How To Bypass Smartguard?

[Anestiss]

TMAC v6

[mamaloca]

i try suspend and i can log, but u need suspend fast, because if u lost one sec u get bann

[1413]

Hi, I am writing a clicker for L2 and stuck with smartguard. I understand that I have to use some trampoline to bypass api hook from smartguard, but I can't find good document on how using it.

 

As far as I understand, trampoline must be place in a DLL, and that DLL must inject to L2. I have to find what api guard.des is hooking and then write a trampoline to jump to original function. In my case, I need to use SendInput() or keybd_event() or SendMessage( [WM_KEYDOWN / WM_KEYUP] ). Then I must find the actual address of  these function in module User32.dll and then write a trampoline to jump back to this function. That is pretty much everything I understand about api hook / detours.

 

But It seem not right. I think I got it wrong somewhere.

 

I use hookshark to find which api detours guard.des using, and the only interesting detour I found on the L2.exe process is GetRawInputData and it doesn't make sense. So, Guard.des doesn't hook on SendInput, keybd_event or SendMessage as it is no use to write trampoline for these function.

 

This is where I stuck.

Appreciate any help :)

 

 

[Szakalaka]

Why clicker? Just go for a bot. But if u really want to, the as far as i know L2 uses directinput which is resistant by nature of it to keybd_event or SendInput. Did you try inejcting messages directly to window procedure? This works in most cases. Dont use Hookshark program, write one yourself. The popular one has soem defects, doesnt show all hooks, especially cant scan ntdll where most of interesting stuff resides.

 

And what do you mean by saying "That is pretty much everything I understand about api hook" ? You have to avoid any modifications when creating a cheat, more mods = higher detect ratio and you definitel dont want it. Hooking is terrible idea (look at l2tower which hooks like 20 functions, doesnt work anywhere).

 

So right now reverse to the window creation, find the address of WndProc and try here. BTW Can you show screenshot with log from hookshark? Im interested how many did he find... :)

 

Greetz

[AchYlek]

Why clicker? Just go for a bot. But if u really want to, the as far as i know L2 uses directinput which is resistant by nature of it to keybd_event or SendInput. Did you try inejcting messages directly to window procedure? This works in most cases. Dont use Hookshark program, write one yourself. The popular one has soem defects, doesnt show all hooks, especially cant scan ntdll where most of interesting stuff resides.

 

And what do you mean by saying "That is pretty much everything I understand about api hook" ? You have to avoid any modifications when creating a cheat, more mods = higher detect ratio and you definitel dont want it. Hooking is terrible idea (look at l2tower which hooks like 20 functions, doesnt work anywhere).

 

So right now reverse to the window creation, find the address of WndProc and try here. BTW Can you show screenshot with log from hookshark? Im interested how many did he find... :)

 

Greetz

:dat: :dat:

[1413]

I mean I am newb at hook and reverse engineering stuffs and that is what I've read somewhere from the internet  :D

 

Mouse hook and keyboard hook are the only kind of hook that I know. Since I am a noob clicker is easiest to code for me, and clicker is enough for me.

 

On some private high/mid rate server, there are other way to farm than hunt mobs, such as raid boss Zaken which need about 12 - 14 players (or 14 boxes on a single computer), and clicker is the best. My clicker just does SendMessage with WM_KEYDOWN / WM_KEYUP to the correct L2 hwnd(s) and everything is good: one player, one computer, 14 L2 client windows and one clicker. That's it.

 

Before L2 exilium upgraded with smartguard my clicker worked fine. You know what happened after they upgraded with smartguard  :D

 

Like I said, I am noob at this hook / detour stuffs, and the information I find on the internet is not helping much.

 

Here are the logs

usermodehook.txt

log.txt

[Szakalaka]

The one which makes your clicker not work is most probably this:

 

[6596] L2.exe!window.dll->?StaticWndProc@WWindow@@SGJPAUHWND__@@IIJ@Z       || [0x1101C480] => guard.des [0x72FD382B]            || Inline - Detour [5 Bytes] || push ebp            || jmp 72FD3830h
 

Did you try to preapre the stack + original entry instructions and call it? This would work almost for sure

[george888]

anybody can help me for l2bnb x10 interlude server?i need a bot.i try with cracked adrenaline and I take ban with my account.

[1413]

The one which makes your clicker not work is most probably this:

 

[6596] L2.exe!window.dll->?StaticWndProc@WWindow@@SGJPAUHWND__@@IIJ@Z       || [0x1101C480] => guard.des [0x72FD382B]            || Inline - Detour [5 Bytes] || push ebp            || jmp 72FD3830h

 

It starts to make sense. So, guard.des detours the callback function that handle all the messages sent to L2 client hwnd and filters out WM_KEYUP /  WM_KEYDOWN. That is probably why message WM_CHAR still works.

 

 

 

Did you try to preapre the stack + original entry instructions and call it? This would work almost for sure

Well, that is beyond my knowledge :D

 

But at least, I have something to search for. I guess I have a lot of reading to do.

 

Thanks alot.

Edited September 29, 2015 by 1413

[sellis]

any bypass for l2 mercury guys?? smart guard protection

[dominik1752]

someone have autoclicker that bypass smartguard? :)

[Szakalaka]

I've never been using the detour/retour terminology :) You have to understand how hooking works and how do the "hooker" call real function. The algorithm is to copy instructions from the functions entry and overwrite them with a jump to your code, and create a jump back to real function using the copied instructions and adding a jump to it. If you manage to find or reproduce these instructions then you are set. It may sound very compilcated at start but u need to check it carefully. Do you use a debugger? Its million times easier with one

Edited September 29, 2015 by Szakalaka

[1413]

I've never been using the detour/retour terminology :) You have to understand how hooking works and how do the "hooker" call real function. The algorithm is to copy instructions from the functions entry and overwrite them with a jump to your code, and create a jump back to real function using the copied instructions and adding a jump to it. If you manage to find or reproduce these instructions then you are set. It may sound very compilcated at start but u need to check it carefully. Do you use a debugger? Its million times easier with one

 

I had a hunch a debugger could be useful someday, then I collected some, such as IDA pro, ollydbg... But never use them before because I have no idea how to read ASM :D

 

So, I have to find the address of the callback function StaticWndProc in the memory, then overwrite the first 5 bytes with my instructions that jump to my_function in my_dll and then my function will jump back to the 6th byte and run the original StaticWndProc. I think I read somewhere they call it trampoline, but actually it is access memory of other process and overwrite a part of that process' memory with my instructions, am I right?

 

I have a question, since guard.des overwrite the first 5 bytes with inline-detour which jump to a function in guard.des, is that right? I think maybe we just need to overwrite that 5 bytes with the original 5 bytes of the original function, like undo what guard.des does and bam StaticWndProc now received WM_KEYDOWN again.

[Szakalaka]

Welp i wrote a big post and it did not send it somehow... So basically u are right with the jump idea, but u cannot unhook guard.des, it will detect it immidietly. You can try to disable the checking loop but without asm knowledge u wont do it, so what you need to do is to reproduce first 5 bytes, then add jump to the 6th and call function that way. I may make short video on it maybe

[AchYlek]

since you make something, they will fix it faster xD