Remove file check for cabalmain ver 374.

[Tmxx Rush]

I am having issues with removing the enc check and running the cabalmain with husky parameter.

I did follow PunkS7yle:

004A0C84   . 74 0D          JE SHORT cabalmai.004A0C93      -------> NOP
004A0C86   . 85C0           TEST EAX,EAX
004A0C88   . 74 09          JE SHORT cabalmai.004A0C93      -------> NOP

changed JE SHORT cabalmai.004A0C93 on 004A0C84 and JE SHORT cabalmai.004A0C93 004A0C88 to NOP with the Fill with NOP's checkbox checked and also tried it unchecked then clicked on assemble on both then right clicked on CPU window -> copy to executable -> all modifications -> copy all then a new window will appear. then save file.

launched cabalmain with husky parameter and I get an error the game will close to receive an update.

like 100 times posted change ur version in server+db ... -_-

 

[magraopb]

CabalMain -> "Check xdata.enc"
CabalMain -> "Check Xor Keys"
CabalMain -> "Check MagicKey"
xdata.enc -> "Check MD5 MCL files"

Punk,
Can you tell us if have more step on this model or have any wrong step?
just for knowleadge

ex:
CabalMain -> "All Checks"
xdata -> "All Checks"

 

[Drav3n]

Yes it will.

so, no other option to protect against mcl patcher for wallhack? if i used punks7yle cabalmain and removed check, everyone are free to use the wallhack

 

[PunkS7yle]

so, no other option to protect against mcl patcher for wallhack? if i used punks7yle cabalmain and removed check, everyone are free to use the wallhack

Write a small dll to get hash of current map file and compare against a list of hashes, poop's easy.

 

[Drav3n]

Write a small dll to get hash of current map file and compare against a list of hashes, poop's easy.

Sorry punk, we are not on same level. i know its easy on you.

Only google can help on what you said. Thanks for the tip punk.

 

[magraopb]

Punk,

Can u tell us if we can pack cabalmain like EP2 (With themida, Winlicense.. or other), to prevent dll injections?
In cabalmain 369 i can't use dll injection, but in 374 i can.

i'm trying pack 374 with themida and WinLicense... but keep able to inject dll

thanks

 

[EliteOP]

Uhm .. Question: When you hit space on the expression, it pops up with a window..

Would you replace: JE SHORT 004A0C93 with NOP?

or tick the "Fill with NOP's" box and press assemble?

or add NOP to comments?

I don't even see copy to executable .. this is all so confusing. Please someone help me.

 

[toast2250]

Replace with NOP and ignore the tick box. How to save is already described.

 

[EliteOP]

Replace with NOP and ignore the tick box. How to save is already described.

I read your instructions on how to save, but I can't find where the "Copy to executable" is ..

 

[toast2250]

Just press right mouse button on code window, choose "copy to executable" -> "All modifications", press copy all, when a new window has opened, just press right mouse button and press "save file" =) It should help u =)

You must be registered to see links

 

[Dairo123]

Can't find this Option.. even with Ollydbg Advanced Plugin and bugfix.

 

[kelly2009]

Help!! remove file check for cabalmain ver 369

 

[PunkS7yle]

Post the main.

 

[kelly2009]

I use this client TGCABAL Ep8 (v369)
I want to remove file check for cabalmain (TGCabalEp8)
I can not find the offset you can help me?
Because it item.enc error: (, non understood at sao item.enc, cabalmain.exe is not found.
Sorry I do not speak good english

 

[cadena]

Read again slowly

 

[PunkS7yle]

I use this client TGCABAL Ep8 (v369)
I want to remove file check for cabalmain (TGCabalEp8)
I can not find the offset you can help me?
Because it item.enc error: (, non understood at sao item.enc, cabalmain.exe is not found.
Sorry I do not speak good english

You didn't do it right.

 

[Darkforcex]

im having a problem my cabal client closes automatically after 10sec of being open :/

 

[VirVir99]

sir punk can you give the right link of the program to use?? i have error when i try to open cabalmain on the one i downloaded.

 

[ShadowGohan]

Uhm .. Question: When you hit space on the expression, it pops up with a window..

Would you replace: JE SHORT 004A0C93 with NOP?

or tick the "Fill with NOP's" box and press assemble?

or add NOP to comments?

I don't even see copy to executable .. this is all so confusing. Please someone help me.

Use OllyDbg Shadow, there you will find 'Copy to executable' for sure.
Just sayin..

 

[tizacup]

what is problem ? i remove file check cabalmain how is this item ? before i install patch Darkstealmain Put item.enc i cannot start cabalmain corrupted i use original tg client ep8 it show ?

You must be registered to see links

helpme ? TT