Unpacked x700 main.exe of GMO (1.04.07 / 104G)

http://img338.imageshack.us/img338/9210/19733568.png

Tested on Win7 - 64Bit!

Offsets:

Code:

---

Mu.exe: 004ECCEB              . 74 12          JE SHORT unpacked.004ECCFF
Mu.exe: 004ECD46              . 75 5B          JNZ SHORT unpacked.004ECDA3
GG sucess: 004ED160              . 0F85 8A000000  JNZ unpacked.004ED1F0 
GameGuard: 004ED11D              . 74 19              JE SHORT unpacked.004ED138
RG #1: 004F016A    EB 23          JMP SHORT main.004F018F
RG #2: 00638349    EB 23          JMP SHORT main.0063836E
RG #3: 00638864    EB 23          JMP SHORT main.00638889

Crack Site Login System:
004AB541 - Cm StarterCore - Set Nop
0043DF96 - LoginBox * to Normal Characters - change PUSH 01 to PUSH 0
0043E4CC - Change - MOV EAX,DWORD PTR DS:[EAX+354] - to - MOV EAX,DWORD PTR DS:[EAX+350]
0043E4D5 - Change - MOV ECX,DWORD PTR DS:[ECX+354] - to - MOV ECX,DWORD PTR DS:[ECX+350]
0043E4DD - Change - CALL DWORD PTR DS:[EAX+30] - to - CALL DWORD PTR DS:[EAX+18]

Decrypted MuError.log
009D2197    |. E8 29FFFFFF    CALL Main_GGG.009D20C5 - Nop this call

---

Version:

Code:

---

2274<

---

Serial:

Code:

---

mwocvvz0x39vbcv3

---

No idea about IP, but on gmo its:

Code:

---

connect.muonline.webzen.com

---

Credits: Me & Willerson
Unpacked & Cracked (No resource guard, no login)
Downlaod link: Main.rar | Game Front

Full client and Patch:

Code:

---

[Asia]
http://az29570.vo.msecnd.net/muonline/ex700client.exe
[Europe]
http://az29571.vo.msecnd.net/muonline/ex700client.exe
[North America]
http://az29572.vo.msecnd.net/muonline/ex700client.exe

-Manual Patch-
[Asia]
http://az29570.vo.msecnd.net/muonline/ex700manualpatch.zip
[Europe]
http://az29571.vo.msecnd.net/muonline/ex700manualpatch.zip
[North America]
http://az29572.vo.msecnd.net/muonline/ex700manualpatch.zip

---

PS. thous who needs crack CMcore and Login, please reffer to this --> guide <--

Here is fully main.exe cracked: http://www.gamefront.com/files/21825..._fullRGFix.rar
Downlaod tool to decrypt packets: http://forum.ragezone.com/f197/unpac...ml#post7079941

Quote:

---

Originally Posted by mauka

Yup and clear this topic xD

---

Hmm i get just white screen when the main loads but after it just crashes. (Win 7 32bit)

Topic moved to release section and cleaned!

Can you give a full client download address?Thank you

Webzen - The Next Generation of Free-to-Play Online Games

Big Man, best work, thanks y my respect....

Run the "MAIN" flash will shut down, whether to supporting?

Anyone knows the CMStarterCore_Check offset? (I cant find it :?:)

Edit: These i found but correct me if im wrong

Code:

---

Login1 -> 0043DF96
Login2 -> 0043E4CC
Login3 -> 0043E4D5
Login4 -> 0043E4DD
CMStarterCore_Check -> ????????

---

Crack Site Login System:

004AB541 - Cm StarterCore - Set Nop in 2 Bytes
0043DF96 - LoginBox * to Normal Characters - change PUSH 01 to PUSH 0
0043E4CC - Change - MOV EAX,DWORD PTR DS:[EAX+354] - to - MOV EAX,DWORD PTR DS:[EAX+350]
0043E4D5 - Change - MOV ECX,DWORD PTR DS:[ECX+354] - to - MOV ECX,DWORD PTR DS:[ECX+350]
0043E4DD - Change - CALL DWORD PTR DS:[EAX+30] - to - CALL DWORD PTR DS:[EAX+18]

[]'s

Quote:

---

Originally Posted by willerson

Crack Site Login System:

004AB541 - Cm StarterCore - Set Nop in 2 Bytes
0043DF96 - LoginBox * to Normal Characters - change PUSH 01 to PUSH 0
0043E4CC - Change - MOV EAX,DWORD PTR DS:[EAX+354] - to - MOV EAX,DWORD PTR DS:[EAX+350]
0043E4D5 - Change - MOV ECX,DWORD PTR DS:[ECX+354] - to - MOV ECX,DWORD PTR DS:[ECX+350]
0043E4DD - Change - CALL DWORD PTR DS:[EAX+30] - to - CALL DWORD PTR DS:[EAX+18]

[]'s

---

Thx. I couldnt find first offset ><

Attachment 106700

Can you give can be used in the MAIN?

If the main is other encoding so is useless now? Or am I wrong?

Big thanks :P

No work

Spoiler:

http://img338.imageshack.us/img338/9210/19733568.png

I have a problem!
main.exe after loading, automatically closed...

MuError.log :

Quote:

---

[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
> ResourceGuard Error!!
[Socket Closed][Clear PacketQueue]
АОµ¦Ѕєё¦ °шАЇЗП°ЕіЄ DeleteѕшАМ »зїлЗПїґАЅData\Effect\Shiny04.jpg(0x00007D76)->Data\Effect\Shiny05.jpg
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
> ResourceGuard Error!!
[Socket Closed][Clear PacketQueue]
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
> ResourceGuard Error!!
[Socket Closed][Clear PacketQueue]
АОµ¦Ѕєё¦ °шАЇЗП°ЕіЄ DeleteѕшАМ »зїлЗПїґАЅData\Interface\newui_item_back01.tga(0x00007A79)->Data\Interface\newui_item_back04.tga
АОµ¦Ѕєё¦ °шАЇЗП°ЕіЄ DeleteѕшАМ »зїлЗПїґАЅData\Interface\newui_item_back04.tga(0x00007A79)->Data\Interface\newui_item_back01.tga
> Loading ok.
Destroy

---

P.S: Client and Patch download in 1 topic

There u go: All.rar | Game Front RG cracked to

crash again :(

Quote:

---

My main.exe

---

When i open main its only white screen. Using Win8 x64.
http://www.bildites.lv/images/b57rogq0rec06eama44n.png

Main.exe was tested on win7 and Xp, try set compatibility mode to Xp

mauka, u check my main?

I think my problem in my OS... (Win7 - 32Bit)

Quote:

---

Originally Posted by mauka

Main.exe was tested on win7 and Xp, try set compatibility mode to Xp

---

Tried both. XP and win7. Same problem.
P.S. Orginal webzen main works fine in win8.

I forgot to crack resource guard :(

Original:

Code:

---

004F016A          74 23            JE SHORT dump_NO_.004F018F
00638349          74 23            JE SHORT dump_NO_.0063836E
00638864          74 23            JE SHORT dump_NO_.00638889

---

Cracked:

Code:

---

RG #1: 004F016A    EB 23          JMP SHORT main.004F018F
RG #2: 00638349    EB 23          JMP SHORT main.0063836E
RG #3: 00638864    EB 23          JMP SHORT main.00638889

---

simply folow offsets and change JE to JMP and save ;)

Here fixed it: http://www.gamefront.com/files/21825..._fullRGFix.rar

OD edit the cmcore but can't save . How to save?

main fix login official site
link : main_nomu.exe_nositelogin_by_omega.rar

by OMEGA

Thanks.
the dumpfullRGfix.rar can connect.
Attachment 106720

Now it works fine. At least until login. When i press on server nothing happens. Server disappears and only background image remains.
Attachment 106721
This happens when i change the IP of main. If i don't change IP than same happens after entering user and pass.

EDIT: Same happens when i try OMEGA main. After entering account and pass nothing happens.

I have a new problem... :glare:
If i select the server, my CS have a problem with login:

login packet rec wpepro:

PHP Code:

---

24  10.1.1.70:1907  10.1.1.2:44405  6  Send  0000  C1 06 F4 03 00 00                                  ......
25  10.1.1.2:44405  10.1.1.70:1907  22  Recv  0000  C1 16 F4 03 31 30 2E 31 2E 31 2E 32 00 00 00 00    ....10.1.1.2....0010  00 00 00 00 5D DA                                  ....].
26  0.0.0.0:1895  :0  26  SendTo  0000  1A 00 00 00 0A 19 00 00 00 03 6E 1D 00 00 00 00    ..........n.....0010  00 00 01 00 00 00 00 00 00 00                      ..........
27  10.1.1.2:55901  10.1.1.70:1909  12  Recv  0000  C1 0C F1 00 01 1F 43 31 30 33 31 31                ......C10311 


---

There is a new protocol crypt as far i understand its does not uses anymore simple modulus to encrypt, decrypt packets!
U can delet Enc1, Dec1.dat or set BP on simple modulus and its make no sens as its never getting called ;)

Other way u can simply look at C3 packets size ;) its simply wrong to Decrypt with simple modulus

Only encrypt the login packet
C3 33 XX

Quote:

---

Originally Posted by kukumopa

I have a new problem... :glare:
If i select the server, my CS have a problem with login:

---

Man wait ex700 server files!!! I same wait server files ;)

@Error

Quote:

---

enc/dec itself is a arithmetic manipulation with 20 keys for encryption and 20 for decryption, but thats only enc/dec ... webzen added additional protection by some xor algorithms based on packet headcodes and sizes ( you can bypass that with a simple NOP in main )

---

Error said something about one "NOP" fix to get work these client on S6 files, if ima not missunderstand him!
U can try look around before load Enc1, Dec1.dat files ;) or simply send alot PM to him eg: Plz man, Man i need, Give me sources, Im no spek englesh, but if not u help i go yor country and eat your dog etc..
Have fun!

maybe him will direct u to the right way or help you ;)

PS. him is kind a pro and sounds like very friendly guy ;) good luck

Quote:

---

Originally Posted by AncestraL

are u fcking kidding?

THERE IS NO SERVER FILES THAT CAN SUPPORT THIS MAIN!!!!!

NOOOOOOOOOOOOOOOOB

---

man u adequate? read and understand my posts correctly!!!

Code:

---

0041E980  . 83EC 08        SUB ESP,8
0041EA80  . 83EC 08        SUB ESP,8

---

Here are the encryption and decryption functions ( encrypt/decrypt blocks of 4 int values - 16 bytes )
but you will still need to bypass additional packet manipulations based on packet header ( some xor/place substitutions )

I still think u talk about Simple modulus as its split packet into blocks 4 Dwords and shift it

Code:

---

function TSimpleModule.DecryptBlock(lpDest: Pointer; lpSource: Pointer): Integer;
var
 dwDecBuffer: array [0 ..3] of DWORD;
 iBitPosition, i: Integer;
 Temp,Temp1: Word;
 btCheckSum: Byte;
begin
 FillMemory(lpDest, 15, 0);
 FillMemory(@dwDecBuffer, SizeOf(dwDecBuffer), 0);
 iBitPosition := 0;

 for i := 0 to 3 do
  begin
  AddBits(@dwDecBuffer[i], 0, lpSource, iBitPosition, 16);
  Inc(iBitPosition, 16);
  AddBits(@dwDecBuffer[i], 22, lpSource, iBitPosition, 2);
  Inc(iBitPosition, 2);
  end;

 for i := 2 downto 0 do // pareizi viss
  dwDecBuffer[i] := (dwDecBuffer[i] xor  m_dwXORKey[i]) xor (dwDecBuffer[i + 1] and $FFFF);

 Temp := 0;
 for i := 0 to 3 do
  begin
  Temp1 := ((m_dwDecryptionKey[i] * (dwDecBuffer[i])) mod (m_dwModulus[i])) xor m_dwXORKey[i] xor Temp;
  Temp  := dwDecBuffer[i] and $0000FFFF;
  PWord(Integer(lpDest) + 2 * i)^ := PWord(@Temp1)^;
  end;

 dwDecBuffer[0] := 0;
 AddBits(@dwDecBuffer[0], 0, lpSource, iBitPosition, 16);

 btCheckSum := $F8;
 for i := 0 to 7 do
  btCheckSum := btCheckSum xor PByte(Integer(lpDest) + i)^;

 if (btCheckSum <> GetH(dwDecBuffer[0])) then    //128  249  153 255 189
  Result := -1
 else
  Result := GetH(dwDecBuffer[0]) xor GetL(dwDecBuffer[0]) xor $3D;
end;

function TSimpleModule.Decrypt(lpDest: Pointer; lpSource: Pointer; iSize: Integer): Integer;
var
 lpTempDest, lpTempSrc: PByte;
 iResult, iDecLen, iTempResult, Epos, Spos: Integer;
begin
 if lpDest = nil then
  begin
  Result := iSize * 8 div 11;
  Exit;
  end;

 lpTempDest := PByte(lpDest);
 lpTempSrc  := PByte(lpSource);

 iResult := 0;
 iDecLen := 0;
 Epos := 0;
 Spos := 0;
 if (iSize mod 11) = 0 then
  begin
  while (iDecLen < iSize) do
    begin
    iTempResult := DecryptBlock(lpTempDest + EPos, lpTempSrc + Spos); // pirmais loops ir OK!
    if (iResult < 0) then
      begin
      Result := iResult;
      Exit;
      end;
    Inc(iResult, iTempResult);
                Inc(iDecLen, 11);
    Inc(Epos, 8);
    Inc(Spos, 11);
    end;
  end;
 Result := iResult;
end;

---

U confused me, correct me if ima wrong

Edietd: Ok, its not simple modulus - rechecked again it by your offset

Quote:

---

Originally Posted by mauka

Edietd: Ok, its not simple modulus - rechecked again it by your offset

---

simple modulus changes the size of the packet ) current system - doesnt, and its a lot simplier than simplemodulus

I noted it ;) U helped me alot.. revesing it will be peace of cake compare to simple modulus

someone could fix login muex700 into this source to me?
: APplE PROJECT - By WolF & M.E.S_GameServer_1.00.90.rar

Quote:

---

Originally Posted by koceto

Man wait ex700 server files!!! I same wait server files ;)

---

Attachment 106792

By the way, smallHabit got work x700 main.exe on s6 srvr files

nah :D that was just fun, disabling 0xC3 encoding in client ^_^

Quote:

---

Originally Posted by SmallHabit

nah :D that was just fun, disabling 0xC3 encoding in client ^_^

---

how did you do that? you can explain ? if yes, it will be helpfull for us...

Quote:

---

Originally Posted by mauka

Attachment 106792

By the way, smallHabit got work x700 main.exe on s6 srvr files

---

I loled at that image/banner :lol:

Quote:

---

Originally Posted by willerson

how did you do that? you can explain ? if yes, it will be helpfull for us...

---

Absolutely agree :ott:

Where is the problem? Me as developer of muservers would Nop this new call

Code:

---

00439387

---

hook next

Code:

---

0043947D  E8 BE258300      CALL dump_NO_.00C6BA40

---

and

Code:

---

004394E5  E8 56258300      CALL dump_NO_.00C6BA40

---

and resore old SimpleModulus!

Example of calls is on send only ;)
Pss. for u server devs its waste of time and useless reversing new encdec of muonline

Problem is that MU dev's, cant catch new structs of protos from official server ^_^

Quote:

---

Originally Posted by SmallHabit

Problem is that MU dev's, cant catch new structs of protos from official server ^_^

---

By that ur meaning u cant right? :D

Quote:

---

BTW: nice job mauka

---

Quote:

---

Originally Posted by SmallHabit

Problem is that MU dev's, cant catch new structs of protos from official server ^_^

---

hm, hook protocol core and get decrypted buffer and work with it..
U know it, but i will post it here for me and all others who will need it in future

Protocol Core

Code:

---

00663B3F  . E8 943E0000    CALL dump_NO_.006679D8

---

Already made it :

Code:

---

#define DataRecvE ((void(*)(BYTE,PBYTE,DWORD,DWORD,...)) 0x006679D8)

void ProtocolCore(BYTE protoNum, BYTE * aRecv, int aLen, int aIndex, BOOL Encrypt, int serial)
{

                DataRecvE(protoNum,aRecv,aLen,aIndex,Encrypt,serial);
}

                                                BYTE ProtoHook1[] = {0xE9, 0xF1, 0xC7, 0xD9, 0xFF };
       
                                                memcpy((int*)0x663B3F,&ProtoHook1,sizeof(ProtoHook1));
                                       
                                                BYTE ProtoHook2[] = {0xFF, 0x15, 0x45, 0x03, 0x40, 0x00};
                                                memcpy((int*)0x400335,&ProtoHook2,sizeof(ProtoHook2));

                                                BYTE ProtoHook3[] = {0xE9,0x3B,0xEE,0xD5,0x00,0x90};
                                                memcpy((int*)0x40033B,&ProtoHook3,sizeof(ProtoHook3));

                                                _asm
                                                {
                                                        MOV DWORD PTR DS:[00400345H],Offset ProtocolCore
                                                }

---

Could YOU unpack the main of Taiwan MUonline. (1.03e+).

www.muonline.com.tw (mublue)

Not all packets have FIX OPCODE, only some of them.

bro y main.exe doesnt apear cant load ? i use windows 2008 r2 ?

Mirror Link:
Unpacked x700 main.exe of GMO (1.04.07 & 104G) - SeeItWorks .COM Download Center


...

Quote:

---

Originally Posted by k2diablo

Not all packets have FIX OPCODE, only some of them.

---

Kamil is right. Some packets have additional xor - such a GG packet etc.. depending on opcode
I dint study it yet

Added: i write small app for packet decryption, will post here maybe somebody will find it usefull

http://img845.imageshack.us/img845/3627/x700encdec.png

Attachment 107072

Quote:

---

Originally Posted by mauka

Kamil is right. Some packets have additional xor - such a GG packet etc.. depending on opcode
I dint study it yet

Added: i write small app for packet decryption, will post here maybe somebody will find it usefull

http://img845.imageshack.us/img845/3627/x700encdec.png

Attachment 107072

---

Mauka u can post how i can get or hook , Protocolcore?

Web site about packet´s MuChina X700
[url=http://blog.sina.com.cn/s/blog_6354812b01012auy.html]Mu

Quote:

---

Originally Posted by mauka

http://img338.imageshack.us/img338/9210/19733568.png

Tested on Win7 - 64Bit!

Offsets:

Code:

---

Mu.exe: 004ECCEB              . 74 12          JE SHORT unpacked.004ECCFF
Mu.exe: 004ECD46              . 75 5B          JNZ SHORT unpacked.004ECDA3
GG sucess: 004ED160              . 0F85 8A000000  JNZ unpacked.004ED1F0 
GameGuard: 004ED11D              . 74 19              JE SHORT unpacked.004ED138
RG #1: 004F016A    EB 23          JMP SHORT main.004F018F
RG #2: 00638349    EB 23          JMP SHORT main.0063836E
RG #3: 00638864    EB 23          JMP SHORT main.00638889

Crack Site Login System:
004AB541 - Cm StarterCore - Set Nop
0043DF96 - LoginBox * to Normal Characters - change PUSH 01 to PUSH 0
0043E4CC - Change - MOV EAX,DWORD PTR DS:[EAX+354] - to - MOV EAX,DWORD PTR DS:[EAX+350]
0043E4D5 - Change - MOV ECX,DWORD PTR DS:[ECX+354] - to - MOV ECX,DWORD PTR DS:[ECX+350]
0043E4DD - Change - CALL DWORD PTR DS:[EAX+30] - to - CALL DWORD PTR DS:[EAX+18]

Decrypted MuError.log
009D2197    |. E8 29FFFFFF    CALL Main_GGG.009D20C5 - Nop this call

---

Version:

Code:

---

2274<

---

Serial:

Code:

---

mwocvvz0x39vbcv3

---

No idea about IP, but on gmo its:

Code:

---

connect.muonline.webzen.com

---

Credits: Me & Willerson
Unpacked & Cracked (No resource guard, no login)
Downlaod link: Main.rar | Game Front

Full client and Patch:

Code:

---

[Asia]
http://az29570.vo.msecnd.net/muonline/ex700client.exe
[Europe]
http://az29571.vo.msecnd.net/muonline/ex700client.exe
[North America]
http://az29572.vo.msecnd.net/muonline/ex700client.exe

-Manual Patch-
[Asia]
http://az29570.vo.msecnd.net/muonline/ex700manualpatch.zip
[Europe]
http://az29571.vo.msecnd.net/muonline/ex700manualpatch.zip
[North America]
http://az29572.vo.msecnd.net/muonline/ex700manualpatch.zip

---

PS. thous who needs crack CMcore and Login, please reffer to this --> guide <--

---

hi bro mauka legend i use this client [Asia]
http://az29570.vo.msecnd.net/muonline/ex700client.exe

and this patch Main.rar | Game Front

every iclick the main.exe no windows loadings apear how make works the main.exe

iuse windows 2008 r2 enterprice 64bit

thanks bro

Windows Servers always have some problems with the 2.5~3D games. or you can install dxdiag?

Quote:

---

Originally Posted by ggragonss

Windows Servers always have some problems with the 2.5~3D games. or you can install dxdiag?

---

but if i update the auto update of Webzen main.exe works in os windows server 2008 r2 ? ithink have problem on main.exe Crack release ? not compatible for all os ?

Quote:

---

Originally Posted by asparagos

but if i update the auto update of Webzen main.exe works in os windows server 2008 r2 ? ithink have problem on main.exe Crack release ? not compatible for all os ?

---

Edit section headers and set full permission to all sections.

Quote:

---

Originally Posted by [RCZ]ShadowKing

Edit section headers and set full permission to all sections.

---

good day sir ShadowKing what you mean edit the headers and set full permission to all sections. the properties and compabilities ?

thank you for your reply and god bless

Download LordPE and go PE Editor -> Sections -> Right click -> Edit section -> check executable, readable, writeable to all then save th exe.

Quote:

---

Originally Posted by [RCZ]ShadowKing

Download LordPE and go PE Editor -> Sections -> Right click -> Edit section -> check executable, readable, writeable to all then save th exe.

---

thanks lot sir ShadowKing ;)

ifollow the PE Editor -> Sections -> Right click -> Edit section -> check executable, readable, writeable

http://i50.tinypic.com/im2xiw.jpg

but in edit section no check executable option ?

can u post image sir ShadowKing



thanks & god bless again

dont use LordPe - its fuck up PE totaly and after it PE cant be restored, use "CFF Explorer" - its free and got more friendly user interface.
http://img502.imageshack.us/img502/7058/cffex.png

maybe its just me, but LordPe does shit here

Quote:

---

Originally Posted by mauka

dont use LordPe - its fuck up PE totaly and after it PE cant be restored, use "CFF Explorer" - its free and got more friendly user interface.
http://img502.imageshack.us/img502/7058/cffex.png

maybe its just me, but LordPe does shit here

---

no log in box apear ;) i use dump_fullRGFix main.exe need to edit ollydbag bro mauka ?

thanks god bless Attachment 107196

i already edit the serial version and ip but no log in box apear ;P

asparagos, your server offline or ip in main incorrect!

Quote:

---

Originally Posted by kukumopa

asparagos, your server offline or ip in main incorrect!

---

my server on can i use hex editor for edit serial ip version ? and i forgot ithink no-ip notworks ?

Quote:

---

Originally Posted by asparagos

my server on can i use hex editor for edit serial ip version ? and i forgot ithink no-ip notworks ?

---

is this ip address need to change this main.exe ? Attachment 107201 connect.muonline.webzen.com ?

i change all "connect.", "cs." and ip "180.148...."

Quote:

---

Originally Posted by kukumopa

i change all "connect.", "cs." and ip "180.148...."

---

nothing happend bro i change all cs and 180.148 still no log in box can you give yuor main.exe clean ? thanks god bless

asparagos,

Quote:

---

My Main.exe:
Download link

---

P.S: Download main.exe in first topic, he is the same :blush:

Quote:

---

Originally Posted by kukumopa

asparagos,


P.S: Download main.exe in first topic, he is the same :blush:

---

lols :) need hex in ollydb this main ? can u share yours :drool:

i edit this file in hex editor :laugh:

Quote:

---

Originally Posted by kukumopa

i edit this file in hex editor :laugh:

---

thanks bro :) its works but if i log in my account not load main.exe support korean protokol bro ? or need some add in client side ?

i dont know, im waiting mauka tutorial, how to change protocol :)

Vietnam mU EX 700 ? D:

Máy chủ mới Aruka

Quote:

---

Originally Posted by Karuritoku

Vietnam mU EX 700 ? D:

Máy chủ mới Aruka

---

really ? 1 guy from VN have already ex 701 ready 1 month so far

but this topic is about cracked Main not private server advertise ;]

Quote:

---

Originally Posted by kukumopa

i dont know, im waiting mauka tutorial, how to change protocol :)

---

dont wait, i dont work with server files ;) i restored new x700 crypt time ago, but at this moment im not ready to public it

Quote:

---

Originally Posted by mauka

dont wait, i dont work with server files ;) i restored new x700 crypt time ago, but at this moment im not ready to public it

---

oh, so badly!!! :$:

Quote:

---

Originally Posted by mauka

dont wait, i dont work with server files ;) i restored new x700 crypt time ago, but at this moment im not ready to public it

---

will you share source of x700EncDec?

Thanks for tool, works fine :D

good morning bro mauka how fix log in box cant on in game my character ;) freeze log in any have idea guys

Quote:

---

Originally Posted by mauka

Kamil is right. Some packets have additional xor - such a GG packet etc.. depending on opcode
I dint study it yet

Added: i write small app for packet decryption, will post here maybe somebody will find it usefull

http://img845.imageshack.us/img845/3627/x700encdec.png

Attachment 107072

---

This additional packet xor can be easily disabled in main ^.^ Find it, it's not hard.

PS. You posted 3 RG offsets, in main there are 4.

Quote:

---

Originally Posted by Dudi2

This additional packet xor can be easily disabled in main ^.^ Find it, it's not hard.

PS. You posted 3 RG offsets, in main there are 4.

---

by the way bro Dudi thanks ;) but how use that x700 :) path ?

Quote:

---

Originally Posted by Dudi2

This additional packet xor can be easily disabled in main ^.^ Find it, it's not hard.

PS. You posted 3 RG offsets, in main there are 4.

---

HOW use this bro thanks :blush:

Quote:

---

Originally Posted by Dudi2

This additional packet xor can be easily disabled in main ^.^ Find it, it's not hard.

PS. You posted 3 RG offsets, in main there are 4.

---

then server will not recognize data corect xD
Dudi naab, post these offsets for ppl so they can work on x700 dont be me xD

Ps.
The 4rd offset is shit.. its for selfcheck GG.crs ;) no need crack it

Quote:

---

Originally Posted by mauka

then server will not recognize data corect xD
Dudi naab, post these offsets for ppl so they can work on x700 dont be me xD

Ps.
The 4rd offset is shit.. its for selfcheck GG.crs ;) no need crack it

---

no point to post it, bcoz ppl still don't have c3 enc<->dec ^.^

and also, main will crash when u try to login, due to protection system from packer (it still exists, and atm I DONT KNOW HOW TO REMOVE/DISABLE IT) ^

ps.

4rd offset will cause dc in-game from rg if it's not "cracked" :E

Code:

---


###### Log Begin ######
-------------------------------------------------------------------------------------
Mu online 1.04g (Eng) executed. (1.4.7.0)
2012/06/17 23:58
-------------------------------------------------------------------------------------
<System information>
OS            : Unknown 6.1 Build 7601 (Service Pack 1)
CPU            : AuthenticAMD - AMD Unknown 3020Mhz
RAM            : 1MB
-------------------------------------------------------------------------------------
Direct-X        : Direct-X 9.0
-------------------------------------------------------------------------------------
[Multi Client] Check cmd line :  / web starter Param :  !!
> To read config.ini.
-- ±Ű·ÎąúĆ÷Ĺ» ĂʱâČ­ --
[Global System] Ĺ°Á¤ş¸ ĽłÁ¤ ÇÔĽö Áßşą ČŁĂâ  -1 / 
> gg init success.
-------------------------------------------------------------------------------------
> Enum display settings.
> Screen size = 1280 x 960.
> Start window success.
> OpenGL init success.
-------------------------------------------------------------------------------------
<OpenGL information>
Vendor        : ATI Technologies Inc.
Render        : AMD Radeon HD 6800 Series
OpenGL version    : 4.2.11566 Compatibility Profile Context
Max Texture size    : 16384 x 16384
Max Viewport size    : 16384 x 16384
-------------------------------------------------------------------------------------
<Sound card information>
Sound Card        : Głośniki (Realtek High Definition Audio)
Sound Card Driver    : {0.0.0.00000000}.{806b49fc-dedb-4723-aab2-d75661ca3156} (0.0.18.0)
Sound Card        : Realtek HDMI Output (ATI HDMI Audio)
Sound Card Driver    : {0.0.0.00000000}.{22280ea7-2d3b-44b8-ae7b-81cdc0f5d95d} (0.0.18.0)
Sound Card        : Realtek Digital Output(Optical) (Realtek High Definition Audio)
Sound Card Driver    : {0.0.0.00000000}.{31617dfe-9106-4abe-a89b-a0663f5eb6c7} (0.0.18.0)
Sound Card        : Realtek Digital Output (Realtek High Definition Audio)
Sound Card Driver    : {0.0.0.00000000}.{e25716ea-888e-42b2-9f28-2e25a16f44d6} (0.0.18.0)
-------------------------------------------------------------------------------------
> gg connect Window Handle.
-------------------------------------------------------------------------------------
<IME information>
IME Name        :
IME File Name        :
Keyboard type        : 00000415
-------------------------------------------------------------------------------------
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\Effect\Shiny04.jpg(0x00007D76)->Data\Effect\Shiny05.jpg
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\Interface\newui_item_back01.tga(0x00007A79)->Data\Interface\newui_item_back04.tga
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\Interface\newui_item_back04.tga(0x00007A79)->Data\Interface\newui_item_back01.tga
> Loading ok.
[Connect to Server] ip address = xxxxx, port = 44405
> Login Scene init success.
Send Request Server List.
Success Receive Server List.
Success Receive Server List.
[ReceiveServerConnect][Socket Closed][Clear PacketQueue]
[Connect to Server] ip address = xxxxx, port = 55902
> Login Request.
> Try to Login "Dudi"
> Request Character list
> Character scene init success.
> Character selected <2> "fsasfafsa"
> Main Scene init success. 2012/06/17 23:58
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\World1\leaf01.tga(0x00007695)->Data\World1\leaf01.jpg
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
[Socket Closed][Clear PacketQueue]
> ResourceGuard Error!!
Strange packet
0x0018DFB1 : C147F303 96860000 00000000 00AAEDE9
          : 00000000 E7FF0590 2901B004 AB0FB004
          : D9079C0C 9C0C980C 980C2858 28588B06
          : 170D0000 E4D69A3B 0220BC16 7F000000
          : 00007F00 020000
> Connection closed. 2012/06/17 23:58
[Socket Closed][Clear PacketQueue]
Destroy

---

Quote:

---

Originally Posted by Dudi2

no point to post it, bcoz ppl still don't have c3 enc<->dec ^.^

and also, main will crash when u try to login, due to protection system from packer (it still exists, and atm I DONT KNOW HOW TO REMOVE/DISABLE IT) ^

ps.




4rd offset will cause dc in-game from rg if it's not "cracked" :E

Code:

---


###### Log Begin ######
-------------------------------------------------------------------------------------
Mu online 1.04g (Eng) executed. (1.4.7.0)
2012/06/17 23:58
-------------------------------------------------------------------------------------
<System information>
OS            : Unknown 6.1 Build 7601 (Service Pack 1)
CPU            : AuthenticAMD - AMD Unknown 3020Mhz
RAM            : 1MB
-------------------------------------------------------------------------------------
Direct-X        : Direct-X 9.0
-------------------------------------------------------------------------------------
[Multi Client] Check cmd line :  / web starter Param :  !!
> To read config.ini.
-- ±Ű·ÎąúĆ÷Ĺ» ĂʱâČ­ --
[Global System] Ĺ°Á¤ş¸ ĽłÁ¤ ÇÔĽö Áßşą ČŁĂâ  -1 / 
> gg init success.
-------------------------------------------------------------------------------------
> Enum display settings.
> Screen size = 1280 x 960.
> Start window success.
> OpenGL init success.
-------------------------------------------------------------------------------------
<OpenGL information>
Vendor        : ATI Technologies Inc.
Render        : AMD Radeon HD 6800 Series
OpenGL version    : 4.2.11566 Compatibility Profile Context
Max Texture size    : 16384 x 16384
Max Viewport size    : 16384 x 16384
-------------------------------------------------------------------------------------
<Sound card information>
Sound Card        : Głośniki (Realtek High Definition Audio)
Sound Card Driver    : {0.0.0.00000000}.{806b49fc-dedb-4723-aab2-d75661ca3156} (0.0.18.0)
Sound Card        : Realtek HDMI Output (ATI HDMI Audio)
Sound Card Driver    : {0.0.0.00000000}.{22280ea7-2d3b-44b8-ae7b-81cdc0f5d95d} (0.0.18.0)
Sound Card        : Realtek Digital Output(Optical) (Realtek High Definition Audio)
Sound Card Driver    : {0.0.0.00000000}.{31617dfe-9106-4abe-a89b-a0663f5eb6c7} (0.0.18.0)
Sound Card        : Realtek Digital Output (Realtek High Definition Audio)
Sound Card Driver    : {0.0.0.00000000}.{e25716ea-888e-42b2-9f28-2e25a16f44d6} (0.0.18.0)
-------------------------------------------------------------------------------------
> gg connect Window Handle.
-------------------------------------------------------------------------------------
<IME information>
IME Name        :
IME File Name        :
Keyboard type        : 00000415
-------------------------------------------------------------------------------------
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\Effect\Shiny04.jpg(0x00007D76)->Data\Effect\Shiny05.jpg
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\Interface\newui_item_back01.tga(0x00007A79)->Data\Interface\newui_item_back04.tga
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\Interface\newui_item_back04.tga(0x00007A79)->Data\Interface\newui_item_back01.tga
> Loading ok.
[Connect to Server] ip address = xxxxx, port = 44405
> Login Scene init success.
Send Request Server List.
Success Receive Server List.
Success Receive Server List.
[ReceiveServerConnect][Socket Closed][Clear PacketQueue]
[Connect to Server] ip address = xxxxx, port = 55902
> Login Request.
> Try to Login "Dudi"
> Request Character list
> Character scene init success.
> Character selected <2> "fsasfafsa"
> Main Scene init success. 2012/06/17 23:58
Ŕε¦˝ş¸¦ °řŔŻÇĎ°ĹłŞ DeleteľřŔĚ »çżëÇĎż´Ŕ˝Data\World1\leaf01.tga(0x00007695)->Data\World1\leaf01.jpg
[ResourceGuard] Check Integrity... : data\local\Gameguard.csr
[ResourceGuard] Error: main.exe file is modified.
[ResourceGuard] Stop checking integrity.
[Socket Closed][Clear PacketQueue]
> ResourceGuard Error!!
Strange packet
0x0018DFB1 : C147F303 96860000 00000000 00AAEDE9
          : 00000000 E7FF0590 2901B004 AB0FB004
          : D9079C0C 9C0C980C 980C2858 28588B06
          : 170D0000 E4D69A3B 0220BC16 7F000000
          : 00007F00 020000
> Connection closed. 2012/06/17 23:58
[Socket Closed][Clear PacketQueue]
Destroy

---

---

hi brother can you help me for 4offset when i can find the offset game server need to edite 2 ?

Quote:

---

Originally Posted by Dudi2

main will crash when u try to login, due to protection system from packer (it still exists, and atm I DONT KNOW HOW TO REMOVE/DISABLE IT)

---

Its not related to packer ;) be cause u can login in private servers etc..

Quote:

---

Originally Posted by mauka

Its not related to packer ;) be cause u can login in private servers etc..

---

but your release client doesnt work to connect my to my test server 11.11.82 version s6 ep3 :) any idea my legend brother need change protocol or some patch brother ?

there is no server files out in public for this or any other x700 client version

Someone can post tutorial how i can hook packets?
or see for make a programm.

Quote:

---

Originally Posted by mauka

Its not related to packer ;) be cause u can login in private servers etc..

---

so look at this:

http://iv.pl/images/51529580277183073595.jpg

Quote:

---

Originally Posted by Dudi2

so look at this:

http://iv.pl/images/51529580277183073595.jpg

---

how works client in server files bro dudi what need to change on server side thanks

god bless

Where can download ?

Quote:

---

Originally Posted by mauka

hm, hook protocol core and get decrypted buffer and work with it..
U know it, but i will post it here for me and all others who will need it in future

Protocol Core

Code:

---

00663B3F  . E8 943E0000    CALL dump_NO_.006679D8

---

---

hi again bro mauka where can find Protocol Core and where i can edit this for hooking ? same in OllyDb ? thanks again

Quote:

---

Originally Posted by asparagos

hi again bro mauka where can find Protocol Core and where i can edit this for hooking ? same in OllyDb ? thanks again

---

are u listening?

THERE IS NOT SERVER FILES THAT CAN SUPPORT THIS MAIN!!!!!

http://nn0.upanh.com/b5.s26.d2/d6bc8...1911250000.jpg
http://nn2.upanh.com/b4.s1.d4/038a6d...1911260002.jpg
http://nn0.upanh.com/b4.s27.d1/74610...1911480000.jpg
anyone know why ...login not happen fins ..

Quote:

---

Originally Posted by emga01

anyone know why ...login not happen fins ..

---

like AncestraL said, s6 files doesn't support ex700 protocol

learn to read people oO

Quote:

---

Originally Posted by 4FUNer

like AncestraL said, s6 files doesn't support ex700 protocol

learn to read people oO

---

Login window don't work because of bad crack, follow this tutorial on clean main http://forum.ragezone.com/f196/bypas...-check-670063/ .

theres nothing about that you cant connect to character list

Not working in files Titan Tech 11.11.82 any solution?

Any way to only use the interface?

Thank you very much.

Quote:

---

Originally Posted by Mosiah17

Not working in files Titan Tech 11.11.82 any solution?

Any way to only use the interface?

Thank you very much.

---

This main is for developers only, you cannot use it on a live server!

can only use the interface ? i'd like the ship , looks like ss1 :D