@124641469hh: All clients are a little different. The last Japanese one I looked at, the correct terminate process Call was not the second in the list, last Vietnamese one I did took considerable removing of routines associated with XTrap, and recent English and Brazilian ones have just been a complete arse.
I did a couple of Chinese ones, and they seemed... different, but reasonably similarly straight forward. From my recollection.
@Vader: Yes, I thought so. But the idea that it could be used to bypass security on official servers may mean it is not appropriate to share on RZ any more.
The release was made a long time ago, by... nguyson(??, don't think that's right) I remember seeing it on SONNB (UnderworldVN) originally, but I ran across a RZ release of it the other day as I was scanning for where I am up to with cleaning old threads. I would have added it to the releases sub-forum there and then, but it's nothing but dead links and a description of how it did what it did.
Since the download is gone, I couldn't compare the description with observation, or use observation to commit the description to memory. It sounded like it would launch game.exe within it's process space, call the checkfunc hashing routine(s), and memorise their result, then patch out XTrap "in-memory" and replace the hashing routines with ones which simply return the stored result.
As I say, it is (was) old, and designed for PTVn. How adaptable it was I really couldn't say. I've known some very good crackers (the likes of Razor1911 & Fairlight) who have developed very good code pattern matching algorithms over the decades. (I think some of them seem better than the ones used in most popular virus scanners, but maybe they have other design considerations IDK)Spoiler:
