Jump to content
MaxCheaters Official Group on Discord
-> Place your ad text here <-
We're Rebuilding – Join Our Staff Team

[EXCLUSIVE SHARE] IG WALKER FOR KASHA PROTECTION (L2Elixir,L2Dex etc.) UPDATED!!

TILEMACHOS

By TILEMACHOS
in Botting [English]

 Share

Recommended Posts

TILEMACHOS Newbie

TILEMACHOS

Posted
  • Author
Posted

l2dex use kasha combined with a custom protection made by the l2walker creator.

 

No its just an idea came from Fyyre...

The named 3Kb code antibot that can patch Opcodes and blocks you on Login...

A really powerfull and simple hook Blocker/"detector" that if added and strong Packed the only way to bypass is to unpack and JMP those functions (crack) or make a new system but you can't do this on L2DEX now cause of RINJAEL packet Crypting

_________________________________________________________________________________

L2Dex has :

 

1) Opcode Patcher ( what i was explained before ) Some simple tests on start up that gives you results on login Server..i mean the Auth Failed

 

2) Enigma Protector loaded on client

 

3) AES Packet crypting and to be more accurate RINJAEL (Server Side Authd made Patched by Kasha and Client Side too! Making you unable to connect to Login Server with out the System they Share)

_________________________________________________________________________________

Those 3 Things make his client really Powerfull

 

All those are confirmed after many many days and night searching on how things working on that Server and to a Similar Greek Server that closed  :( the L2Elixir

 

_________________________________________________________________________________

 

Here you can read the Share of Fyyre while talking for his clever 1st version idea of the antibot in an old Lineage Forum that now is closed:

That was firstly the antiphx.dll that some Servers are using still today...

But for Lineage.ro he did wonderfull Job or they tweaked the Code by themselves

 

 

[howto] kill hlapex/l2phx/l2walker with 3k of code

Hi,

 

On this thread smeli mentions about antihlapex. I don't know if anything like this is currently available (or for free) - but it is now.

 

This little project is an ultra simple way of keeping l2phx, hlapex, along with l2walker away from the game client.

 

First I'll say that both l2phx/hlapex depend on one import from ws2_32.dll (connect) in order to function correctly. Since both applications hook ws2_32.connect by way of a jmp at the start of the function - the solution is obvious, we need to replace their hook. The good news is that the first 12 or so bytes for ws2_32.connect is the same across all versions of Windows (yes, this works on X64 too - I tested it), so instead of patching their jmp with another jmp, we'll simply restore the original bytes of ws2_32.connect, and problem solved.

 

L2Walker is completely different - from briefly looking it in OllyDbg... walker seems to operate by calling functions inside of L2's engine itself... It installs its window hook (the home key) by directly calling a function inside of window.dll - L2Walker is really impressive actually... but also makes me wonder if the author might have 'inside information' about how Lineage II works internally, if you get my meaning.

 

Anyways, to the point... the actual bot is LineageII.dll - not the loader application L2Walker.exe - because LineageII.dll is protected with Asprotect... users of the bot can't just rename it to whatever, or Asprotect will get mad D= ... so the simple solution is to query for it with GetModuleHandleA then if we return an address... terminate the game process. I haven't been able to force unload walker's LineageII.dll without causing a GPF in the L2 game client - oh well, who cares...

 

nophx.dll works by adding it to the IAT of engine.dll and importing DllEntryPoint - since our DllEntryPoint is called quite often(no its not called only once...) its always running through the two 'anti bot' sub-routines. Now how to prevent players from just replacing our engine.dll with an older version? Nevyn gets the credit for this idea in his post here - we change the Auth key, so using an older engine.dll means you don't login.

 

Well, that's all, kill three bots with 3kb of code, and we didn't even hook outside of our own process address space (unlike some stupid kernel mode anti-cheat programs) -- I'd like to know what others think of this (if anything), or any holes you might find...

 

The .dll and its source code is attached to this thread...

 

-Fyyre

 

Fyyre here didn't thought that someone can change the name of Lineageii.dll ( L2Walker module ) because of Asprotect (back to those days Asprotect was a strong Packer)

So antiphx.dll that some servers using today are Just Searching for Lineageii.dll to block walker...

They have an alpha Version only of the Module

Fyyre is a really clever guy and he found how to unhook this dll not by name...but by patching!

 

Fyyre Helped a Lot of Private Servers and People with his Free to share Modules ( Gameguard Killer,Blowfish Patcher,Port Changer etc. ).

 

Also he Unpacked from Themida the Original L2.exe and the Engine.dll so he opened big roads for protections to be made on Private Servers

 

Hope all this Informations i am giving help you Guys

TILEMACHOS Newbie

TILEMACHOS

Posted
  • Author
Posted

I know i am offtopic in this thread, but you seem like a nice, SMART guy so i would like to ask u this: could u pls take a look at rpg club protection also? :(

I did...There Protections is Similar to L2Dex on detecting by patching...

You can Login with L2Walker but it is Unfunctionable

The only we can do is Unpack the Files are Protected with VMProtect and give a crack to bypass...

I can crack them for sure but i can't Release them from this Packer...

For me now is the Strongest Packer and i can not take a good working Dump file to Crack on

TILEMACHOS Newbie

TILEMACHOS

Posted
  • Author
Posted

So ... until u find a way to unpack their files, there is no way to get a working bot there? :(

Do u expect this to happen any time soon?

 

P.S. Happy New Years everybody!

 

It's not ubeatable but it's hard to unpack...

I know a guy named LCF-AT that knows how to unpack those shits and shares some Scripts for OllyDbg but no luck with the existing scripts...

Manual Unpacking is hard but soon we can do this for sure

  • 2 weeks later...
cmassao Newbie

cmassao

Posted
Posted

After www.Lineageii.com.br get bug of windpotion they moved to www.RPGPlay.net, same staff and etc.. we can try to log in using the same method used by MestreWalker

Sighed Newbie

Sighed

Posted
Posted

I think that this Server is Protected by Kasha but the only changed thing is the Blowfish...

If they payed for this they are really Jerks

This Server has not the L2.dll (AES) if there was you ll get ConnectionTimeout (Disconnect)

Like L2DEX does...hope you understand me :)

 

This Server has a packed Engine.dll with Enigma so you can't just debbug Dump etc. and find the Moded Blowfish in there...

So i think you find the blowfish while sniffing the TCP connection and you patched a clean system with Bfishy.dll and set in L2.ini IP to Localhost for redirecting the Connection on L2.NET... Am i Right??

 

Offcourse this is a low Protection for servers...and if there are Server patched like this one by Kasha there are LOL easy to break hehe

 

The point guys isn't the engine.dll packed with enigma, but l2.exe packed with Armadillo

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


  • Posts

    • Kowalskiz
      Christmas is approaching. Let's discuss the Xmas event NPC

      By Kowalskiz · Posted

      I'm using Myext64 HF and recently tried to replicate the "br_xmas09_event" Raising Rudolph Event. Detailed event information can be found at https://legacy-lineage2.com/news/_rudolf_the_red.html After configuring .eventdata.xml and starting the server, t  server log shows: 12/02/2025 15:39:01.809, [NO_ERROR] SpawnEx2 [br_xmas2009_invisible][schuttgart20_npc2213_xs03m1] [1][0][0][0][0][346796390] 12/02/2025 15:39:02.057, DummyPacket received from L2Server 12/02/2025 15:39:02.058, server socket close 312ac(f0820224) error(997) 12/02/2025 15:39:02.058, [CallStack][tid:0][tick:2][0] Begin 12/02/2025 15:39:02.058, [CallStack][tid:0][tick:2][1][0] void __cdecl IOThreadCallback::IOThread_common(void) 12/02/2025 15:39:02.059, [CallStack][tid:0][tick:2][2][1] void IOThread_common 1 12/02/2025 15:39:02.059, [CallStack][tid:0][tick:2][3][2] void __cdecl CIOSocketEx<class CIOBufferEx<16384> >::Close(void) 12/02/2025 15:39:02.059, [CallStack][tid:0][tick:2][4][3] void __cdecl CServerSocket::OnClose(void) 12/02/2025 15:39:02.059, [CallStack][tid:0][tick:2][5] End l2server log: 12/02/2025 15:39:02.112, npc server closed(127.0.0.1) error: 64 read buffer size: (server:0 npc:0) 12/02/2025 15:39:02.112, [NO_ERROR] L2Server is under protection mode!!! 12/02/2025 15:39:02.112, [NO_ERROR] L2Server is under protection mode!!! 12/02/2025 15:39:02.112, [NO_ERROR] L2Server is under protection mode!!! 12/02/2025 15:39:02.131, dwTime[0] < 80 !!!!!!! 12/02/2025 15:39:02.131, [CallStack][tid:7][tick:1][0] Begin 12/02/2025 15:39:02.132, [CallStack][tid:7][tick:1][1][0] void __cdecl IOThreadCallback::IOThread_common(void) 12/02/2025 15:39:02.132, [CallStack][tid:7][tick:1][2][1] void IOThread_common 1 12/02/2025 15:39:02.132, [CallStack][tid:7][tick:1][4][3] void __cdecl NpcSocket::OnClose(void) 12/02/2025 15:39:02.132, [CallStack][tid:7][tick:1][3][2] void __cdecl CIOSocketEx<class CIOBufferEx<16384> >::Close(void) 12/02/2025 15:39:02.132, [CallStack][tid:7][tick:1][5] End 12/02/2025 15:39:31.767, server closed(127.0.0.1) Error: 64 Read buffer size: (server:0 npc:0) 12/02/2025 15:39:31.768, [NO_ERROR] Logout All Characters : 1   The NPC server sent a packet to the L2 server while generating the br_xmas2009_invisible game NPC server, and the NPC server subsequently crashed.     After some digging, I found a clue in a very old MXC post, but the fix was for the GF version. The whole problem is in l2server side support for NPC function CreateOnePrivateNearUser. It sends CreatePacket but Koreans made some changes in it (added instance ID) so it got broken. As Santa event is the only AI that uses this function, they probably don't know about it    So is there a way to fix this problem, specifically for Myext64 HF? I'd be happy to buy him coffee.
    • Tryskell
      How to start learning Java using Lineage 2 as an example?

      By Tryskell · Posted

      Offtopic, personal attacks, probably too old to use that much memes and what's YOUR actual contribution to L2J, in order I laugh aswell ?   The main poster quotes my pack so I answer accordingly, while you advertise L2JFrozen in both of your posts - discontinued since 2014 (? 1132 rev), with none taking back the open source lead while anyone could.   If you're somewhat affiliated to hopzone, you probably packed way more money than me. Packs don't make any type of money (barely 100e/month) and if you would follow me, you would know there are ways to handle it or even getting paid.   Hope I was short enough, 🧂🤡.
    • byPain
      [SHARE] Beatiful Landing page for ur lineage 2 project

      By byPain · Posted

      Hi guys, this is a CMS im sharing for lineage 2 servers, im tired of the crap i see on new release servers. Dont let me start on the IA developed ones lmao.   📋 Description Free and open source template to create landing pages for Lineage 2 private servers. Designed with a dark fantasy theme and modern animations. ✨ Current Features This FREE version includes: Complete Landing Page - Professional design ready to use Multi-language Support - Spanish, English, Portuguese Dark Fantasy Theme - With animated UI elements Server Information - Rates, features, and rules Olympiad Ranking - Rankings display Download Section - For game client Skins and Animations Gallery Streaming Widget - Twitch/Kick integration Fully Customizable - Via configuration files ❌ Not Included in Free Version ❌ User Registration System ❌ Online Players Counter ❌ Donation Panel 💎 Premium Integrations IntegrationPrice Registration System $50 USD Online Players Counter $50 USD Donation Panel $50 USD   📧 Contact: https://gh0tstudio.com 🛠️ Tech Stack Technology    Version    Description React              19.2.0       UI Library TypeScript       5.8.2        Static typing Vite                 6.2.0         Build tool TailwindCSS   CDNCSS    Framework Lucide React   0.554.0         Icons i18next           23.16.0       Internationalization react-i18next   15.1.0        React bindings for i18n All documentation provided for AI AGENTS to make changes on the ui texts and so on. u can have a look on the cms fully working with donation panel, online count and register via: https://crmlineage2.vercel.app/ https://github.com/6h0T/CRM-LINEAGE2-FREE If u are in the lookings to develop a unique website for ur projects, u can dm me or contact me throw my socials on my profile. all code has encrypted references so any type of rebranding, copying or selling without authorization will result in take downs
    • byPain
      [WTB] L2 website + account panel + donate panel

      By byPain · Posted

      Hello dude, i can help u out, i reached to u via DM, my studio is https://gh0tstudio.com i have worked with almost 40 brands on developing Private Lineage and Mu online servers, dashboard for vote pages and more. I sent u some examples too
    • protoftw
      Graphic/Html Designs - Protojah

      By protoftw · Posted

      L2 TARTARUS - HTML DESIGN       L2 KOMBAT - ANIMATED BORDER   L2 SERENITY - ANIMATED LOGO   L2 ARCANE - COMMUNITY BOARD     L2 AMERIKA - ADVERTISING BANNER   L2 ZERON - ADVERTISING BANNER  

  • Topics

×
×
  • Create New...

AdBlock Extension Detected!

Our website is made possible by displaying online advertisements to our members.

Please disable AdBlock browser extension first, to be able to use our community.

I've Disabled AdBlock