Disable Xtrap loading:
007CDD25 /74 18 JE SHORT Fiesta.007CDD3F
=NOP
--------------------------
Disable checks:
TerminateProcess :
- 007CD5A7 !
=> from
007CC037
007CBBD0 =RETN
007CE13B
00677D4D =JMP
- 007CE000
007CC1AD?
007CC2BD -> hit
007CC28E =JMP
- Timed check
007CE297
007CE170 =RETN
Extra:
Multiclient
0041D90C /MutexName = "FiestaOnlineClient"
0041D90A =JMP
--------------------
--------------------
AOB Tutorial
1. Removal of xtrap loading
Look for:
81 EC 04 01 00 00 53 56 57 B9 40 00 00 00 33 C0 8D 7C 24 0D C6 44 24 0C 00 F3 AB 66 AB AA
And patch the JE right below it to NOP
2. Removal of check 1
55 8B EC 81 EC 14 07 00 00 53 56 57 89 6D E8 8B 45 E8 33 DB 8B 48 04
RETN the top of this function
2. Removal of check 2
8B 8D C4 FD FF FF 51 8B 95 C0 FD FF FF 52 8B 85 BC FD FF FF 50 8B 8D B8 FD FF FF 51 8B 95 B4 FD FF FF 52
Change the 2nd JNZ above it to JMP (the first conditioal above this), so
JMP
CMP
JNZ
3. Removal of timer check
81 EC 04 01 00 00 55 8B 2D 54 21 85 00 56 FF D5
RETN the top of this function
4. Multiclient
FF 15 B8 20 85 00 8B F8 3B FB
change the JE above this to JMP
(or search for string FiestaOnlineClient and patch the je above)
5. Change titlebar
String search for FiestaOnline and replace it in data window with yours.
Add 00 bytes to terminate your string.
6. Compress the new EXE:
Download
You must be registered to see links
, then run
upx.exe Fiesta.bin
This will reduce the client size to around 1.5MB instead of 5. Also protects others from stealing your code
~ Csharp
