Q-Protect Anti hack source code

[MisterKid]

Hi,

I thought I release the source code now as I promised it ones
I'm not working on this project anymore so no reason to keep it for myself.
Well I hope you all can use it well or even improve it if you like too
If you are going to use this source don't forget to give me some credits

Source code from my Flyff Source

Functions : [C++] qProtect - Pastebin.com

How I execute them

#ifdef __QUGET_NON_PROTECT_DLL_VERSION
HANDLE_QUGET_ANTI_PACKET = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)QUGET_ANTI_PACKET, 0, 0, 0 );
HANDLE_QUGET_ANTI_SPEED = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)QUGET_ANTI_SPEED, 0, 0, 0 );
HANDLE_QUGET_ANTI_WINM = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)QUGET_ANTI_WINM, 0, 0, 0 );
#endif

This source can be used for most games
Lol its not really big its simple and messy in my view.

Don't forget to like this post for the release

[MentaL]

[AngraMainyu]

If I can break your code by modifying the string table, you're doing it wrong.

Edit: Proxy DLLs.

[MisterKid]

Then improve it? Source is there:p
You don't get the goal for releasing a source code?

[jMerliN]

That's like releasing a hello world as an operating system example and then when someone says "this isn't an operating system" you reply "so improve it, isn't that the point of releasing the source code?"

/facepalm.

[AngraMainyu]

Then improve it? Source is there:p
You don't get the goal for releasing a source code?

That implies that there's something of substance to begin with. That's not to say that your code isn't useful -- it has the makings of a packet editor already -- just that if it cannot protect itself from reversing, it won't protect a game client.

[Improved]

Anywho anyone willing to improve the anti-hack can just go ahead, the source was probably released probably due to it lacking interest for the OP and therefor decide to release it rather than working on it.

[MisterKid]

It helps some people that was my goal. Or it makes people wanting to do more into anti-hacking.
I didn't really like it so i gave up on it a long time ago. And I promised to release the source ones so I did.

@people complaining.
Read

"Well I hope you all can use it well or even improve it if you like too "
Lol its not really big its simple and messy in my view.

[ShadowDragon]

Well, I've been semi-waiting for this, merely because I'm interested in how it works (whether or not it's perfect)

Btw, think you put enough smilies in the first post? o.o

[mikederoobs]

Thanks For the Download I will try to make the antihack better

[MisterKid]

Bump.
The non sourced thread is getting some post and I get bugged on msn/pm's
I do not continue so use the source!

[Intelligence]

Is this source updated or not?

[Improved]

Is this source updated or not?

updated in which way? It haven't been touched since release if that's what you're asking.

[Intelligence]

Ahhh ok. I mean is, the one that developing by misterkid is q-protect 4 and he said in his last post (I think) in the thread were q-protect 4 is 'go to the source of it'. That's why I came here.

[ShadowDragon]

I haven't looked at it, but this was released after q-protect v4, so I'm guessing this is the source for that version.

[Intelligence]

Alright and I see that this has been released after qpro 4.

[MisterKid]

the source is the latest version :P

[Mootie]

Uhhhh...

#1 - Threading in an antihack isn't usually good unless done properly(which requires time checking by the main thread). A hacker can simply suspend your checking threads and your antihack is bypassed. You should have it check in a function that is essential to the game's processing, such as render.

#2 - Why are you using ASM and VirtualProtect at all? You can simply do something like:

DWORD dwAddr = GetProcAddress(hModule, "QueryPerformanceCounter");
if(*((BYTE*)dwAddr) == 0xE9)
...

#3 - This only checks for jmps at the address of the functions. A hacker can also jmp inside the function, or even hook the vtable and bypass any .text section checking completely. Do some research and you can easily find much better methods of detour detection.

#4 - At least check for hooks on ExitProcess/GetProcAddress/GetModuleHandle. Those are also easy ways to bypass this "antihack".

[MisterKid]

Updated link
@ Mootie Ty :P

[Deviant]

hey sir can you add splash thingy?

[MisterKid]

Erm Mootie your way is invalid.
DWORD dwAddr = GetProcAddress(hModule, "QueryPerformanceCounter");
Will get you the function address when the dll has the export.
Kernal32.dll exports QueryPerformanceCounter right?:P

if(*((BYTE*)dwAddr) == 0xE9)
It is not possible to do it like this :P

I found another way to block functions. The new way just replaces the function if it can find the function addres :P But using the same method you be able to bypass the antihack :S (only if you know the function addres) Most Flyff server has their neuzes unpacked so it would be easy to find the addres.

[Mootie]

Erm Mootie your way is invalid.
DWORD dwAddr = GetProcAddress(hModule, "QueryPerformanceCounter");
Will get you the function address when the dll has the export.
Kernal32.dll exports QueryPerformanceCounter right?:P

if(*((BYTE*)dwAddr) == 0xE9)
It is not possible to do it like this :P

I found another way to block functions. The new way just replaces the function if it can find the function addres :P But using the same method you be able to bypass the antihack :S (only if you know the function addres) Most Flyff server has their neuzes unpacked so it would be easy to find the addres.

Why doesn't it work? It seems perfectly valid to me.

dwAddr = DWORD(an x86 address)
dwAddr is cast as a ptr to a BYTE
dwAddr is dereferenced and checked to make sure the function call isn't detoured

It does the exact same thing as what your code does, except less mess and performance overhead. The only thing that doesn't work about it is if the hacker uses a non-standard detour that doesn't use the 0xE9 instruction, but yours doesn't protect against this either. VirtualProtect is completely unnecessary to check the text section of a normal loaded module.

[MisterKid]

getproc doesnt really return a Dword. But I try converting it and test it again .
:p just interested in it agaib lol
Posted via Mobile Device

[Yazzn]

some ideas:
Let your anticheat scan itself and the Neuz.exe for modifications.

Let your anticheat send some crypted information to the server, which kicks/bans the user, if the informations are not valid / sent.

Create a driver, which blocks ZwOpenProcess, ZwReadProcessMemory, ZwWriteProcessMemory, etc..

Ignore jmps at the begging of a function (this isn't really efficient, because you still can hook in the mid of the function)
example

int QueryPerformanceCounter_real = (DWORD)GetProcAddress(GetModuleHandle("Kernel32.dll"), "QueryPerformanceCounter") + 5;
__declspec(naked) BOOL WINAPI QueryPerformanceCounter_proxy(LARGE_INTEGER *lpPerformanceCount)
{
	__asm
	{
		mov edi, edi
		push ebp
		mov ebp, esp
		jmp [QueryPerformanceCounter_real]
	}
}

[jvscrptr]

make it minimized to tray when opened =))

[guemebr123]

Which version should I use visual studio?

2003 not open