DriftCity Client

Printable View

30-01-11
Fyyre

DriftCity Client

Here is a brief 'howto' I wrote:

Quote:

This 'howto' assumes you are capible of unpacking Asprotect on your own. Or are making some dll to patch memory.

If having trouble, here is some detail for you:

0x43CC84 <<-- OEP

PUSH 74
PUSH DriftCit.0089D488
CALL DriftCit.0083CFDC
XOR EBX, EBX
MOV DWORD PTR SS:[EBP-20], EBX
PUSH EBX
MOV EDI, DWORD PTR DS:[86C0EC] ; kernel32.GetModuleHandleA
CALL EDI
CMP WORD PTR DS:[EAX], 5A4D
JNZ SHORT DriftCit.0083CCC4
MOV ECX, DWORD PTR DS:[EAX+3C]

searching for 66 81 38 4D 5A 75 1F 8B 48 3C 03 C8 81 39 50 45 00 00 75 12 0F B7 41 18 3D 0B 01 00 00 74 1F 3D 0B 02 00 00 74 05 from within
context of DriftCity.exe will bring you to the OEP.

Now, let us remove the launcher nag we get when attempt to start DriftCity.exe directly.

Start from WinMain. If you are unable to locate... search for binary pattern: 83 C4 04 B0 01 C3 B8 38 11 00 00

function begins with:

mov eax, 0x1138

once here, scroll down the disasm a bit...

notice the error messages "HanAuthForClient.dll not found.", "This program needs to be started from game homepage.", etc...

Skipping to the point (if know what you are doing already, you should single step, and patch the obvious jxx instructions).

CMP EAX, 1
JNZ SHORT DriftCit.004D4937 <<-- (change to JMP ) 0xeb 0x34

next...

cmp eax, 5
je 4d4a56 <<-- (change to JMP ) change to 0xeb 0x56

next, patch where above jmp lands...

test al, al
jmp 004D4A86 <<-- (change to JMP ) 0xEB 0x22

Okay... that takes care of the nag.

Next, we disable GameGuard. Look down some at the disassembly, until you see:

CMP EAX, 0B7
JNZ SHORT $+14
MOV EAX, 309
ADD ESP, 1138
RETN 10
CALL address

MOV ECX, DWORD PTR DS:[8E8EA0]
MOV EAX, DWORD PTR DS:[ECX]

CALL DWORD PTR DS:[EAX+4] ; <<-- This calls InitGameGuard

TEST AL, AL ; <<-- test for success ( bool )
JNZ SHORT 12_.004D4B44 ; <<-- if we fail, JNZ is not taken

How to disable? Simple.

NOP both the call addr and test al, al instruction (since test is no longer needed..), and change
the JE to JMP:

90 NOP
90 NOP
90 NOP
90 NOP
90 NOP
EB 0E JMP SHORT 12_.004D4B42

Save modifications to the .exe file -- that is all.

-Fyyre
30-01-11
Military

Re: DriftCity Client

Thank you sir.
31-01-11
ARTYOMT

Re: DriftCity Client

Awesome DC will soon be revived to comunity
31-01-11
ccleanerz

Re: DriftCity Client

good job (thank)
05-02-11
Fyyre

Re: DriftCity Client

Surely, I hope it is useful.

Here is the DriftCity.exe I unpack from Ver. 03i (linked in Detour thread) -- note, I modified this binary so he attempts connections to localhost ( 127.0.0.1 ).

VirusTotal scan results

Unpacked DriftCity binary
05-02-11
ARTYOMT

Re: DriftCity Client

Drift City will soon finally go private server and no more donating it yeah!
05-02-11
nerdyguy64

Re: DriftCity Client

Quote:

Originally Posted by Fyyre

Surely, I hope it is useful.

Here is the DriftCity.exe I unpack from Ver. 03i (linked in Detour thread) -- note, I modified this binary so he attempts connections to localhost ( 127.0.0.1 ).

VirusTotal scan results

Unpacked DriftCity binary

How did you edit the client to connect to 127.0.0.1? Did you reverse engineer the client?:?:

---------- Post added at 07:17 PM ---------- Previous post was at 07:16 PM ----------

What client version is this for?
05-02-11
wesman2232

Re: DriftCity Client

Nice job. Once Checkpoint or someone gets a server up, please be sure to tell me.
06-02-11
Fyyre

Re: DriftCity Client

Anyone may do it:

Code:

48 6F 73 74 00 00 00 00 41 75 74 68 00 00 00 00 Host....Auth.... 31 30 2E 31 32 2E 31 34 2E 37 35 00 25 73 2F 69 10.12.14.75.%s/i 6E 69 74 2F 6E 65 74 77 6F 72 6B 2E 74 78 74 00 nit/network.txt.

See the above IP address? Replace it with IP you wish to connect to. The NULL byte must be preserved at the end of this string .75 (i.e. 0x37 0x35) where 0x00 is the NULL byte at end of string.

Quote:

Originally Posted by nerdyguy64

How did you edit the client to connect to 127.0.0.1? Did you reverse engineer the client?:?:

---------- Post added at 07:17 PM ---------- Previous post was at 07:16 PM ----------

What client version is this for?

0.3i or such? See first posting.

-Fyyre
06-02-11
ccleanerz

Re: DriftCity Client

Quote:

Originally Posted by Fyyre

Anyone may do it:

Code:

48 6F 73 74 00 00 00 00 41 75 74 68 00 00 00 00 Host....Auth.... 31 30 2E 31 32 2E 31 34 2E 37 35 00 25 73 2F 69 10.12.14.75.%s/i 6E 69 74 2F 6E 65 74 77 6F 72 6B 2E 74 78 74 00 nit/network.txt.

See the above IP address? Replace it with IP you wish to connect to. The NULL byte must be preserved at the end of this string .75 (i.e. 0x37 0x35) where 0x00 is the NULL byte at end of string.

-Fyyre

Ah ! thanks again :)
06-02-11
nerdyguy64

Re: DriftCity Client

Quote:

Originally Posted by Fyyre

Anyone may do it:

Code:

48 6F 73 74 00 00 00 00 41 75 74 68 00 00 00 00 Host....Auth.... 31 30 2E 31 32 2E 31 34 2E 37 35 00 25 73 2F 69 10.12.14.75.%s/i 6E 69 74 2F 6E 65 74 77 6F 72 6B 2E 74 78 74 00 nit/network.txt.

See the above IP address? Replace it with IP you wish to connect to. The NULL byte must be preserved at the end of this string .75 (i.e. 0x37 0x35) where 0x00 is the NULL byte at end of string.

0.3i or such? See first posting.

-Fyyre

Thank you for helping, do I just open it in hex edit. Excuse my lack of knowledge on this. Im guessing its hex edit, thanks again!

Oh if you dont mind, I have the Green Tea Sever stuff (zoneserver) and I set it up in SQL. But I was wondering how do you connect to it. I understand that nobody has gotten game play yet, but I just want to play around with it. I open the 3 zoneserver executable but how do I try and connect to 127.0.0.1 the client freezes and it crashes at the loading screen. If you dont mind could you point me in the right direction with this?

-Dan

(oh does it madder if you dont open the 3 trafficAgent, I just opened the 3 zoneserver, but there are 2 other zoneservers that it doesn't say to open:blink: )
06-02-11
Fyyre

Re: DriftCity Client

I am not any expert on this (in same boat, cannot get everything working and play) -- but the server(s) listen on any available interface(IP address), so when client attempts to connect via localhost (127.0.0.1), it is guarantee a port listening for this connection request.

If you look at console window of the ZoneServer when client is attempting to connect, you should see some error message there, or in the log files.. if client crashing when you attempt to run it.... what version of Windows is it ?

And hex editor, yes -- like WinHex.

-Fyyre

Quote:

Originally Posted by nerdyguy64

Thank you for helping, do I just open it in hex edit. Excuse my lack of knowledge on this. Im guessing its hex edit, thanks again!

Oh if you dont mind, I have the Green Tea Sever stuff (zoneserver) and I set it up in SQL. But I was wondering how do you connect to it. I understand that nobody has gotten game play yet, but I just want to play around with it. I open the 3 zoneserver executable but how do I try and connect to 127.0.0.1 the client freezes and it crashes at the loading screen. If you dont mind could you point me in the right direction with this?

-Dan

(oh does it madder if you dont open the 3 trafficAgent, I just opened the 3 zoneserver, but there are 2 other zoneservers that it doesn't say to open:blink: )
06-02-11
CheckPoint

Re: DriftCity Client

If the client successfully connects,after the authentication it should display a HanIPCheck error.If you can't unpack the client,you should use the connect hook I posted a few posts earlier.Along with the DriftDetour(Unless if you got the ZoneServer connected to the database via the ODBC driver),it should let you get to the server select screen.In order to get a working serverlist,create a serverlist.txt inside your ZoneServer folder and paste the following:

Code:

100 NameOfServer 192.168.0.100 11011 192.168.0.100 11021 192.168.0.100 11031 192.168.0.100 11041 100

Where 100 is the ServerID specified in ZoneServerConfig.ini,11011-11041 are the listener ports,and NameOfServer is your server's name.On most client(except for 0.3-0.5i),it will retrieve a faulty character list.Once you do create a character and manage to create a game session,your client will most likely crash at the end of loading.
06-02-11
nerdyguy64

Re: DriftCity Client

Quote:

Originally Posted by Fyyre

I am not any expert on this (in same boat, cannot get everything working and play) -- but the server(s) listen on any available interface(IP address), so when client attempts to connect via localhost (127.0.0.1), it is guarantee a port listening for this connection request.

If you look at console window of the ZoneServer when client is attempting to connect, you should see some error message there, or in the log files.. if client crashing when you attempt to run it.... what version of Windows is it ?

And hex editor, yes -- like WinHex.

-Fyyre

Well im running Windows Vista Home Premium 32 bit. Is it ok if I download the 2007 client and use your executable? Or do I have to use 0.5f (the version you use) to run it? Im gonna play around with it, see what I can do.:laugh:

-Dan

---------- Post added at 09:31 PM ---------- Previous post was at 09:22 PM ----------

Quote:

Originally Posted by CheckPoint

If the client successfully connects,after the authentication it should display a HanIPCheck error.If you can't unpack the client,you should use the connect hook I posted a few posts earlier.Along with the DriftDetour(Unless if you got the ZoneServer connected to the database via the ODBC driver),it should let you get to the server select screen.In order to get a working serverlist,create a serverlist.txt inside your ZoneServer folder and paste the following:

Code:

100 NameOfServer 192.168.0.100 11011 192.168.0.100 11021 192.168.0.100 11031 192.168.0.100 11041 100

Where 100 is the ServerID specified in ZoneServerConfig.ini,11011-11041 are the listener ports,and NameOfServer is your server's name.On most client(except for 0.3-0.5i),it will retrieve a faulty character list.Once you do create a character and manage to create a game session,your client will most likely crash at the end of loading.

Did you explain this is your other post, DriftDetour and the hook connection to get pass the hanIPcheck? Ill take a look at it and see if I can get it to the server list.

I understood about 3/4 of what you said. When you say create a serverlist.txt, which ZoneServer folder, is it all 5 or just one? Oh what do you mean by 0.3-0.5i, I know they are version numbers but aren't those like the 2007 client but just updated a little bit? Again forgive my lack of knowledge on this, I just want to gather as much information about the client I can. Why does it crash at the end of loading, im guessing thats because it retrieves a faulty character list. Will 0.3-0.5i work, will they retrieve a valid character list? Sorry for 20 questions.

-Dan

---------- Post added at 10:01 PM ---------- Previous post was at 09:31 PM ----------

Quote:

Originally Posted by nerdyguy64

Thank you for helping, do I just open it in hex edit. Excuse my lack of knowledge on this. Im guessing its hex edit, thanks again!

Oh if you dont mind, I have the Green Tea Sever stuff (zoneserver) and I set it up in SQL. But I was wondering how do you connect to it. I understand that nobody has gotten game play yet, but I just want to play around with it. I open the 3 zoneserver executable but how do I try and connect to 127.0.0.1 the client freezes and it crashes at the loading screen. If you dont mind could you point me in the right direction with this?

-Dan

(oh does it madder if you dont open the 3 trafficAgent, I just opened the 3 zoneserver, but there are 2 other zoneservers that it doesn't say to open:blink: )

Excuse me for asking this, but what is a NULL byte. Cant I just replace the ip (127.0.0.1) with another ip? Is that possible or is there something else I have to do. I just talking about your hacked client, I know that you have to do more to a client that hasn't been hacked but Im wondering about the ip thing.

-Dan

---------- Post added at 10:14 PM ---------- Previous post was at 10:01 PM ----------

Again im sorry for 20 questions, im new at this:/:

Im trying to edit the 2007 client (you put instructions on how to do that (first post)) but I cant find any of the binary, Hex or unicode you posted (WinMain I think is Unicode, but im not sure). But I scrolled down and I saw a huge part was just zeros :

005CEB69 00 DB 00
005CEB6A 00 DB 00
005CEB6B 00 DB 00
005CEB6C 00 DB 00
005CEB6D 00 DB 00
005CEB6E . 00000000 DD 00000000
005CEB72 00000000 DD 00000000
005CEB76 00000000 DD 00000000
005CEB7A 00000000 DD 00000000
005CEB7E 00000000 DD 00000000

this is the same for the hex dump. What does this mean. Id like to try and edit my client and use that. Any thoughts?

-Dan

I dont have any knowledge of reverse engineering or assembly code for that madder, but I still want to play around with it.:w00t:
07-02-11
wesman2232

Re: DriftCity Client

Hope some of you get this working, I personally have no clue what you're talking about other than hex editing :P
20-02-11
mario185

Re: DriftCity Client

I'm using the 0.05e client and can't get past the character creation screen. No matter what name I enter, it always says that the ID is already in use.
http://img135.imageshack.us/img135/4...1184628.th.jpg
But if I try a name what is prohibited by OperatorMisrepresent.xlt (found in [server]/Data/Init), I get the message that the name is prohibited, and I have to use another name. I even tried Korean, Chinese and Japanese names, but none of them worked.

--------------------------

Something I found out:
If you add ServerName=??? in the ZoneServerConfig.ini, you can give your Server in the old client a name. (Instead of Gear One, Gear Two, etc...) :laugh:
(This doesn't work in the clients with the new UI, so this may be useless anyway. :P)

Code:

[Server] ServerId=100 ServerName=SomeServer test123 AreaOn=1 GameOn=1 LobbyOn=1 AuthOn=1 BAreaOn=1

http://img11.imageshack.us/img11/332...1212344.th.jpg
01-03-11
elmon

Re: DriftCity Client

Quote:

Originally Posted by Fyyre

Surely, I hope it is useful.

Here is the DriftCity.exe I unpack from Ver. 03i (linked in Detour thread) -- note, I modified this binary so he attempts connections to localhost ( 127.0.0.1 ).

VirusTotal scan results

Unpacked DriftCity binary

All that's cool, but where is the other part of client? =D
I mean, can you please share full client?
02-03-11
laukinfai001

Re: DriftCity Client

godgod..

---------- Post added at 04:13 AM ---------- Previous post was at 03:57 AM ----------

always says that the ID is because not connection sql

---------- Post added at 04:48 AM ---------- Previous post was at 04:13 AM ----------

ASProtect v1.23 RC1 ^_^
10-03-11
Blasian

Re: DriftCity Client

Quote:

Originally Posted by mario185

I'm using the 0.05e client and can't get past the character creation screen. No matter what name I enter, it always says that the ID is already in use.
http://img135.imageshack.us/img135/4...1184628.th.jpg
But if I try a name what is prohibited by OperatorMisrepresent.xlt (found in [server]/Data/Init), I get the message that the name is prohibited, and I have to use another name. I even tried Korean, Chinese and Japanese names, but none of them worked.

--------------------------

Something I found out:
If you add ServerName=??? in the ZoneServerConfig.ini, you can give your Server in the old client a name. (Instead of Gear One, Gear Two, etc...) :laugh:
(This doesn't work in the clients with the new UI, so this may be useless anyway. :P)

Code:

[Server] ServerId=100 ServerName=SomeServer test123 AreaOn=1 GameOn=1 LobbyOn=1 AuthOn=1 BAreaOn=1

http://img11.imageshack.us/img11/332...1212344.th.jpg

Not sure if CheckPoint has gotten this far yet, will have to ask him but very nice work O_O mind giving the actually client version/ build date? ^^
10-03-11
elmon

Re: DriftCity Client

He stopped at the same place as me - we need unpacked client with version under 0.04
I have a packed one, but i can't unpack it
10-03-11
MentaL

Re: DriftCity Client

Why not dump from memory and rebuild the headers?
10-03-11
elmon

Re: DriftCity Client

Cos there is a good protection from launching it not from a launcher=\

And in addition to this I have very bad knowledge in assembler=(

If you can help us - here is a topic with client and some info
19-03-11
nemboy88

Re: DriftCity Client

lol nice
30-03-11
laukinfai001

Re: DriftCity Client

What progress has
16-04-11
stevenliy

Re: DriftCity Client

same all i want is to play driftcity!!! i love it and they delete it MAKE IT!

---------- Post added at 09:57 PM ---------- Previous post was at 09:56 PM ----------

same all i want is to play driftcity!!! i love it and they delete it MAKE IT!
19-04-11
CheckPoint

Re: DriftCity Client

Instead of crying about how you guys want Drift City so bad,why don't you try and find more developers to help with it?Besides, I am only one developer working on this project.
20-04-11
ThroneX

Re: DriftCity Client

I'll try to find out more developers but I don't know if they'll join or not..
21-04-11
Agent Tran

Re: DriftCity Client

nice to see the progress made here.
23-04-11
fxdoggy

Re: DriftCity Client

Wish I could make some of the brilliant developers of ac-web help with this ; )
24-04-11
CheckPoint

Re: DriftCity Client

From what I noticed,it fails to load the car info,and when it tries to render the world it crashes(ver 0.5e,ijji client).
So I believe the crash has to do with the LoadCharacter packet.
27-05-11
esteniomaldade

Re: DriftCity Client

Thank you sir.
22-09-14
sortaloc

Re: DriftCity Client

Quote:

Originally Posted by Fyyre

Here is a brief 'howto' I wrote:

Hello Fyyre,
I have found this kind of client from 03.08.2007, It doesn't have a launcher there. I have tried to unpack it like you said. But, I get some message that I don't understand what it's meant.
http://i.imgur.com/xMd9Fd9.png
http://i.imgur.com/24DnP7K.png
http://i.imgur.com/Dk9Za5o.png

I just want to know where I have to edit in order to bypass the gameguard?
Because I don't find any command like yours in here
http://i.imgur.com/e9Jvmbk.png

And this is from the latest GamesCampus Client
http://i.imgur.com/DaVC6nk.png
13-03-16
N1der5

Re: DriftCity Client

Sortaloc what program is that? and what file did you open in that program?
14-03-16
DriftCity

Re: DriftCity Client

Quote:

Originally Posted by N1der5

Sortaloc what program is that? and what file did you open in that program?

His reply was in 2014, i doubt he's gonna reply.
18-03-16
Snopboy

Re: DriftCity Client

Quote:

Originally Posted by N1der5

Sortaloc what program is that? and what file did you open in that program?

Looks like ollydbg to me, since he can read all those strings, I can only assume it's either unpacked or simply wasn't packed in the first place.
I'm not really familiar with DriftCity clients.
18-03-16
savetherobots

Re: DriftCity Client

Quote:

Originally Posted by kingslime

Looks like ollydbg to me, since he can read all those strings, I can only assume it's either unpacked or simply wasn't packed in the first place.
I'm not really familiar with DriftCity clients.

DriftCity release clients are packed and yes, that does look like ollydbg.