Printable View
DLL only works with WindowNT or above.
DLL works for any mains.
DLL is easy to hook.
It runs every 5 seconds.
-----
Some pic :
https://www.upsieutoc.com/images/201.../DLLreduce.png
Link down:http://www.mediafire.com/download/p8...BEnt%28%29.rar
Proof of cleaness:
https://www.virustotal.com/en/file/1...is/1419910189/
----
For some people dll doesnt work... please download this http://www.mediafire.com/download/jm...redist_x86.exe
Install then reboot and everything should work fine
What exactly does this DLL do? As in code wise. I'd be afraid to hook this for reasons that concern account theft and/or private botnet collection.
Work only RAM reducing
Before:
http://i.imgur.com/VLYE6Vo.png
After:
http://i.imgur.com/S498WB2.png
Spoiler:
its codex anti cheat with thread priority .... and some system functions optimization .Quote:
Originally Posted by Wortex
build in anti cheat - server side so its unsafe to use .
you can decompile it and see the code .
Post the decompiled code here if you've managed to do that @boncha.
For some people dll doesnt work... please download this http://www.mediafire.com/download/jm...redist_x86.exe
Install then reboot and everything should work fine
-----
About CPU it only reduce a small portion because it depends on main too...Quote:
Originally Posted by psychedelic
The reason for memory reduces a lot because the original main is really light, after packing it dump a huge amount of fake memory into main. Therefore my function will take those fake memory from packing away... leaving the original size...
You can release sources?
sorry cus of cheap packingQuote:
Originally Posted by jeronemo6666
Don't trusth it. has a FTP function and stuff.
Packed with: MPress
Here's the patched DLL (isDebugger removed): https://www.mediafire.com/?xd4yb02eyrbkg5j
Too lazy to unpack, sry lol
Avira TR/Crypt.XPACK.Gen3 20150104
Ikarus Trojan.Crypt 20150104
Qihoo-360 Win32/Trojan.160 20150104
is safe to use or not??Quote:
Originally Posted by jeronemo6666
I do not know myself I want to learn
Those are not viruses. It's because of a shitty packer (MPress) that it reports them as having malicious code.
@jackbot release unpacked DLL to save us both the trouble or should I unpack and post the source here?
I'm not interested in the Codex anti cheat stuff. The functions that optimize the game is what interests me. (Or you could just PM me)
(Hex Rays and IDA + ODBG aka Ollydbg 110) use JBEnt.dll or JBEnt_patched.dll
Same effect in jackbot (anyway thanks for good stuff man!)
code in JBEnt.dll or JBEnt_patched.dll
Code:74557CE9 |. 6A 00 PUSH 0 ; /pThreadId = NULL
74557CEB |. 6A 00 PUSH 0 ; |CreationFlags = 0
74557CED |. 6A 00 PUSH 0 ; |pThreadParm = NULL
74557CEF |. 68 10B15574 PUSH JBEnt_pa.7455B110 ; |ThreadFunction = JBEnt_pa.7455B110
74557CF4 |. 6A 00 PUSH 0 ; |StackSize = 0
74557CF6 |. 6A 00 PUSH 0 ; |pSecurity = NULL
74557CF8 |. FFD6 CALL ESI ; \CreateThread
You must compile. and inject or hooked dll.Code:7455B110 . 53 PUSH EBX
7455B111 . 8B1D 4CD05574 MOV EBX,DWORD PTR DS:[<&KERNEL32.SetProc>; KERNEL32.SetProcessWorkingSetSize
7455B117 . 56 PUSH ESI
7455B118 . 8B35 44D05574 MOV ESI,DWORD PTR DS:[<&KERNEL32.GetCurr>; KERNEL32.GetCurrentProcess
7455B11E . 57 PUSH EDI
7455B11F . 8B3D 78D05574 MOV EDI,DWORD PTR DS:[<&KERNEL32.Sleep>] ; KERNEL32.Sleep
7455B125 > 68 88130000 PUSH 1388
7455B12A . FFD7 CALL EDI
7455B12C . 6A FF PUSH -1
7455B12E . 6A FF PUSH -1
7455B130 . FFD6 CALL ESI
7455B132 . 50 PUSH EAX
7455B133 . FFD3 CALL EBX
7455B135 . 6A FE PUSH -2
7455B137 . FFD6 CALL ESI
7455B139 . 50 PUSH EAX ; |hThread
7455B13A . FF15 48D05574 CALL DWORD PTR DS:[<&KERNEL32.SetThreadP>; \SetThreadPriority
7455B140 .^EB E3 JMP SHORT JBEnt_pa.7455B125
Source:
Code:#include <Windows.h>
void cpu(){
HANDLE v1;
HANDLE v2;
while ( 1 )
{
Sleep(5000);
v1 = GetCurrentProcess();
SetProcessWorkingSetSize(v1, 0xFFFFFFFF, 0xFFFFFFFF);
v2 = GetCurrentProcess();
SetThreadPriority(v2, -2);
}
}
BOOL APIENTRY DllMain(HMODULE hM, DWORD dwR, LPVOID lpR)
{
if(dwR == 0x01)
{
CreateThread(NULL,NULL,LPTHREAD_START_ROUTINE(cpu),NULL,0,0);
}
return true;
}
I test in 1.04E GMO.
Maybe help.
Voila.
Quote:
Originally Posted by Azuriw
Yead im noob at protection... btw why u guys wasting time to decomplie where there is google.com.... Do more research and u will find it right away(understand more)
More swaping, how can someone might think this is good? really?
do so would Virustotal was 0/56
does not want that antivirus swears on file
- - - Updated - - -
Can somehow do not have antivirus swears on this file?
Quote:
Originally Posted by jeronemo6666
I do .... virus is becuase i have to pack dll ... I'm using cheap packer i guess... if u know how a good program packing ill pack it with 0 virus for u
I need DLL on which anti-virus does not swear
Does anyone have?
Quote:
Originally Posted by Wortex
What a joke... threading me and shit... go ahead release it ... i dont give a fuck.....
These code is just 10 minutes of research..... How about save ur time on unpack and research it on google
See i have a lot of good stuffs wanted to share here.. but people like this make me so disappointed ...
something like this:
https://www.youtube.com/watch?v=pX6B...ature=youtu.be
This minimizer is good idea, i should implement this in my cheat :D
No one threatened you. If you misunderstood, I'll rephrase: I asked for you to release an unpacked dll so that people would stop getting malicious virus results.
The Codex anti cheat stuff is seriously not needed, it's bad and not only that, it's easily bypassed. Anyways, this is the same trick used by older generation Mu's where you set the affinity and priorities of the process to 1 CPU and low alloc. This helps decrease the consumption of resources for 1.04D < Versions because S6E3 already has CPU management (not great one, but still). About the ram, it's a risky thing to do as you'll see from testing, random parts of the game will start to jitter or load longer due to memory swapping.
Why I asked for the source is that I thought you came up with some other solution. Thats all man. Jeez lol.
share you source ?
is this really working? :drool:
yea for me is working is decrease ram memory usedQuote:
Originally Posted by jhesociety