Jump to content

Recommended Posts

Posted

funny shit.

i made the 2nd dll. dunno who leaked it. i left some "signature" inside.

i can just say there's nothing bad inside.

funny is also that by saying that and being my first post, no one will download it now, cuz "brr HE NOT ONE OF US, MUST BE EVIL brr"

muahah.........

 

anyway the bigger one is just bigger cuz its based on a more recent version of drake's dll that allow dual box. and drake probably added some more code, which i didn't even bother to lookup, since my own dll works fine.

 

finally, don't trust your computer firewall so much. you'd better trust an external one. i could make the dll manipulate your firewall (or actually the kernel) and you wouldn't see it, as long as you run l2 with administrator rights (=like everyone)

 

anyway, its just a game  ::)

Posted

funny shit.

i made the 2nd dll. dunno who leaked it. i left some "signature" inside.

i can just say there's nothing bad inside.

funny is also that by saying that and being my first post, no one will download it now, cuz "brr HE NOT ONE OF US, MUST BE EVIL brr"

muahah.........

 

anyway the bigger one is just bigger cuz its based on a more recent version of drake's dll that allow dual box. and drake probably added some more code, which i didn't even bother to lookup, since my own dll works fine.

 

finally, don't trust your computer firewall so much. you'd better trust an external one. i could make the dll manipulate your firewall (or actually the kernel) and you wouldn't see it, as long as you run l2 with administrator rights (=like everyone)

 

anyway, its just a game  ::)

 

 

Eheheh... yeah you are true... the software firewall are not so sure... but outpost ask me what to do even if the system is asking for internet access... of course if u have the knowledge all the firewall can be bypassed... even an external linux box...

 

But however i can sniff packets sent by the PC if i have another in the same net... but im waiting to try your dll coz i hate this work... i prefer to wait and see if anyone got hacked by your dll :P

Posted

Be Carefull...

 

IAMBORED pls post entire open code of your 160 Kb DLL...... !!!

 

i don't have no 160kb dll.. this is just the one you have on the 2nd link.. 67K packed 166K unpacked if i remember right.

there's no such "code". the code is the dll lol. Just disassemble it. then you get asm. then you figure out what it does, and change it with an hex editor in the dll file. It's how i modify it anyway.

 

anyway.. just funny to see it up there ^^

Posted

Be Carefull...

 

IAMBORED pls post entire open code of your 160 Kb DLL...... !!!

 

 

i don't have no 160kb dll.. this is just the one you have on the 2nd link.. 67K packed 166K unpacked if i remember right.

there's no such "code". the code is the dll lol. Just disassemble it. then you get asm. then you figure out what it does, and change it with an hex editor in the dll file. It's how i modify it anyway.

 

anyway.. just funny to see it up there ^^

 

 

 

IAMBORED

 

Yes man !!

 

Your work is very good and we all are botting now thanx to your dll.

 

but as you know there are continue account hacks and my asshole is 1 micron diameter in this period.... :)

I meant that you please could explain us what modify you did on the dll. Im not a coder so i couldnt do it by myself.

 

I thought that your dll was the 160k one. So please can you gimme a direct link for your 67 kb dll ??? I cannot download it fron FILEFRONT.

 

And... sorry for my bad english.

Posted

;----------------------------------------------------------------------------------------------------

; Exports

;

Index: 1 Name: AttachMe

;

;----------------------------------------------------------------------------------------------------

; Imports from oleaut32.dll

;

extrn SysFreeString

extrn SysReAllocStringLen

extrn SysAllocStringLen

;

; Imports from advapi32.dll

;

extrn RegQueryValueExA

extrn RegOpenKeyExA

extrn RegCloseKey

;

; Imports from user32.dll

;

extrn GetKeyboardType

extrn DestroyWindow

extrn LoadStringA

extrn MessageBoxA

extrn CharNextA

;

; Imports from kernel32.dll

;

extrn GetACP

extrn Sleep

extrn VirtualFree

extrn VirtualAlloc

extrn GetTickCount

extrn QueryPerformanceCounter

extrn GetCurrentThreadId

extrn InterlockedDecrement

extrn InterlockedIncrement

extrn VirtualQuery

extrn WideCharToMultiByte

extrn MultiByteToWideChar

extrn lstrlen

extrn lstrcpyn

extrn LoadLibraryExA

extrn GetThreadLocale

extrn GetStartupInfoA

extrn GetProcAddress

extrn GetModuleHandleA

extrn GetModuleFileNameA

extrn GetLocaleInfoA

extrn GetCommandLineA

extrn FreeLibrary

extrn FindFirstFileA

extrn FindClose

extrn ExitProcess

extrn ExitThread

extrn CreateThread

extrn CompareStringA

extrn WriteFile

extrn UnhandledExceptionFilter

extrn RtlUnwind

extrn RaiseException

extrn GetStdHandle

;

; Imports from kernel32.dll

;

extrn TlsSetValue

extrn TlsGetValue

extrn TlsFree

extrn TlsAlloc

extrn LocalFree

extrn LocalAlloc

;

; Imports from user32.dll

;

extrn PeekMessageA

extrn MsgWaitForMultipleObjects

extrn MessageBoxA

extrn LoadStringA

extrn GetSystemMetrics

extrn CharNextA

extrn CharToOemA

;

; Imports from kernel32.dll

;

extrn WriteProcessMemory

extrn WritePrivateProfileStringA

extrn WriteFile

extrn WaitForSingleObject

extrn VirtualQuery

extrn VirtualProtectEx

extrn TerminateProcess

extrn Sleep

extrn SetFilePointer

extrn SetEvent

extrn SetEndOfFile

extrn ResumeThread

extrn ResetEvent

extrn ReadProcessMemory

extrn ReadFile

extrn OpenProcess

extrn LoadLibraryA

extrn LeaveCriticalSection

extrn InitializeCriticalSection

extrn GetVersionExA

extrn GetThreadLocale

extrn GetStdHandle

extrn GetProcAddress

extrn GetPrivateProfileStringA

extrn GetModuleHandleA

extrn GetModuleFileNameA

extrn GetLocaleInfoA

extrn GetLocalTime

extrn GetLastError

extrn GetFullPathNameA

extrn GetExitCodeThread

extrn GetDiskFreeSpaceA

extrn GetDateFormatA

extrn GetCurrentThreadId

extrn GetCurrentProcessId

extrn GetCPInfo

extrn InterlockedIncrement

extrn InterlockedExchange

extrn InterlockedDecrement

extrn FreeLibrary

extrn FormatMessageA

extrn EnumCalendarInfoA

extrn EnterCriticalSection

extrn DeleteCriticalSection

extrn CreateMutexA

extrn CreateFileA

extrn CreateEventA

extrn CompareStringA

extrn CloseHandle

;

; Imports from kernel32.dll

;

extrn Sleep

;

; Imports from oleaut32.dll

;

extrn SafeArrayPtrOfIndex

extrn SafeArrayGetUBound

extrn SafeArrayGetLBound

extrn SafeArrayCreate

extrn VariantChangeType

extrn VariantCopy

extrn VariantClear

extrn VariantInit

;

;----------------------------------------------------------------------------------------------------

 

Posted

Drakes one.

 

;------------------------------------------------------------------------------

; Imports from kernel32.dll

;

extrn LoadLibraryA

extrn GetProcAddress

extrn VirtualAlloc

extrn VirtualFree

;

; Imports from oleaut32.dll

;

extrn SysFreeString

;

; Imports from advapi32.dll

;

extrn RegQueryValueExA

;

; Imports from user32.dll

;

extrn GetKeyboardType

;

;------------------------------------------------------------------------------

 

Posted

u need to compare against old one from drake because he changed it. also one is packed the other not.

 

if both files were packed with the same packer you wouldn't see any import difference, because, well, its packed. you only see the calls from the packer.

 

here's a newly packed version in UPX e.g.

 

http://rapidshare.com/files/30274070/fldrv.dll.html

 

its 77k.

 

there are tons of different packers

 

 

if you wanna check the dll you gotta unpack it first. there are automatic unpackers on the net, but the best is to do it yourself.

download ollydbg http://www.ollydbg.de/

open the dll with it (say ok blabla when it warns you)

 

run it (F9)

 

go into the views, select memory, see the rows corresponding to fldrv.dll. there are section names (.text, .bss etc <= this is delphi code from drake that's why there is this kind of section btw) dump the one starting with e PE (portable executable) header, its easy to see, there is a string like "This program cannot be run in dos mode"

 

dump it (right click => dump) and reconstruct the dll (with LordPE or others I think most tools can do it), and tada, its unpacked.

 

Alternative: load the dll the same wait in olly (or in L2.exe if u want) and use some automatic memory dumper like PE Tools. (it will reconstruct it for you, too)

 

Once you dumped both dll, you can compare them. Good luck.

 

 

 

ps: remember, my dll is based on drake's first dll, the one blocking dualbox and l2w. I didn't see a need to patch the new one, since he simply allowed dualbox on it (but not l2w)

Posted

So... anyone have tried it?

 

We know it works... but its safe 100%? Can all of us be sure of it?

 

i don't think you'll ever be sure. even 100% legal crap you can't be sure of it.

even drake's files, maybe drake trojan u, how can u be 100% sure ? maybe his client is compromise, u never know.

it's like if something guy with 500 posts came here and said "im the best ever, and i say its sure".

and u will trust him, yet maybe he just lied the 500 past posts lol

 

i gave you the tools above to check it for yourself however

Posted

So... anyone have tried it?

 

We know it works... but its safe 100%? Can all of us be sure of it?

 

i don't think you'll ever be sure. even 100% legal crap you can't be sure of it.

even drake's files, maybe drake trojan u, how can u be 100% sure ? maybe his client is compromise, u never know.

it's like if something guy with 500 posts came here and said "im the best ever, and i say its sure".

and u will trust him, yet maybe he just lied the 500 past posts lol

 

i gave you the tools above to check it for yourself however

 

Ok.. im belive in you iambored... one question.. You make this dll ?

Posted

So... anyone have tried it?

 

We know it works... but its safe 100%? Can all of us be sure of it?

 

i don't think you'll ever be sure. even 100% legal crap you can't be sure of it.

even drake's files, maybe drake trojan u, how can u be 100% sure ? maybe his client is compromise, u never know.

it's like if something guy with 500 posts came here and said "im the best ever, and i say its sure".

and u will trust him, yet maybe he just lied the 500 past posts lol

 

i gave you the tools above to check it for yourself however

 

Same for me... i believe in u... and some friends are using your dll with no problems...

 

Thx for your share... ;)

 

It was only a question... dont be angry of it ;)

Guest
This topic is now closed to further replies.



  • Posts

    • I suggest you provide Test server for public and add a price.
    • Kroma — Lineage II Interlude on LU4 Client (Latest client)   I'm selling this project. Here's what it actually is and what's been done.   This is a few months of work, most of it on the reverse engineering side. I built it because I wanted to open my own Interlude server on it. That's not happening any more — I've moved on to other projects and don't have the free time left to take it the rest of the way, so I'd rather it went to someone who will.   The idea was to take the modern LU4 client and make it run an Interlude version of the game. Not a reskin of an old client — the actual current client, playing Interlude, against a server I wrote. That's what this is, and it works end to end: the client boots, authenticates, connects, and you play. There are six repositories. Roughly, it splits into three kinds of work: reverse engineering the client, writing the server, and rebuilding the client's own content so it matches Interlude.   Fully reverse engineered   The client's protocol wasn't documented anywhere, so it was derived from scratch off real traffic. I built a sniffer (bypassing anticheat packet encryption) that drops into the client's binaries folder and dumps live traffic to disk, then a separate Java toolchain that decrypts those captures — login and game traffic, both directions. Everything the server knows about the protocol came out of that loop: capture, decrypt, read, implement, test against the real client.   On top of that there's a native x64 hook and injector in C++. It points the client at your own servers and handles its authentication and session layer, plus a few client-side stability fixes that were needed to keep it from falling over once it's talking to something that isn't the official backend. The hooking is pattern-based rather than address-based, so a client patch doesn't automatically break it.   The reverse-engineering notes are in the repos — the patterns, the disassembly, the decompiled functions, what each one does and why it's hooked. That documentation is a real part of what's being sold; it's the difference between inheriting a working system and inheriting a black box.   The server   Interlude ruleset, aCis lineage, but substantially rewritten and extended to speak the LU5 client's protocol with modern features like Party matching, Offline shops or Mailbox. The geodata has been updated according to some layout changes in LU4 cities. There's also a separate login server handling the client's auth flow.   Customized client to adapt to Interlude   This is the part people underestimate. The retail client ships retail content — retail NPCs, retail items, retail zones, retail UI. All of that had to be reshaped. The whole client-side pipeline is scripted: extract the retail PAKs, apply every edit from data files, rebuild, drop the result back into the game folder. 23 purpose-built C# tools, ~6,700 lines, organised into three pipelines that are guaranteed not to write over each other. There's a documented checklist for regenerating everything from scratch when a new patch drops. The important thing is that none of it is hand-editing. Every change is a line in a data file. When the client updates, you re-run the scripts instead of redoing the work from memory.   All NPC / item / drop lists updated according to Interlude   The client's own data tables were rewritten from the real Interlude client data files — `npcname-e`, `itemname-e`, `skillname-e`, `systemmsg-e`, `npcgrp`. That means roughly 6,470 NPC and skill name/title updates and about 4,000 Drops/Spoils rows written directly into the client's `NPCDataTable` and `SkillTable`, so the client shows Interlude names, Interlude item text, Interlude system messages, and Interlude drop and spoil lists. There are also custom NPC rows on top of that, plus 304 game action rewrites.   Opened the catacombs   In the LU4 client the catacombs and necropolises are unusable — flooded, unlit, and with holes in the geometry. All three were fixed: Water removed. Water exclusion volumes were placed over all 12 of them: Rifts, Apostate, Patriots, Devotion, Dark Omens, Heretics, Pilgrims, Saints, Worship, Martyr, Forbidden Path and Witch. This was more involved than it sounds — the volumes' scale is ignored at runtime, so the tool picks the best-fitting native template per hole, and nearby lakes and rivers are separate water bodies that have to be excluded individually or you get leftover water borders. Lights added. About 28,900 light definitions imported into the client's level files. Missing walls fixed. Mesh actors replaced and spawned to close the gaps in the geometry.   Removed the modern "slop" features from the UI   The LU4 client is full of things that have no business in an Interlude server, and most of them are wired into the UI. Those are stripped out: The assistant manager — the auto-hunt / auto-play slot on the XP bar Vitality*and the XP lock button The fatigue system — updated the format to a regular VIP format The in-game browser and in-game radio buttons The "Learn Skill" tab in the player skills window Removals are scripted by path, so they survive a client patch and are trivially reversible if a buyer wants any of them back.   Reworked the UI toward an actual Lineage II feel   The original LU4 UI looks AI-generated. It doesn't feel like Lineage II. A good part of it has been reworked toward the classic look — the menu button row rebuilt as a wrapping layout with a proper background, the self status and target windows cleaned up, and 590 asset field edits covering textures, positions, colours, text and compiled Blueprint literals.   This part is not finished, and I want to be straight about that But the tooling to continue it is all there, and it's the good kind of tooling: you can target any widget property in any UI asset by dotted path, remove widgets by path without knowing their auto-generated slot names, and edit text that's dynamically bound through Blueprint bytecode rather than stored as a plain property. Continuing the UI work means adding lines to a data file, not reverse engineering anything new.   Other client-side work   A custom login scene, built in a real Unreal Engine project that's included Interlude music restored, plus ambient sound work (cities only for now) Custom splash and branding   What's included   All six git repositories, the Unreal Engine project and its custom assets, all the tooling — injector, hook, sniffer, decryptor, asset editor — every data set including geodata, XML, HTML and the SQL schema, the build and repack scripts, and the per-repo technical documentation including the reverse-engineering notes.   Happy to answer questions or show it running.   Gallery
  • Topics

×
×
  • Create New...

Important Information

This community uses essential cookies to function properly. Non-essential cookies and third-party services are used only with your consent. Read our Privacy Policy and We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue..