Skip to content

[help ]L2OFF Windows server 2008

Featured Replies

Hello,

did someone run L2server+extender under Windwos server 2008 R2 ? I have a little problem when i tun server, there was error message "Cannot find import; DLL maybe missing;corrupt, or wrong version File: WININET.DLL  Error: 998 ". (So I run to check Windows\system32 for WININET.dll, i found WININET.DLL version 8.00.7600.16625 (win7_gdr.100629-1617). ) Server stop running after this error..

 

 

L2Server_1221_0208_dll.exe / 8.91 MB (9340416 bytes)

l2serverx64-dll.dll / 1.75 MB (1835008 bytes) / licenced..

 

I also made DLL with fix mentioned on PP, but there is another error :

The Application was unable to start correctly (0xc000007b)..

 

Can someone help me solve this problem ?

Thanks..

 

If you have the newest version of dVampire properly licensed, this shouldn't happen.

Try contacting fr3d since he bought out dvamp.

 

Secondly the fix created is not for R2(released in 2010).

It could be there's more poopoo's with the OS architecture in R2.

In which case you'd need research to figure out where it is.

 

Most likely however, it sounds like you fukked up the "fix dll", based on your error.

  • Author

So solutions is:

  1 : Contact Fr3d and buy new extender.

  2 : Reinstal Windows Server 2008 R2 to Windows server 2003 RC2

  3 : Try to find fix for WS 2008 R2 ...

 

Is it correct?)

So solutions is:

  1 : Contact Fr3d and buy new extender.

  2 : Reinstal Windows Server 2008 R2 to Windows server 2003 RC2

  3 : Try to find fix for WS 2008 R2 ...

 

Is it correct?)

 

Solution is - boot up without the WS 2008 fix, and note if it crashes during loading one of the scripts as it should on 2008.

Boot up with fix, and note if the process doesn't even start but instantly exits, citing bad injection of code.

 

Noting you fukked up - and that there's no difference from 2008 to 2008 R2.

If difference exists, start researching(Yea, i know won't happen).

 

Alternatively, downgrade would instantly fix it.

 

 

  • Author

Solution is - boot up without the WS 2008 fix, and note if it crashes during loading one of the scripts as it should on 2008.

Boot up with fix, and note if the process doesn't even start but instantly exits, citing bad injection of code.

 

Noting you fukked up - and that there's no difference from 2008 to 2008 R2.

If difference exists, start researching(Yea, i know won't happen).

 

Alternatively, downgrade would instantly fix it.

 

 

 

 

Yes process crashes instatly after start every time (without/with WS2008 fix ).

Without fix ,there was error with WINNET, as i mentioned above.

With fix , there was error 0xc000007b .

  • Author

The next problem is with or without Fix DLL:

  Problem Event Name:    APPCRASH
 Application Name:    L2Server_1221_0208_dll.exe
 Application Version:    0.0.0.0
 Application Timestamp:    43e9e657
 Fault Module Name:    StackHash_fca3
 Fault Module Version:    0.0.0.0
 Fault Module Timestamp:    00000000
 Exception Code:    c0000005
 Exception Offset:    000000001d660000
 OS Version:    6.1.7600.2.0.0.272.7
 Locale ID:    1033
 Additional Information 1:    fca3
 Additional Information 2:    fca35134e2da30130be19e279f6c1200
 Additional Information 3:    4843
 Additional Information 4:    484311c7b93a181590321c631b7ef467

 

I used :

case DLL_PROCESS_ATTACH:
	{
		WriteInstruction(0x643AA6, 0x643AB7, 0, 0xE9);	
	}

 

How exactly will that relate to his problem at all?

 

 

 

Post your full code.

Random base address or fixed?

 

Try selecting a fixed unused adressbase in the project management.

This used to cause me problems with quick fix dlls.

try this vistaFix dll.mb it could worked for u...its for Dvamp extender....

 

i remembered that there is a hooking address in COEP sounce codes...u can find it...

 

http://www.datafilehost.com/download-a4b3b629.html

Load problem on 2008 then try Jump from 0x643AA6 to 0x643AB7 @ 2 nops.

  • Author

How exactly will that relate to his problem at all?

 

 

 

Post your full code.

Random base address or fixed?

 

Try selecting a fixed unused adressbase in the project management.

This used to cause me problems with quick fix dlls.

 

Oki my code is here :

I used extredner code from topic about extenders , posted on this forum and 2 methods from guys on PP.

#include "DllMain.h"

//#define STATUS_ACCESS_VIOLATION          ((NTSTATUS)0xC0000005L) 

void NOPMemory(INT32 Address, INT32 len)
{
BYTE Byte = 0x90;
DWORD OLDPROTECT;
SIZE_T BW;
HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());
if ( Server )
{
	for ( int i = 0 ; i < len ; i++ )
	{
		INT32 ADDR = Address+i;
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, PAGE_WRITECOPY, &OLDPROTECT);
		WriteProcessMemory(Server,(LPVOID)ADDR,&Byte,1,&BW);
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, OLDPROTECT, &OLDPROTECT);
	}
}
CloseHandle(Server);
}

void WriteInstruction(INT32 Address, INT32 NewAddress, INT32 NopZone, INT8 Instruction)
{
DWORD OLDPROTECT;
SIZE_T BytesWritten;
CHAR *MyAddress = (CHAR *)Address;
INT32 JAddress = NewAddress - (Address+5);

HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());

if ( Server )
{
	// Unlocking the current address space in order to create the new jump.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, PAGE_WRITECOPY, &OLDPROTECT);

	WriteProcessMemory(Server,MyAddress,(CHAR *)&Instruction,1,&BytesWritten);
	WriteProcessMemory(Server,MyAddress+1,(CHAR *)&JAddress,4,&BytesWritten);
												 // COPYING THE ADDRESS TO THE ADDRESS SPACE.
	NOPMemory((INT32)MyAddress+5, NopZone);	         // NOPING THE REST OF THE ZONE YOU WANTED PATCHED.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, OLDPROTECT, &OLDPROTECT);
}

CloseHandle(Server);
}

__declspec(dllexport) BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved )
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
	{
		WriteInstruction(0x6432F6, 0x643307, 0, 0xE9);
		//WriteInstruction(0x643AA6, 0x643AB7, 0, 0xE9);	
	}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
	break;
}
return TRUE;
}

 

 

This fix DLL , i import to L2server.....exe, after l2serverx64-dll.dll, also tried import it before l2serverx64-dll.dll.

 

try this vistaFix dll.mb it could worked for u...its for Dvamp extender....

 

i remembered that there is a hooking address in COEP sounce codes...u can find it...

 

http://www.datafilehost.com/download-a4b3b629.html

 

Also tried, doesnt work for me.

Oki my code is here :

I used extredner code from topic about extenders , posted on this forum and 2 methods from guys on PP.

#include "DllMain.h"

//#define STATUS_ACCESS_VIOLATION          ((NTSTATUS)0xC0000005L) 

void NOPMemory(INT32 Address, INT32 len)
{
BYTE Byte = 0x90;
DWORD OLDPROTECT;
SIZE_T BW;
HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());
if ( Server )
{
	for ( int i = 0 ; i < len ; i++ )
	{
		INT32 ADDR = Address+i;
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, PAGE_WRITECOPY, &OLDPROTECT);
		WriteProcessMemory(Server,(LPVOID)ADDR,&Byte,1,&BW);
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, OLDPROTECT, &OLDPROTECT);
	}
}
CloseHandle(Server);
}

void WriteInstruction(INT32 Address, INT32 NewAddress, INT32 NopZone, INT8 Instruction)
{
DWORD OLDPROTECT;
SIZE_T BytesWritten;
CHAR *MyAddress = (CHAR *)Address;
INT32 JAddress = NewAddress - (Address+5);

HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());

if ( Server )
{
	// Unlocking the current address space in order to create the new jump.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, PAGE_WRITECOPY, &OLDPROTECT);

	WriteProcessMemory(Server,MyAddress,(CHAR *)&Instruction,1,&BytesWritten);
	WriteProcessMemory(Server,MyAddress+1,(CHAR *)&JAddress,4,&BytesWritten);
												 // COPYING THE ADDRESS TO THE ADDRESS SPACE.
	NOPMemory((INT32)MyAddress+5, NopZone);	         // NOPING THE REST OF THE ZONE YOU WANTED PATCHED.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, OLDPROTECT, &OLDPROTECT);
}

CloseHandle(Server);
}

__declspec(dllexport) BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved )
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
	{
		WriteInstruction(0x6432F6, 0x643307, 0, 0xE9);
		//WriteInstruction(0x643AA6, 0x643AB7, 0, 0xE9);	
	}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
	break;
}
return TRUE;
}

 

 

This fix DLL , i import to L2server.....exe, after l2serverx64-dll.dll, also tried import it before l2serverx64-dll.dll.

 

Also tried, doesnt work for me.

"

Random base address or fixed?

 

Try selecting a fixed unused adressbase in the project management.

This used to cause me problems with quick fix dlls.

 

repeat.

  • Author

It throws me error in compilation process : Error    2    fatal error LNK1295: '/FIXED' not compatible with '/DYNAMICBASE' specification; link without '/FIXED'

 

So i remove /DYNAMICBASE

 

  • Author

It throws me error in compilation process : Error    2    fatal error LNK1295: '/FIXED' not compatible with '/DYNAMICBASE' specification; link without '/FIXED'

 

So i remove /DYNAMICBASE

 

 

and the server instantly stops with error :

Problem Event Name: APPCRASH

 Application Name: L2Server_1221_0208_dll.exe

 Application Version: 0.0.0.0

 Application Timestamp: 43e9e657

 Fault Module Name: StackHash_5446

 Fault Module Version: 0.0.0.0

 Fault Module Timestamp: 00000000

 Exception Code: c0000005

 Exception Offset: 000000001d740000

 OS Version: 6.1.7600.2.0.0.272.7

 Locale ID: 1033

 Additional Information 1: 5446

 Additional Information 2: 544654776bb96463ce31d05c263bc066

 Additional Information 3: 6c88

 Additional Information 4: 6c88dfe237dda869f533bae89fea51b4

 

 

Someone can help me please?

 

 

  • Author

I can share here, my l2server.exe and fix dll , if someone can help me with ?

Create an account or sign in to comment

Account

Navigation

Search

Search

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.