Creating a V162.4 localhost

[msacco4]

Hey, would love to get some help with V162.4 localhost, client reaches world select fine, then wipes its own stack and dies exactly like 60s after it sends 0x0033 (registers zeroed, TEB StackBase, StackLimit zeroed, EIP = 0).
Tried to replace NGClient.aes with my own module and separately kill BlackXchg/BlackCipher right after spawn, the first reaches world select but the timer still fires on schedule, the second just throws CSecurityNGSInitFailed.
The timer also runs when the AC processes never start at all, and both the check and the wipe live in the Themida VM, which I don't manage to de virtualize.
If someone is familiar with it and could give some direction on what to tackle next that would be great, thanks

 

[shailist]

Hey, would love to get some help with V162.4 localhost, client reaches world select fine, then wipes its own stack and dies exactly like 60s after it sends 0x0033 (registers zeroed, TEB StackBase, StackLimit zeroed, EIP = 0).
Tried to replace NGClient.aes with my own module and separately kill BlackXchg/BlackCipher right after spawn, the first reaches world select but the timer still fires on schedule, the second just throws CSecurityNGSInitFailed.
The timer also runs when the AC processes never start at all, and both the check and the wipe live in the Themida VM, which I don't manage to de virtualize.
If someone is familiar with it and could give some direction on what to tackle next that would be great, thanks

Not sure if this helps, but since you already got past the hurdle of launching the game, you can try completely disabling NGS.
There are many method, but the easiest is to modify the return address of `SendWvsSetupStep(1)` to the return address of `SendWvsSetupStep(12)`, effectively skipping steps [2-12]. This should launch the game without NGS.

 

[msacco4]

Not sure if this helps, but since you already got past the hurdle of launching the game, you can try completely disabling NGS.
There are many method, but the easiest is to modify the return address of `SendWvsSetupStep(1)` to the return address of `SendWvsSetupStep(12)`, effectively skipping steps [2-12]. This should launch the game without NGS.

Thanks for the reply, I already managed to write my own devirtualizer and bypass the tick timer check, so I don't think I need to fully skip NGS for now.