Brauche Hilfe bei nem Tutorial!

[Martin87]

Background

ETPRO gets its GUID from one of your Harddrives.

It does this via an API called DeviceIoControl.

This API has a parameter DWORD dwIoControlCode, this defines what type of data is input and output.

ETPRO calls an undocumented control code at the start of a map, nothing else in the game calls it so we can check
for this control code and know its a GUID call.

This undocumented control code is 0x2d1400 and its called n times depending on the amount of HDDs you have.

Since the control defines what the APIs input and output are we have to analyse it to check what its doing. I've done that for you already: it takes an input string which tells the API what drive to get the info from, for example "\.\PhysicalDrive0". This is enumerated for the number of HDDs you have (hence n calls). The output is a string that returns the HDD model, model no., and HDD serial etc

Here is an example string:
Maxtor 6Y120P0 YAR4Maxtor 6Y120P0.YAR41BW0.33595.3359533150584546202020202020202020202020

The last part is the HDD serial, for this example the HDD serial is 3359533150584546h (20h = space). Lets convert this string into a readable ASCII serial:

So this HDD serial = Y31SXPFE

ETPRO makes this calculation and then performs a 40bit encryption on the serial which is your GUID. It only uses one HDD to make this calc, I didn't research enough but I think it's based on the lowest physical drive number (i.e \.\PhysicalDrive0) but I can't be sure, whatever it is - its the 'dominant' HDD.

Practical - Spoof the GUID

So I'm 2 lazy to do any decryption or other complex procedures
Instead I will perform a 4 byte patch to spoof the GUID.

If we BP on the GUID call and step through a while the GUID will be calculated from the serial. As mentioned I couldn't be bothered to look at this procedure, instead we will attack the code when its most vulnerable:

Just before the GUID is returned in a function a operation like this is performed:

MOV EAX, <addr to GUID str>
...
RETN

Moving a ptr to the string into EAX. So why not instead of moving the real GUID string, just move our own custom string...

MOV EAX, <addr to SPOOF str>

The ugly thing ofc about patching this way is that memory can vary slightly. So I use a byte pattern searcher (credits OGC)

lets do the code:

//dwGuidAddr = a ptr to our custom string
[detour hook]
    if(dwIoControlCode == 0x2d1400)
    {
        // Get module base address
        dwBaseAddr = (DWORD)GetModuleHandleW(_T("cgame_mp_x86.dll"));

        if(dwBaseAddr)
        {
            // Search for GUID func
            dwGUIDFunc = dwFindPattern(dwBaseAddr, 0x15000, (BYTE*)"\x55\x57\x56\x53\x81\xEC\xAC\x00\x00\x00\xE8\x61\xF9\xFF\xFF\x89\xC6","xxxxxxxxxxxxxxxxx");
    
            if(dwGUIDFunc)
            {
                // Create an array for the module base address
                bArr = new BYTE[4];
                *(DWORD*)bArr = dwBaseAddr;  

                // Create a pattern to search for within the GUID func
                sPattern = (char*)malloc(4);
                memcpy(sPattern, "\xB8\xFF\xFF\xFF\xFF", 4); // i.e MOV EAX, ????????
                sPattern[4] = bArr[3]; // e.g. MOV EAX, 30??????
                
                // Search for the address to overwrite (MOV EAX, <addr to real GUID str>)
                dwPatchAddr = dwFindPattern(dwGUIDFunc, 0x13A, (BYTE*)sPattern, "x???x");
            
                if(dwPatchAddr)
                {
                    // Enable access to memory at the found address + 4
                    VirtualProtectEx(GetCurrentProcess(), (LPVOID)dwPatchAddr, 4, PAGE_EXECUTE_READWRITE, &dwOldProt);

                    // Create an array of bytes for the guid string address
                    bArr = new BYTE[4];
                    *(DWORD*)bArr = dwGuidAddr;

                    // Patch over with the guid string address: MOV EAX, <addr to our GUID str>
                    for(int i=1; i<=4; i++)
                    {
                        WriteProcessMemory(GetCurrentProcess(), (LPVOID)(dwPatchAddr + i), &bArr[i-1], 1, NULL);
                    }

                    // Cleanup
                    VirtualProtectEx(GetCurrentProcess(), (LPVOID)dwPatchAddr, 4, dwOldProt, NULL);
                }
            }
            else {
                // Couldn't find guid function
                MessageBoxW(GetForegroundWindow(), _T("Error(2): Failed to Spoof ETPRO Guid"), _T("Error"), 0);
            }
        }
        else {
            // Couldn't get a handle to cgame
            MessageBoxW(GetForegroundWindow(), _T("Error(1): Failed to Spoof ETPRO Guid"), _T("Error"), 0);
        }
    }        
[end detour hook]

Note that this patch code doesn't necessary have to be in DeviceIoControl, if cgame DLL is loaded you can apply the patch from anywhere.

hallo erstmal allerseits!
ich habe dieses tutorial gefunden, was ich doch gerne ausprobieren würde, nur leider verstehe ich hier nichts von, ich hab schon sonen compiler ausprbiert, und dort den code eingegeben aber da kommen nur fehler...

könnte denn einer bitte von euch mir dieses zeug einfach richtig compilen?

danke im vorraus!

[LowFly]

lol will da jemand die serialnr seiner festplatte patchen um nen HW-ban wegzukriegen
tja wenn du damit net klarkommst pech gehab
nicht cheaten heist die device

[Martin87]

hi
mir is schon klar so her zu kommen und euch wegen sowas um hilfe zu bitte, kommt schon scheisse an, aber was soll ich sonst machen? ich hab ja keinen hdban, nur meine etpro guid hat ne warnung im yawn system, aber woherbitteschön soll ich wissen das ein dynotimer als multihack gezählt wird?
und ich möchte lediglich, wie du schon richtig bemerkt hast die sn ändern.... die leute die sowas können, bieten dies für geld an... aber damit könnt ichs schnell ändern und das wars....