Some People are unsure if they should use a crypted DLL.
I improved my asm knowledge a little bit during the last time, so i was able to find out some informations out of the dll even it is it crypted, well its much harder to find informations, but its not impossible : P
Text strings referenced that i found:
Code:
Address Disassembly Text string
60C61022 TEST BYTE PTR SS:[EBP+8],1 (Initial CPU selection)
60C612B7 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C61341 PUSH 1vs1.60C6E3A4 ASCII "invalid string position"
60C61379 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C61415 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C6146A PUSH 1vs1.60C6E3A4 ASCII "invalid string position"
60C61960 PUSH 1vs1.60C6E3F0 ASCII "%X"
60C621E1 PUSH 1vs1.60C6E408 ASCII "Problem while loading (%s) on line %d. You forgot about equal (=)."
60C62D01 PUSH 1vs1.60C6E408 ASCII "Problem while loading (%s) on line %d. You forgot about equal (=)."
60C630F6 PUSH 1vs1.60C6E458 ASCII "Do not have winner for 1 vs 1 tournament."
60C63110 PUSH 1vs1.60C6E44C ASCII "1vs1.txt"
60C632CE MOV EAX,1vs1.60C6E484 ASCII "WinnerRewardAmount"
60C632FC MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C63325 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C63359 MOV EAX,1vs1.60C6E4B0 ASCII "WinnerRewardIndex"
60C63382 MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C633AB MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C6345C PUSH 1vs1.60C6E4C4 ASCII " won 1 vs 1 tournament."
60C634BA PUSH 1vs1.60C6E44C ASCII "1vs1.txt"
60C63A87 PUSH 1vs1.60C6E44C ASCII "1vs1.txt"
60C63A95 PUSH 1vs1.60C6E44C ASCII "1vs1.txt"
60C63A9A PUSH 1vs1.60C6E4DC ASCII "temp.txt"
60C63E50 PUSH 1vs1.60C6E44C ASCII "1vs1.txt"
60C63E5E PUSH 1vs1.60C6E44C ASCII "1vs1.txt"
60C63E63 PUSH 1vs1.60C6E4DC ASCII "temp.txt"
60C64013 PUSH 1vs1.60C6E4EC ASCII " will start in 15 seconds."
60C6401F PUSH 1vs1.60C6E508 ASCII " and "
60C64031 PUSH 1vs1.60C6E510 ASCII "Battle between "
60C64746 MOV EAX,1vs1.60C6E520 ASCII "Index"
60C6476D MOV EAX,1vs1.60C6E528 ASCII "Quest"
60C64797 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C647E9 MOV ECX,1vs1.60C6E44C ASCII "1vs1.txt"
60C6496F PUSH 1vs1.60C6E570 ASCII "#Successfully registered to 1 vs 1 tournament."
60C64974 PUSH 1vs1.60C6E560 ASCII "<Server>"
60C64979 PUSH 1vs1.60C6E56C ASCII "ss"
60C649BE PUSH 1vs1.60C6E530 ASCII "#You already registered to 1 vs 1 tournament."
60C649C3 PUSH 1vs1.60C6E560 ASCII "<Server>"
60C649C8 PUSH 1vs1.60C6E56C ASCII "ss"
60C64A03 PUSH 1vs1.60C6E5A0 ASCII "#You can not register to 1 vs 1 tournament while it is running."
60C64A08 PUSH 1vs1.60C6E560 ASCII "<Server>"
60C64A0D PUSH 1vs1.60C6E56C ASCII "ss"
60C64A22 PUSH 1vs1.60C6E5E0 ASCII "#It is not time to register for 1 vs 1 tournament."
60C64A27 PUSH 1vs1.60C6E560 ASCII "<Server>"
60C64A2C PUSH 1vs1.60C6E56C ASCII "ss"
60C64B81 MOV ECX,1vs1.60C6E614 ASCII "/1vs1registeron"
60C64BDA PUSH 1vs1.60C6E624 ASCII "&1 vs 1 tournament registration enabled."
60C64BDF PUSH 1vs1.60C6E560 ASCII "<Server>"
60C64BE4 PUSH 1vs1.60C6E56C ASCII "ss"
60C64BFA PUSH 1vs1.60C6E650 ASCII "1 vs 1 tournament registration enabled."
60C64C45 MOV ECX,1vs1.60C6E678 ASCII "/1vs1registeroff"
60C64C9E PUSH 1vs1.60C6E68C ASCII "#1 vs 1 tournament registration disabled."
60C64CA3 PUSH 1vs1.60C6E560 ASCII "<Server>"
60C64CA8 PUSH 1vs1.60C6E56C ASCII "ss"
60C64CBE PUSH 1vs1.60C6E6B8 ASCII "1 vs 1 tournament registration disabled."
60C64D16 MOV ECX,1vs1.60C6E6E4 ASCII "/suicide"
60C64DC5 MOV ECX,1vs1.60C6E6F0 ASCII "/1vs1start"
60C64E38 PUSH 1vs1.60C6E6FC ASCII "#1 vs 1 tournament already started, you can not re-start it."
60C64E3D PUSH 1vs1.60C6E560 ASCII "<Server>"
60C64E42 PUSH 1vs1.60C6E56C ASCII "ss"
60C64E95 PUSH 1vs1.60C6E73C ASCII "&1 vs 1 tournament started. (Coded By R3volutioN)"
60C64E9A PUSH 1vs1.60C6E560 ASCII "<Server>"
60C64E9F PUSH 1vs1.60C6E56C ASCII "ss"
60C64EC1 PUSH 1vs1.60C6E770 ASCII "1 vs 1 tournament started. (Coded By R3volutioN)"
60C653FA MOV EAX,1vs1.60C6E7A4 ASCII "Draw, both player eliminated from 1 vs 1 tournament."
60C65493 PUSH 1vs1.60C6E7DC ASCII "Coded and released by R3volutioN"
60C65498 PUSH 1vs1.60C6E800 ASCII "%s"
60C654D1 MOV EAX,1vs1.60C6E804 ASCII "RegistrationStart"
60C654FA MOV EAX,1vs1.60C6E818 ASCII "Start"
60C65524 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C65644 PUSH 1vs1.60C6E650 ASCII "1 vs 1 tournament registration enabled."
60C65682 MOV EAX,1vs1.60C6E820 ASCII "1vs1Start"
60C656AF MOV EAX,1vs1.60C6E818 ASCII "Start"
60C656D9 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C65807 PUSH 1vs1.60C6E770 ASCII "1 vs 1 tournament started. (Coded By R3volutioN)"
60C6598B PUSH 1vs1.60C6E830 ASCII " not avalible to fight both player eliminated from 1 vs 1 tournament."
60C65997 PUSH 1vs1.60C6E508 ASCII " and "
60C65ACB PUSH 1vs1.60C6E878 ASCII " won the battle."
60C65B32 MOV ECX,1vs1.60C6E44C ASCII "1vs1.txt"
60C65C2C MOV EAX,1vs1.60C6E88C ASCII "RoundReward"
60C65C31 MOV EBX,1vs1.60C6E3E8 ASCII "true"
60C65C62 MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C65C93 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C65CFE MOV EAX,1vs1.60C6E898 ASCII "RoundRewardAmount"
60C65D19 MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C65D34 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C65D5A MOV EAX,1vs1.60C6E8AC ASCII "RoundRewardIndex"
60C65D75 MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C65D90 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C65EEB PUSH 1vs1.60C6E878 ASCII " won the battle."
60C65F58 MOV ECX,1vs1.60C6E44C ASCII "1vs1.txt"
60C66056 MOV EAX,1vs1.60C6E88C ASCII "RoundReward"
60C6605B MOV EBX,1vs1.60C6E3E8 ASCII "true"
60C6608C MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C660BD MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C66146 MOV EAX,1vs1.60C6E898 ASCII "RoundRewardAmount"
60C66161 MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C6617C MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C661A2 MOV EAX,1vs1.60C6E8AC ASCII "RoundRewardIndex"
60C661BD MOV EAX,1vs1.60C6E498 ASCII "Reward"
60C661D8 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C66639 PUSH 1vs1.60C6E8C0 ASCII "dd"
60C66671 PUSH 1vs1.60C6E8C0 ASCII "dd"
60C666C8 PUSH 1vs1.60C6E8C4 ASCII "bbss"
60C6685A MOV EAX,1vs1.60C6E8CC ASCII "Reduce"
60C6687E MOV EAX,1vs1.60C6E8D4 ASCII "Damage"
60C668A8 MOV EAX,1vs1.60C6E4A0 ASCII "1vs1config.txt"
60C67289 MOV ECX,1vs1.60C6E44C ASCII "1vs1.txt"
60C675D6 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C67906 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C67DFF MOV ECX,1vs1.60C6E4DC ASCII "temp.txt"
60C67F06 MOV ECX,1vs1.60C6E44C ASCII "1vs1.txt"
60C683ED PUSH 1vs1.60C6E3BC ASCII "string too long"
60C68401 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C688FF PUSH 1vs1.60C6E3BC ASCII "string too long"
60C68B6F PUSH 1vs1.60C6E8DC ASCII "bad cast"
60C6912F PUSH 1vs1.60C6E8DC ASCII "bad cast"
60C691B1 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C69537 PUSH 1vs1.60C6E3BC ASCII "string too long"
60C6954A PUSH 1vs1.60C6E3BC ASCII "string too long"
Mainserver calls wich i found:
Code:
MOV EDX,45CC90 //CPlayer__Teleport
MOV EDX,44A4E0 //CPlayer__SubEState
MOV EAX,44A510 //CPlayer__IsEState
MOV EAX,40B870 //CChar__CancelBuffPrty
MOV EDX,43A200 //Char__GetMaxHP
MOV EDX,44A4E0 //CPlayer__SubEState
MOV EDX,43AF90 //CChar__GetMaxMP
MOV EDX,409910 //CChar__AddGState
MOV EAX,40B870 //CChar__CancelBuffPrty
MOV EDX,43AF90 //CChar__GetMaxMP
MOV EDX,4328C0 //Console__Write__Red
MOV EDX,450890 //CPlayer__FindPlayer
MOV EDX,40B280 //CChar__IsNormal
MOV EDX,40B4A0 //CChar___FindBuff
MOV EAX,40B310 //CChar__IsGState
MOV EDX,40B6A0 //CChar__CancelBuff
MOV EDX,40B4A0 //CChar___FindBuff
MOV EDX,45CC90 //CPlayer__Teleport
MOV EDX,406490 //CBuffPrtyEx__CBuffPrtyEx
Some Packets and _beginthread detection:
Code:
Example:
60C666B6 . 83C7 20 ADD EDI,20
60C666B9 . 83C6 20 ADD ESI,20
60C666BC . 8D6424 00 LEA ESP,DWORD PTR SS:[ESP]
60C666C0 > 8B03 MOV EAX,DWORD PTR DS:[EBX]
60C666C2 . 57 PUSH EDI
60C666C3 . 56 PUSH ESI
60C666C4 . 6A 05 PUSH 5
60C666C6 . 6A 41 PUSH 41
60C666C8 . 68 C4E8C660 PUSH 1vs1.60C6E8C4 ; ASCII "bbss"
60C666CD . 6A 44 PUSH 44
60C666CF . 50 PUSH EAX
60C666D0 . B9 602E4500 MOV ECX,452E60 ; CPlayer__Write
60C666D5 . FFD1 CALL ECX
60C666D7 . 83C4 1C ADD ESP,1C
Example:
60C66630 . 8B47 1C MOV EAX,DWORD PTR DS:[EDI+1C]
60C66633 . 68 80000000 PUSH 80
60C66638 . 50 PUSH EAX
60C66639 . 68 C0E8C660 PUSH 1vs1.60C6E8C0 ; ASCII "dd"
60C6663E . 6A 2E PUSH 2E
60C66640 . 57 PUSH EDI
60C66641 . B9 602E4500 MOV ECX,452E60 ; CPlayer__Write
60C66646 . FFD1 CALL ECX
Example:
60C6539E |. 8B83 EC050000 MOV EAX,DWORD PTR DS:[EBX+5EC]
60C653A4 |. 6A 07 PUSH 7
60C653A6 |. 6A 04 PUSH 4
60C653A8 |. 6A 04 PUSH 4
60C653AA |. 50 PUSH EAX
60C653AB |. BA 40094600 MOV EDX,460940 ; CPlayer__EndPvP
Example:
60C64BDA |. 68 24E6C660 PUSH 1vs1.60C6E624 ; ASCII "&1 vs 1 tournament registration enabled."
60C64BDF |. 68 60E5C660 PUSH 1vs1.60C6E560 ; ASCII "<Server>"
60C64BE4 |. 68 6CE5C660 PUSH 1vs1.60C6E56C ; ASCII "ss"
60C64BE9 |. 6A 3C PUSH 3C
60C64BEB |. 57 PUSH EDI
60C64BEC |. BA 602E4500 MOV EDX,452E60 ; CPlayer__Write
Example:
60C66936 |. 50 PUSH EAX ; /arg; Case 1 of switch 60C66926
60C66937 |. 50 PUSH EAX ; |stksize
60C66938 |. 68 4054C660 PUSH 1vs1.60C65440 ; |start = 1vs1.60C65440
60C6693D |. FF15 2C283D15 CALL DWORD PTR DS:[153D282C] ; \_beginthread
60C66943 |. 83C4 0C ADD ESP,0C
It seems that the DLL is okay and that there is no Backdoor in it, im 99% sure, that this one is save to use. Good Job R3volutioN : )