Main CheckSum.dat Generator

[Deathway]

This time i present a new way to prevent main modding - cracking, to use this you must know some asm knowledge.

Level of Protection against crack - weak-medium

How to use it:

1.- Download the File

http://www.fileserve.com/file/5hzE8qt
http://www.megaupload.com/?d=2J2MX5HC

2.- Open your main.exe and click generate. After some minutes it will produce the CheckSum.dat file (YES the program works VERY SLOW)

3.- Paste that file on lang\jpn folder in my case ( in your could be lang\kor : according to your Language set on commonserver.cfg)

4.- Fix the GS

The function CGCheckMainRecv should be like this ( in case that gs don't have PDB you should search with Search all referenced strings and find "error-L1 : [%s][%s] CheckSum-Exe error " (in case of GS-JPN)

CGCheckMa>/> \55            PUSH EBP
00431B61  |.  8BEC          MOV EBP,ESP
00431B63  |.  83EC 40       SUB ESP,40
00431B66  |.  53            PUSH EBX
00431B67  |.  56            PUSH ESI
00431B68  |.  57            PUSH EDI                                 ;  ntdll.7C910738
00431B69  |.  68 B8536B00   PUSH OFFSET GameServ.??_C@_0P@HPBC@218?4>; /s2 = "218.234.76.254"
00431B6E  |.  8B45 0C       MOV EAX,[ARG.aIndex]                     ; |
00431B71  |.  69C0 68190000 IMUL EAX,EAX,1968                        ; |
00431B77  |.  05 90F06006   ADD EAX,GameServ.0660F090                ; |
00431B7C  |.  50            PUSH EAX                                 ; |s1 = NULL
00431B7D  |.  E8 DE771600   CALL GameServ._strcmp                    ; \_strcmp
00431B82  |.  83C4 08       ADD ESP,8
00431B85  |.  85C0          TEST EAX,EAX
00431B87  |.  75 28         JNZ SHORT GameServ.00431BB1
00431B89  |.  8B4D 0C       MOV ECX,[ARG.aIndex]
00431B8C  |.  69C9 68190000 IMUL ECX,ECX,1968
00431B92  |.  C781 D8F06006>MOV DWORD PTR DS:[ECX+660F0D8],0
00431B9C  |.  8B55 0C       MOV EDX,[ARG.aIndex]
00431B9F  |.  69D2 68190000 IMUL EDX,EDX,1968                        ;  ntdll.KiFastSystemCallRet
00431BA5  |.  C682 B9FF6006>MOV BYTE PTR DS:[EDX+660FFB9],1
00431BAC  |.  E9 F8000000   JMP GameServ.00431CA9
00431BB1  |>  8B45 0C       MOV EAX,[ARG.aIndex]
00431BB4  |.  69C0 68190000 IMUL EAX,EAX,1968
00431BBA  |.  0FBF88 D4F060>MOVSX ECX,WORD PTR DS:[EAX+660F0D4]
00431BC1  |.  85C9          TEST ECX,ECX
00431BC3  |.  7C 17         JL SHORT GameServ.00431BDC
00431BC5  |.  8B55 0C       MOV EDX,[ARG.aIndex]
00431BC8  |.  69D2 68190000 IMUL EDX,EDX,1968                        ;  ntdll.KiFastSystemCallRet
00431BCE  |.  0FBF82 D4F060>MOVSX EAX,WORD PTR DS:[EDX+660F0D4]
00431BD5  |.  3D FF030000   CMP EAX,3FF
00431BDA  |.  7E 3F         JLE SHORT GameServ.00431C1B
00431BDC  |>  8B4D 0C       MOV ECX,[ARG.aIndex]
00431BDF  |.  69C9 68190000 IMUL ECX,ECX,1968
00431BE5  |.  81C1 EBF06006 ADD ECX,GameServ.0660F0EB
00431BEB  |.  51            PUSH ECX
00431BEC  |.  8B55 0C       MOV EDX,[ARG.aIndex]
00431BEF  |.  69D2 68190000 IMUL EDX,EDX,1968                        ;  ntdll.KiFastSystemCallRet
00431BF5  |.  81C2 E0F06006 ADD EDX,GameServ.0660F0E0
00431BFB  |.  52            PUSH EDX                                 ;  ntdll.KiFastSystemCallRet
00431BFC  |.  68 88536B00   PUSH OFFSET GameServ.??_C@_0CI@DJHJ@erro>;  ASCII "error-L1 : [%s][%s] CheckSum-Exe error "
00431C01  |.  FF15 34993506 CALL DWORD PTR DS:[LogAdd]
00431C07  |.  83C4 0C       ADD ESP,0C
00431C0A  |.  8B45 0C       MOV EAX,[ARG.aIndex]
00431C0D  |.  50            PUSH EAX
00431C0E  |.  E8 33F4FCFF   CALL GameServ.00401046
00431C13  |.  83C4 04       ADD ESP,4
00431C16  |.  E9 8E000000   JMP GameServ.00431CA9
00431C1B  |>  8B4D 0C       MOV ECX,[ARG.aIndex]
00431C1E  |.  69C9 68190000 IMUL ECX,ECX,1968
00431C24  |.  0FBF91 D4F060>MOVSX EDX,WORD PTR DS:[ECX+660F0D4]
00431C2B  |.  8B45 08       MOV EAX,[ARG.lpMsg]                      ;  GameServ.<ModuleEntryPoint>
00431C2E  |.  8B0C95 AC6CF4>MOV ECX,DWORD PTR DS:[EDX*4+dwgCheckSum]
00431C35  |.  3B48 04       CMP ECX,DWORD PTR DS:[EAX+4]
00431C38  |.  74 5C         JE SHORT GameServ.00431C96
00431C3A  |.  8B55 0C       MOV EDX,[ARG.aIndex]
00431C3D  |.  69D2 68190000 IMUL EDX,EDX,1968                        ;  ntdll.KiFastSystemCallRet
00431C43  |.  81C2 E0F06006 ADD EDX,GameServ.0660F0E0
00431C49  |.  52            PUSH EDX                                 ;  ntdll.KiFastSystemCallRet
00431C4A  |.  8B45 0C       MOV EAX,[ARG.aIndex]
00431C4D  |.  69C0 68190000 IMUL EAX,EAX,1968
00431C53  |.  0FBF88 D4F060>MOVSX ECX,WORD PTR DS:[EAX+660F0D4]
00431C5A  |.  51            PUSH ECX
00431C5B  |.  8B55 08       MOV EDX,[ARG.lpMsg]                      ;  GameServ.<ModuleEntryPoint>
00431C5E  |.  8B42 04       MOV EAX,DWORD PTR DS:[EDX+4]
00431C61  |.  50            PUSH EAX
00431C62  |.  8B4D 0C       MOV ECX,[ARG.aIndex]
00431C65  |.  69C9 68190000 IMUL ECX,ECX,1968
00431C6B  |.  0FBF91 D4F060>MOVSX EDX,WORD PTR DS:[ECX+660F0D4]
00431C72  |.  8B0495 AC6CF4>MOV EAX,DWORD PTR DS:[EDX*4+dwgCheckSum]
00431C79  |.  50            PUSH EAX
00431C7A  |.  68 54536B00   PUSH OFFSET GameServ.??_C@_0CM@KMJI@erro>;  ASCII "error-L1 : CheckSum-Exe error %d %d %d [%s]"
00431C7F  |.  FF15 2C993506 CALL DWORD PTR DS:[LogAddTD]
00431C85  |.  83C4 14       ADD ESP,14
00431C88  |.  8B4D 0C       MOV ECX,[ARG.aIndex]
00431C8B  |.  51            PUSH ECX
00431C8C  |.  E8 B5F3FCFF   CALL GameServ.00401046
00431C91  |.  83C4 04       ADD ESP,4
00431C94  |.  EB 13         JMP SHORT GameServ.00431CA9
00431C96  |>  8B55 0C       MOV EDX,[ARG.aIndex]
00431C99  |.  69D2 68190000 IMUL EDX,EDX,1968                        ;  ntdll.KiFastSystemCallRet
00431C9F  |.  C782 D8F06006>MOV DWORD PTR DS:[EDX+660F0D8],0
00431CA9  |>  5F            POP EDI                                  ;  kernel32.7C816FD7
00431CAA  |.  5E            POP ESI                                  ;  kernel32.7C816FD7
00431CAB  |.  5B            POP EBX                                  ;  kernel32.7C816FD7
00431CAC  |.  8BE5          MOV ESP,EBP
00431CAE  |.  5D            POP EBP                                  ;  kernel32.7C816FD7
00431CAF  \.  C3            RETN

Normally the command affected is this

00431C38  |. /74 5C         JE SHORT GameServ.00431C96

often is changed to JMP or to JNZ to prevent disconnection, you must restore it to JE ( in other cases i saw that the function has a RET on the beginning, other remove the call to the function, be creative to restore to the original function that i posted above)

5.- How it works: the original main send a Checksum Value to GS and the GS check it, if it match it continue sending packets, if not it disconnects you. On all the gs, this function is wrong, as i explain, so the task is restore it, once it is done, the original checksum from webzen will again do its task :)

Cya

[MentaL]

[iBimbo]

Useful :)

Approved.

[DenimKo]

work only on jpn protocol?

[Gembrid]

work only on jpn protocol?

it should work for all GSes, doedn't matter on version and protocol

[Vengeful]

so what does this program is doing?

[Gembrid]

so what does this program is doing?

generates checksum.dat file of main.exe

[Disconnect1]

When i double clicking nothing happends :/

[CiberGame]

thank you very much

[zolamu]

thanks bro

[Areskoi]

Thanks Deathway. This is awesome! Tested and it works. GS 1.00.16.

[Klivert]

It

[mayojung]

Nice

how to make gg server ?

[SkyLinE27]

Thanks.Nice job :)

[penihop]

The time of this checksum finally came xD
5/5 :)

[vcorp]

cool , tnx for sharing this method ;)