[help ]L2OFF Windows server 2008

Mrako · October 13, 2010

Hello,

did someone run L2server+extender under Windwos server 2008 R2 ? I have a little problem when i tun server, there was error message "Cannot find import; DLL maybe missing;corrupt, or wrong version File: WININET.DLL Error: 998 ". (So I run to check Windows\system32 for WININET.dll, i found WININET.DLL version 8.00.7600.16625 (win7_gdr.100629-1617). ) Server stop running after this error..

L2Server_1221_0208_dll.exe / 8.91 MB (9340416 bytes)

l2serverx64-dll.dll / 1.75 MB (1835008 bytes) / licenced..

I also made DLL with fix mentioned on PP, but there is another error :

The Application was unable to start correctly (0xc000007b)..

Can someone help me solve this problem ?

Thanks..

mcbigmac · October 13, 2010

If you have the newest version of dVampire properly licensed, this shouldn't happen.

Try contacting fr3d since he bought out dvamp.

Secondly the fix created is not for R2(released in 2010).

It could be there's more poopoo's with the OS architecture in R2.

In which case you'd need research to figure out where it is.

Most likely however, it sounds like you fukked up the "fix dll", based on your error.

Mrako · October 13, 2010

So solutions is:

1 : Contact Fr3d and buy new extender.

2 : Reinstal Windows Server 2008 R2 to Windows server 2003 RC2

3 : Try to find fix for WS 2008 R2 ...

Is it correct?)

mcbigmac · October 13, 2010

So solutions is:

1 : Contact Fr3d and buy new extender.

2 : Reinstal Windows Server 2008 R2 to Windows server 2003 RC2

3 : Try to find fix for WS 2008 R2 ...

Is it correct?)

Solution is - boot up without the WS 2008 fix, and note if it crashes during loading one of the scripts as it should on 2008.

Boot up with fix, and note if the process doesn't even start but instantly exits, citing bad injection of code.

Noting you fukked up - and that there's no difference from 2008 to 2008 R2.

If difference exists, start researching(Yea, i know won't happen).

Alternatively, downgrade would instantly fix it.

Mrako · October 13, 2010

Solution is - boot up without the WS 2008 fix, and note if it crashes during loading one of the scripts as it should on 2008.

Boot up with fix, and note if the process doesn't even start but instantly exits, citing bad injection of code.

Noting you fukked up - and that there's no difference from 2008 to 2008 R2.

If difference exists, start researching(Yea, i know won't happen).

Alternatively, downgrade would instantly fix it.

Yes process crashes instatly after start every time (without/with WS2008 fix ).

Without fix ,there was error with WINNET, as i mentioned above.

With fix , there was error 0xc000007b .

Mrako · October 13, 2010

The next problem is with or without Fix DLL:

  Problem Event Name:    APPCRASH
 Application Name:    L2Server_1221_0208_dll.exe
 Application Version:    0.0.0.0
 Application Timestamp:    43e9e657
 Fault Module Name:    StackHash_fca3
 Fault Module Version:    0.0.0.0
 Fault Module Timestamp:    00000000
 Exception Code:    c0000005
 Exception Offset:    000000001d660000
 OS Version:    6.1.7600.2.0.0.272.7
 Locale ID:    1033
 Additional Information 1:    fca3
 Additional Information 2:    fca35134e2da30130be19e279f6c1200
 Additional Information 3:    4843
 Additional Information 4:    484311c7b93a181590321c631b7ef467

I used :

case DLL_PROCESS_ATTACH:
	{
		WriteInstruction(0x643AA6, 0x643AB7, 0, 0xE9);	
	}

piotress · October 13, 2010

use this

http://www.maxcheaters.com/forum/index.php?topic=150998.0

mcbigmac · October 14, 2010

use this

http://www.maxcheaters.com/forum/index.php?topic=150998.0

How exactly will that relate to his problem at all?

Post your full code.

Random base address or fixed?

Try selecting a fixed unused adressbase in the project management.

This used to cause me problems with quick fix dlls.

sandeagle · October 14, 2010

try this vistaFix dll.mb it could worked for u...its for Dvamp extender....

i remembered that there is a hooking address in COEP sounce codes...u can find it...

http://www.datafilehost.com/download-a4b3b629.html

manton · October 14, 2010

Load problem on 2008 then try Jump from 0x643AA6 to 0x643AB7 @ 2 nops.

Mrako · October 14, 2010

How exactly will that relate to his problem at all?

Post your full code.

Random base address or fixed?

Try selecting a fixed unused adressbase in the project management.

This used to cause me problems with quick fix dlls.

Oki my code is here :

I used extredner code from topic about extenders , posted on this forum and 2 methods from guys on PP.

#include "DllMain.h"

//#define STATUS_ACCESS_VIOLATION          ((NTSTATUS)0xC0000005L) 

void NOPMemory(INT32 Address, INT32 len)
{
BYTE Byte = 0x90;
DWORD OLDPROTECT;
SIZE_T BW;
HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());
if ( Server )
{
	for ( int i = 0 ; i < len ; i++ )
	{
		INT32 ADDR = Address+i;
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, PAGE_WRITECOPY, &OLDPROTECT);
		WriteProcessMemory(Server,(LPVOID)ADDR,&Byte,1,&BW);
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, OLDPROTECT, &OLDPROTECT);
	}
}
CloseHandle(Server);
}

void WriteInstruction(INT32 Address, INT32 NewAddress, INT32 NopZone, INT8 Instruction)
{
DWORD OLDPROTECT;
SIZE_T BytesWritten;
CHAR *MyAddress = (CHAR *)Address;
INT32 JAddress = NewAddress - (Address+5);

HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());

if ( Server )
{
	// Unlocking the current address space in order to create the new jump.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, PAGE_WRITECOPY, &OLDPROTECT);

	WriteProcessMemory(Server,MyAddress,(CHAR *)&Instruction,1,&BytesWritten);
	WriteProcessMemory(Server,MyAddress+1,(CHAR *)&JAddress,4,&BytesWritten);
												 // COPYING THE ADDRESS TO THE ADDRESS SPACE.
	NOPMemory((INT32)MyAddress+5, NopZone);	         // NOPING THE REST OF THE ZONE YOU WANTED PATCHED.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, OLDPROTECT, &OLDPROTECT);
}

CloseHandle(Server);
}

__declspec(dllexport) BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved )
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
	{
		WriteInstruction(0x6432F6, 0x643307, 0, 0xE9);
		//WriteInstruction(0x643AA6, 0x643AB7, 0, 0xE9);	
	}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
	break;
}
return TRUE;
}

This fix DLL , i import to L2server.....exe, after l2serverx64-dll.dll, also tried import it before l2serverx64-dll.dll.

try this vistaFix dll.mb it could worked for u...its for Dvamp extender....

i remembered that there is a hooking address in COEP sounce codes...u can find it...

http://www.datafilehost.com/download-a4b3b629.html

Also tried, doesnt work for me.

mcbigmac · October 14, 2010

Oki my code is here :

I used extredner code from topic about extenders , posted on this forum and 2 methods from guys on PP.

#include "DllMain.h"

//#define STATUS_ACCESS_VIOLATION          ((NTSTATUS)0xC0000005L) 

void NOPMemory(INT32 Address, INT32 len)
{
BYTE Byte = 0x90;
DWORD OLDPROTECT;
SIZE_T BW;
HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());
if ( Server )
{
	for ( int i = 0 ; i < len ; i++ )
	{
		INT32 ADDR = Address+i;
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, PAGE_WRITECOPY, &OLDPROTECT);
		WriteProcessMemory(Server,(LPVOID)ADDR,&Byte,1,&BW);
		VirtualProtectEx(Server, (LPVOID)ADDR, 1, OLDPROTECT, &OLDPROTECT);
	}
}
CloseHandle(Server);
}

void WriteInstruction(INT32 Address, INT32 NewAddress, INT32 NopZone, INT8 Instruction)
{
DWORD OLDPROTECT;
SIZE_T BytesWritten;
CHAR *MyAddress = (CHAR *)Address;
INT32 JAddress = NewAddress - (Address+5);

HANDLE Server = OpenProcess(PROCESS_ALL_ACCESS | PROCESS_VM_READ | PROCESS_VM_WRITE, false, GetCurrentProcessId());

if ( Server )
{
	// Unlocking the current address space in order to create the new jump.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, PAGE_WRITECOPY, &OLDPROTECT);

	WriteProcessMemory(Server,MyAddress,(CHAR *)&Instruction,1,&BytesWritten);
	WriteProcessMemory(Server,MyAddress+1,(CHAR *)&JAddress,4,&BytesWritten);
												 // COPYING THE ADDRESS TO THE ADDRESS SPACE.
	NOPMemory((INT32)MyAddress+5, NopZone);	         // NOPING THE REST OF THE ZONE YOU WANTED PATCHED.
	VirtualProtectEx(Server, (VOID *)Address, 5+NopZone, OLDPROTECT, &OLDPROTECT);
}

CloseHandle(Server);
}

__declspec(dllexport) BOOL APIENTRY DllMain( HMODULE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved )
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
	{
		WriteInstruction(0x6432F6, 0x643307, 0, 0xE9);
		//WriteInstruction(0x643AA6, 0x643AB7, 0, 0xE9);	
	}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
	break;
}
return TRUE;
}

This fix DLL , i import to L2server.....exe, after l2serverx64-dll.dll, also tried import it before l2serverx64-dll.dll.

Also tried, doesnt work for me.

"

Random base address or fixed?

Try selecting a fixed unused adressbase in the project management.

This used to cause me problems with quick fix dlls.

repeat.

Mrako · October 14, 2010

It throws me error in compilation process : Error 2 fatal error LNK1295: '/FIXED' not compatible with '/DYNAMICBASE' specification; link without '/FIXED'

So i remove /DYNAMICBASE

Mrako · October 14, 2010

It throws me error in compilation process : Error 2 fatal error LNK1295: '/FIXED' not compatible with '/DYNAMICBASE' specification; link without '/FIXED'

So i remove /DYNAMICBASE

and the server instantly stops with error :

Problem Event Name: APPCRASH

Application Name: L2Server_1221_0208_dll.exe

Application Version: 0.0.0.0

Application Timestamp: 43e9e657

Fault Module Name: StackHash_5446

Fault Module Version: 0.0.0.0

Fault Module Timestamp: 00000000

Exception Code: c0000005

Exception Offset: 000000001d740000

OS Version: 6.1.7600.2.0.0.272.7

Locale ID: 1033

Additional Information 1: 5446

Additional Information 2: 544654776bb96463ce31d05c263bc066

Additional Information 3: 6c88

Additional Information 4: 6c88dfe237dda869f533bae89fea51b4

Someone can help me please?

Mrako · October 15, 2010

I can share here, my l2server.exe and fix dll , if someone can help me with ?

sandeagle · October 16, 2010

Open PP had a fix inserted into it's SVN long ago, by... i forgot was it kation or kuroi or... fyyre?

Someone.

Seems to be a problem after fishing data with some different instructions opcodes machine wise vs new windows 2008 architecture.

When it's calling some waitthread que function, that screws it all up.

//OpenPP / Normal NA/EU c4 Exe.

Code:

// Vista 64 / Windows 2008 Server (Incompatibility) [Fixes the Crash During the Loadage of L2Server]

WriteInstruction(0x6432F6, 0x643307, 0, 0xE9); // Forced Jump

Since it's giveaway your using dVamp - and it's more or less identical, it's just switching hook/jump adress to it's corresponding proper memory adress.

Code:

// Vista 64 / Windows 2008 Server (Incompatibility) [Fixes the Crash During the Loadage of L2Server] // dVampire

WriteInstruction(0x643AA6, 0x643AB7, 0, 0xE9); // Forced Jump

Could try that, but if it crashes straight on startup obviously something is more is wrong, that would require research.

all from http://www.mmocom.ru....

like mation said need nops 2 bytes at 0x643AA6 to 0x643AB7

hope it could help with u...GL

[help ]L2OFF Windows server 2008

Question

Mrako

21 answers to this question

Recommended Posts

mcbigmac

Mrako

mcbigmac

Mrako

Mrako

piotress

mcbigmac

sandeagle

manton

Mrako

mcbigmac

Mrako

Mrako

Mrako

sandeagle

Join the conversation

Posts

Topics

Browse

Activity

Store