Removing Ads popup after quitting v62 client

[NikitaVB]

Hi, I'm having trouble finding the addy for removing the ads popup after quitting MapleStory (using a clean v62 localhost client).

Any suggestions or help?

Thanks!

 

[Eric]

Should be in CWvsApp::CleanUp if I remember correctly.. Try nopping the address 007C66E3.

 

[NikitaVB]

Should be in CWvsApp::CleanUp if I remember correctly.. Try nopping the address 007C66E3.

That's the one I've been trying and it seems to have no effect (ad still shows up after exiting)

 

[Eric]

That's the one I've been trying and it seems to have no effect (ad still shows up after exiting)

Any idea what the URL is that it's trying to direct to? I'm pretty sure the ads were part of NexonADBalloon, and thus my best guess is the URL is

You must be registered to see links

that gets called from WinMain. If so, then try to change the instruction at address 00823BC3 to jmp 00823C3D.

 

[NikitaVB]

Any idea what the URL is that it's trying to direct to? I'm pretty sure the ads were part of NexonADBalloon, and thus my best guess is the URL is

You must be registered to see links

that gets called from WinMain. If so, then try to change the instruction at address 00823BC3 to jmp 00823C3D.

Ayy that was it. You fixed it.

Do you mind sharing how I would go about figuring something out like that on my own? I know its reverse engineering and looking at Assembly code but is there a good tutorial out there?

Thanks!

 

[Eric]

Ayy that was it. You fixed it.

Do you mind sharing how I would go about figuring something out like that on my own? I know its reverse engineering and looking at Assembly code but is there a good tutorial out there?

Thanks!

Honestly it's more of just experience. After doing it for so long I basically just know/assume how and where to find things anywhere in the client. In this instance the first thing I did to find it was search for a URL string that had "ad" in it somewhere as well as linked to nexon.net. After it didn't exist in the client, I checked the StringPools and found it at index 8. Then, I just traced that StringPool to the function in WinMain. It called a function which controlled sending a browser (and also used NexonADBalloon which I already knew controlled ad windows before), and below it had another function regarding internet explorer. So, to skip both of them, we jump from the current location all the way to the bottom location.

As far as assembly/reverse engineering goes, I self-taught myself the basics, and then I had taken a more advanced course regarding the subject in college where I got to better learn and understand how it all worked. I'm sure you could find some decent guides and videos online regarding it though.

 

[NikitaVB]

Honestly it's more of just experience. After doing it for so long I basically just know/assume how and where to find things anywhere in the client. In this instance the first thing I did to find it was search for a URL string that had "ad" in it somewhere as well as linked to nexon.net. After it didn't exist in the client, I checked the StringPools and found it at index 8. Then, I just traced that StringPool to the function in WinMain. It called a function which controlled sending a browser (and also used NexonADBalloon which I already knew controlled ad windows before), and below it had another function regarding internet explorer. So, to skip both of them, we jump from the current location all the way to the bottom location.

As far as assembly/reverse engineering goes, I self-taught myself the basics, and then I had taken a more advanced course regarding the subject in college where I got to better learn and understand how it all worked. I'm sure you could find some decent guides and videos online regarding it though.

Gotcha, thanks man. You mentioned StringPools and tracing functions, what tools do you use to get that? (Especially the one where you know the address correlating with the function)
Thanks!