0x805A47AA, 0xDEFE3589, 0x28BE386A, 0x89B3323D, 0xF06B3826, 
    0xE14993CC, 0x1142C0CC, 0x6D619017, 0x03140900, 0x47EC74FF, 0xFFA16DB1, 0xE88CA635, 0x3FDB23B0, 0x79315FAA, 0x3B74A6C1, 
    0x53BDE900, 0x2D4B2EBF, 0xEED0AE36, 0x5D220451, 0x656BE40F, 0x35D97284, 0x202FF74A, 0xED33F0FC, 0x780E2EBA, 0xEF0FA8A8, 
    0xA5C8C33E, 0x632FF03A, 0x023F1E99, 0xC2543492, 0xF7228AAB, 0x467FAC82, 0xBC654D25, 0x484192DA, 0x8CC6C3F8, 0x1FAA5E5C, 
    0xDE1833E5, 0xF75D49E8, 0xED2BF8CD, 0x4739BC40, 0x10B05852, 0x5800D146, 0x91B9AF83, 0x63A22FC7, 0xC9E62402, 0xD3E2C178, 
    0x021941A1, 0xFE802F49, 0x93213E5F, 0x0F5C830A, 0xC6C166CF, 0x6F38446C, 0xE4DA00D1, 0x55E5AD51, 0x462B7556, 0x4D44069B
};

void init()
{
    srand((unsigned int)time(NULL));
    memset(&blowfish_CTX, 0, sizeof(blowfish_CTX));
    Blowfish_Init(&blowfish_CTX, (unsigned char*)INCA_SALT ,10);    
}

long int inca__rand()
{
    long int res = 0;
    for(int i = 0; i<8; i++)
    {
          long int temp = rand();
          temp = temp%0x10;
          res |= temp<<(i<<2);
    }
    return res;
}

void blowfish__decrypt(unsigned long *key)
{
    Blowfish_Decrypt(&blowfish_CTX, &key[1],&key[3]);
    key[2] ^= 0x64D84A;
    key[3] ^= 0xF0F4C802;
    Blowfish_Decrypt(&blowfish_CTX, &key[0],&key[2]);
    key[0] ^= 0xFD3A9D;
    key[1] ^= 0x9D2DB902;
}


void blowfish__encrypt(unsigned long *key)
{
    key[0] ^= 0xAFD349D;
    key[1] ^= 0x9D28B918;
    Blowfish_Encrypt(&blowfish_CTX, &key[0],&key[2]);
    key[2] ^= 0xB64D24A;
    key[3] ^= 0xF674C8B9;
    Blowfish_Encrypt(&blowfish_CTX, &key[1],&key[3]);
}

unsigned long get_index(char* key)
{
    unsigned long keyone = 0;
    unsigned long keytwo = 0;
    unsigned long keythree = 0;
    unsigned long keyfour = 0;

    sscanf(key,"%X %X %X %X",&keyone,&keytwo,&keythree,&keyfour);

    unsigned long keys[4] = { keyone, keytwo, keythree, keyfour };
    blowfish__decrypt(keys);
    return keys[0];
}

unsigned long* inca__keygen(unsigned long* inkey)
{
    unsigned short first = 8;
    unsigned short second = 1;
    unsigned int temp;
    unsigned int index;
    unsigned char* ptr1;
    unsigned char* ptr2;
    unsigned char ptr;
    unsigned long* outkey = (unsigned long*)malloc(4*4);

    blowfish__decrypt(inkey);
    
    if(inkey[0] == 0x000)
    {
        // static key
        outkey[0] = 0xd5091f33;
        outkey[1] = 0x7ea484fa;
        outkey[2] = 0xbb6d43d1;
        outkey[3] = 0xbee38f18;
        return outkey;
    }
    else
    {
        while(first)
        {
            ptr1 = (unsigned char*)inkey;
            ptr2 = (unsigned char*)inkey+second;
            
            for (unsigned short i = 0; i < first; i++)
            {
                for (unsigned short j = 0; j < second; j++)
                {
                    ptr = (ptr1[0] ^ ptr2[0]);

                    if (ptr & 0x80)
                    {
                        ptr *= 2;
                        ptr ^= 0xA9;
                    }
                    else
                        ptr *= 2;

                    ptr1[0] ^= ptr;
                    ptr1++;
                    ptr2[0] ^= ptr;
                    ptr2++;
                }
            
                ptr1 += second;
                ptr2 += second;
            }
        
            first >>= 1;
            second *= 2;
        }

        temp = inkey[2];
        inkey[2] = inkey[3];
        inkey[3] = temp;
        temp = inkey[1];
        inkey[1] = inkey[0];
        inkey[0] = inkey[3] ^ temp;
        
        outkey[0] = 0x10056;
        outkey[1] = inca__rand();
        outkey[2] = inca__rand();
        outkey[3] = inca__rand();

        Log("INDEX: %x\n",inkey[0]);

        // fuck u Themida Virtual Machine.
        switch(inkey[0])
        {
        case 0x001:
        {
            DWORD GlobalVal1 = 0xA2EEF041;
            DWORD GlobalVal2 = 0x35673D88;
            DWORD GlobalVal3 = 0xA65D20B7;
            DWORD GlobalVal4 = 0xF7228AAB;
            DWORD GlobalVal5 = 0xFFD98099;
            DWORD GlobalVal6 = 0x1F000059;
            DWORD GlobalVal7 = 0xF1CFBE7F;

            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;

            TempVal1 = inkey[3] - GlobalVal1;
            TempVal1 = TempVal1       - GlobalVal2;
            TempVal2 = TempVal1       + 0x4270D0F0;
            TempVal1 = TempVal1       + GlobalVal3;

            TempVal2 = GlobalVal4     - TempVal2;
            TempVal1 = TempVal2       - GlobalVal5;
            TempVal2 = TempVal2       + GlobalVal6;
            TempVal1 = TempVal1       + GlobalVal7;
            
            outkey[1] = TempVal2;
            outkey[2] = TempVal1;
            break;
        }
        case 0x00C:
        {
            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;
            DWORD TempVal3 = 0x00;

            TempVal1 = inkey[2] ^ 0xA0084DFE;
            TempVal2 = TempVal1 - 0x9C9EFE2A;
            TempVal1 = 0xDFE08B35 - TempVal1;
            TempVal1 = TempVal1 + 0xC921EEB5;
            TempVal3 = 0x70CA9668 - 0x12CC72A5;

            TempVal1 += 2;

            TempVal2 = TempVal1 - 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;

            break;
        }
        case 0x012:
        {
            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;

            TempVal1 = inkey[3] + 0x49167F43;
            TempVal1 = TempVal1 + 0xF9C2567D;
            TempVal1 = TempVal1 - 0xDF46EF5C;
            TempVal1 = TempVal1 + 0xF7AC72B1;
            TempVal2 = TempVal1 & 0x476FFC00;
            TempVal2 = TempVal2 ^ 0x30400626;
            TempVal2 = TempVal2 - 0x3EBFE99F;
            TempVal2 = TempVal2 + 0x6A01E805;
            
            outkey[3] = TempVal1;
            outkey[1] = TempVal2;

            break;
        }
        case 0x021:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 - 0x9C9EFE2A;

            TempVal1 += 0xDFE08B35;
            TempVal1 += 0xA6ED8601;

            DWORD TempVal3 = 0x70CA9668 + 0x2284AE0D;
            TempVal1 += 2;

            TempVal2 = TempVal1 - 0x6DDF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            outkey[3] = TempVal1;
            outkey[1] = TempVal2;

            break;
        }
        case 0x013:
        {
            DWORD GlobalVal1 = 0xA0084DFE;
            DWORD GlobalVal2 = 0x9C9EFE2A;
            DWORD GlobalVal3 = 0xDFE08B35;
            DWORD GlobalVal4 = 0x6330DC47;
            DWORD GlobalVal5 = 0x70CA9668;
    
            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;
            DWORD TempVal3 = 0x00;

            TempVal1 = inkey[2] - GlobalVal1;
            TempVal2 = TempVal1       + GlobalVal2;
            TempVal1 = TempVal1       ^ GlobalVal3;
            TempVal1 = TempVal1       + GlobalVal4;
            TempVal3 = GlobalVal5     - 0x6D399CCC;
 
            TempVal1 += 2;

            TempVal2 = TempVal1 - TempVal3;
            
            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x014:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 + 0x9C9EFE2A;

            TempVal1 += 0xDFE08B35;
            TempVal1 += 0x021180ED;

            DWORD TempVal3 = 0x70CA9668 - 0x0A549B92;

            TempVal1 += 2;

            TempVal2 = TempVal1 + 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            inkey[1] = TempVal1;
            inkey[3] = TempVal2;

            break;
        }

        case 0x017:
        {
            DWORD GlobalVal1 = 0xA0084DFE; 
            DWORD GlobalVal2 = 0x9C9EFE2A; 
            DWORD GlobalVal3 = 0xDFE08B35; 
            DWORD GlobalVal4 = 0x3097ABA4; 
            DWORD GlobalVal5 = 0x70CA9668; 
            DWORD GlobalVal6 = 0x6DF955F1; 
            
            DWORD TempVal1 = 0x00; 
            DWORD TempVal2 = 0x00; 
            DWORD TempVal3 = 0x00; 
            
            TempVal1 = inkey[2] - GlobalVal1;     
            TempVal2 = TempVal1 ^ GlobalVal2; 
            TempVal1 = TempVal1 ^ GlobalVal3; 
            TempVal1 = TempVal1 + GlobalVal4; 
            TempVal3 = GlobalVal5 ^ 0xD149E53C; 
            TempVal1 = TempVal1 + 2; 
            TempVal2 = TempVal1 - TempVal3; 
            
            outkey[1] = TempVal1; 
            outkey[3] = TempVal2; 
            break;
        }
        case 0x011:
        {
            DWORD TempVal1 = 0x0A;
            DWORD TempVal2 = 0x14;
            DWORD TempVal3 = 0x1E;

            TempVal1 = inkey[2] + 0xA65D20B7;
            TempVal1 += 0x20258E69;
            TempVal1 |= 0x1011;

            TempVal3 = 0x7B2FE0D8 ^ 0x750D34FF;
            DWORD TempVal4 = TempVal1 ^ TempVal3;
            
            TempVal1 |= 0x7FF90C38;
            TempVal1 += 0x556A4AD7;

            TempVal2 = keytable_a[TempVal4 % 0x1F4] ^ TempVal1;
            TempVal2 += 1;

            outkey[3] = TempVal2;
            outkey[1] = TempVal1;
            break;
        }
        case 0x02A:
        {
            DWORD GlobalVal1 = 0xA65D20B7;
            DWORD GlobalVal2 = 0x20258E69;
            DWORD GlobalVal3 = 0x7B2FE0D8;
            DWORD GlobalVal4 = 0x7FF90C38;
            DWORD GlobalVal5 = 0x96E21B47;
            DWORD GlobalVal6 = 0x5850FF75; 

            DWORD TempVal1 = 0x0A;
            DWORD TempVal2 = 0x14;
            DWORD TempVal3 = 0x1E;

            TempVal1 = inkey[2] + GlobalVal1;
            TempVal1 += GlobalVal2;
            TempVal1 |= 0x1011;

            TempVal3 = GlobalVal3 - 0x0FC2B42;

            DWORD GlobalVal = TempVal1 ^ TempVal3;

            TempVal1 |= GlobalVal4;
            TempVal1 += GlobalVal5;

            TempVal2 = keytable_a[GlobalVal % 0x1F4] + TempVal1;
            TempVal2 += GlobalVal6;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x028:
        {
            DWORD GlobalVal1 = 0xA65D20B7;
            DWORD GlobalVal2 = 0x20258E69;
            DWORD GlobalVal3 = 0x7B2FE0D8;
            DWORD GlobalVal4 = 0x7FF90C38;
            DWORD GlobalVal5 = 0x85D3D618;
            DWORD GlobalVal6 = 0x5850FF75;

            DWORD TempVal1 = 0x0A;
            DWORD TempVal2 = 0x14;
            DWORD TempVal3 = 0x1E;

            TempVal1 = inkey[2] + GlobalVal1;
            TempVal1 = TempVal1 - GlobalVal2;
            TempVal1 |= 0x1011;

            TempVal3 = 0x6A68EC6A - GlobalVal3;
            DWORD TempAddress = TempVal1 - TempVal3;

            TempVal1 |= GlobalVal4;
            TempVal1 = TempVal1 + GlobalVal5;

            TempVal2 = keytable_a[TempAddress % 0x1F4];
            TempVal2 = TempVal2 - TempVal1;

            TempVal2 += GlobalVal6;

            outkey[3] = TempVal2;
            outkey[1] = TempVal1;        
            break;
        }
        case 0x006:
        {
            DWORD TempVal1 = inkey[2] - 0xA0084DFE;
            DWORD TempVal2 = TempVal1 ^ 0x9C9EFE2A;
            TempVal1 ^= 0xDFE08B35;
            TempVal1 += 0x30B6CC64;

            DWORD TempVal3 = 0x70CA9668 ^ 0xD149E53C;
            TempVal1 += 2;
            TempVal2 = TempVal1 ^ 0x6DF955F1;
            TempVal2 = TempVal1 - TempVal3;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x008:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 - 0x9C9EFE2A;
            
            TempVal1 += 0xDFE08B35;
            TempVal1 += 0xD677BA21;

            DWORD TempVal3 = 0x70CA9668 - 0x54F31548;
            TempVal1 += 2;

            TempVal2 = TempVal1 - 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x015:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 - 0x9C9EFE2A;
            TempVal1 += 0xDFE08B35;
            TempVal1 += 0xA6ED8601;
            DWORD TempVal3 = 0x70CA9668 + 0x2284AE0D;

            TempVal1 += 2;
            TempVal2 = TempVal1 - 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            //346BAC9D
            //27587C40
        
            outkey[1] = TempVal1;
            outkey[3] = TempVal2;

            break;
        }
        case 0x01F:
        {
            DWORD GlobalVal1 = 0x35F3A386;
            DWORD GlobalVal2 = 0xAD5656C6;
            DWORD GlobalVal3 = 0x51300592;
            DWORD GlobalVal4 = 0xDFE08B35;
            DWORD GlobalVal5 = 0x1C9F236D;
            DWORD GlobalVal6 = 0x03F74AD0;
            DWORD GlobalVal7 = 0xF8805824;

            DWORD TempVal1 = inkey[2] - GlobalVal1;
            
            TempVal1 -= GlobalVal2;
            TempVal1 += GlobalVal3;
            TempVal1 ^= GlobalVal4;
            TempVal1 ^= GlobalVal5;
            TempVal1 ^= GlobalVal6;

            DWORD TempVal2 = TempVal1 - GlobalVal7;
            outkey[1] = TempVal1;
            outkey[2] = TempVal2;
            break;
        }
        }
        

        temp = outkey[0] ^ outkey[3];
        outkey[3] = outkey[2] ^ outkey[1];
        outkey[2] = temp;
        temp = outkey[0] ^ outkey[1];
        outkey[0] = outkey[1];
        outkey[1] = temp;

    }

    blowfish__encrypt(outkey);

    return outkey;
}

unsigned long* inca__keygen(char* key)
{
    unsigned long keyone = 0;
    unsigned long keytwo = 0;
    unsigned long keythree = 0;
    unsigned long keyfour = 0;

    sscanf(key,"%X %X %X %X",&keyone,&keytwo,&keythree,&keyfour);

    unsigned long inkey[4] = { keyone, keytwo, keythree, keyfour };

    return inca__keygen(inkey); 
}





HERE THE FULL SOURCE CODE TO BYPASS GG CHANGE THE OLD HOOD ADDRESS

Hacking Requirements



  • A Brain
  • Hands
  • A little tiny bit knowledge on hacking.


Credit by: mauka

READ MY WIKI
#1 · edited ·
May i ask what is gameMOD64.des ?

I am new sorry!
#2 ·
Quote Originally Posted by limweijie99 View Post
May i ask what is gameMOD64.des ?

I am new sorry!
if you using hack like Dll in bs and then it say detected what is mean of that you already know the answer
#3 ·
Quote Originally Posted by COD3RIN View Post

if you using hack like Dll in bs and then it say detected what is mean of that you already know the answer
How do i select that process? Sorry, i just want to bypass it! I cant find the proccess
#4 ·
Quote Originally Posted by limweijie99 View Post
How do i select that process? Sorry, i just want to bypass it! I cant find the proccess
I released the addies. Go and check it out.
#5 ·
Quote Originally Posted by limweijie99 View Post
How do i select that process? Sorry, i just want to bypass it! I cant find the proccess
what process is that?
#6 ·
Quote Originally Posted by COD3RIN View Post

what process is that?
Open CE view memory address of gameMOD64.des

This part, i don't get it!

What process should i select?
#7 · edited ·
Quote Originally Posted by Caezer99 View Post
I released the addies. Go and check it out.
i test your address but not working i tested it about my trainer that is post i view the gamemod64 but in never see anything i terminate the assembler code but it was not there......
#8 ·
Quote Originally Posted by limweijie99 View Post
Open CE view memory address of gameMOD64.des

This part, i don't get it!
run the launcher first and open CE search for gamemod64.des and check the memory view
#9 ·
Quote Originally Posted by COD3RIN View Post

run the launcher first and open CE search for gamemod64.des and check the memory view
Oh okay. Thanks ! I go try now

EDIT :

I don't know how to do this (Facepalm)

I guess i will just have to giveup...
#10 · edited ·
Quote Originally Posted by limweijie99 View Post
Oh okay. Thanks ! I go try now

EDIT :

How do i search for gamemod64.des

Sorry again!I'm a noob at hacking ><
there is no noob here only a leecher

use process hacker first and suspended blackshot before you open CE
#11 ·
Quote Originally Posted by COD3RIN View Post

there is no noob here only a leecher

use process hacker first and suspended blackshot before you open CE
Do you have skype? Can you be my teacher to teach me these?

Anyway, do i do next!
#12 ·
Quote Originally Posted by limweijie99 View Post
Do you have skype? Can you be my teacher to teach me these?

Anyway, do i do next!
i am busy in my work and beside no time to play blackshot
#13 ·
Quote Originally Posted by COD3RIN View Post

i am busy in my work and beside no time to play blackshot
Okay... I really want to hack... Thats why : (
#14 ·
Quote Originally Posted by limweijie99 View Post
Okay... I really want to hack... Thats why : (
Ok try fleep tutorial in youtube how to hack
#15 ·
Posts 1–15 of 31 · Page 1 of 3
This thread is closed for replies.

Similar Threads

GeneralCS Source Clan/ServerDave84311Dave84311 20 CounterStrike (CS) 1.6 Hacks / Counter Strike: Source (CSS) HacksCounter Strike: SourceFlawlessFlawless 15 Hack RequestsGameGuardTojeKunTojeKun 11

Tags for this Thread

#full code
Need help?