Q-Protect Anti hack source code

[MisterKid]

Hi,

I thought I release the source code now as I promised it ones tt1:
I'm not working on this project anymore so no reason to keep it for myself.
Well I hope you all can use it well or even improve it if you like too tt1:
If you are going to use this source don't forget to give me some credits

Source code from my Flyff Source

Functions :

To view the content, you need to sign in or register

How I execute them

#ifdef __QUGET_NON_PROTECT_DLL_VERSION
HANDLE_QUGET_ANTI_PACKET = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)QUGET_ANTI_PACKET, 0, 0, 0 );
HANDLE_QUGET_ANTI_SPEED = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)QUGET_ANTI_SPEED, 0, 0, 0 );
HANDLE_QUGET_ANTI_WINM = CreateThread(0, 0, (LPTHREAD_START_ROUTINE)QUGET_ANTI_WINM, 0, 0, 0 );
#endif

This source can be used for most games tt1:
Lol its not really big its simple and messy in my view.

Don't forget to like this post for the release :

 

[AngraMainyu]

If I can break your code by modifying the string table, you're doing it wrong.

Edit: Proxy DLLs.

 

[MisterKid]

Then improve it? Source is there
You don't get the goal for releasing a source code?

 

[jMerliN]

That's like releasing a hello world as an operating system example and then when someone says "this isn't an operating system" you reply "so improve it, isn't that the point of releasing the source code?"

/facepalm.

 

[AngraMainyu]

Then improve it? Source is there
You don't get the goal for releasing a source code?

That implies that there's something of substance to begin with. That's not to say that your code isn't useful -- it has the makings of a packet editor already -- just that if it cannot protect itself from reversing, it won't protect a game client.

 

[Improved]

Anywho anyone willing to improve the anti-hack can just go ahead, the source was probably released probably due to it lacking interest for the OP and therefor decide to release it rather than working on it.

 

[MisterKid]

It helps some people tt1: that was my goal. Or it makes people wanting to do more into anti-hacking.
I didn't really like it so i gave up on it a long time ago. And I promised to release the source ones so I did.

@people complaining.
Read

"Well I hope you all can use it well or even improve it if you like too "
Lol its not really big its simple and messy in my view.

 

[ShadowDragon]

Well, I've been semi-waiting for this, merely because I'm interested in how it works (whether or not it's perfect)

Btw, think you put enough smilies in the first post? o.o

 

[mikederoobs]

Thanks For the Download I will try to make the antihack better

 

[MisterKid]

Bump.
The non sourced thread is getting some post and I get bugged on msn/pm's
I do not continue so use the source!

 

[Intelligence]

Is this source updated or not?

 

[Improved]

Is this source updated or not?

updated in which way? It haven't been touched since release if that's what you're asking.

 

[Intelligence]

Ahhh ok. I mean is, the one that developing by misterkid is q-protect 4 and he said in his last post (I think) in the thread were q-protect 4 is 'go to the source of it'. That's why I came here.

 

[ShadowDragon]

I haven't looked at it, but this was released after q-protect v4, so I'm guessing this is the source for that version.

 

[Intelligence]

Alright and I see that this has been released after qpro 4.

 

[MisterKid]

the source is the latest version

 

[Mootie]

Uhhhh...

#1 - Threading in an antihack isn't usually good unless done properly(which requires time checking by the main thread). A hacker can simply suspend your checking threads and your antihack is bypassed. You should have it check in a function that is essential to the game's processing, such as render.

#2 - Why are you using ASM and VirtualProtect at all? You can simply do something like:

DWORD dwAddr = GetProcAddress(hModule, "QueryPerformanceCounter");
if(*((BYTE*)dwAddr) == 0xE9)
...

#3 - This only checks for jmps at the address of the functions. A hacker can also jmp inside the function, or even hook the vtable and bypass any .text section checking completely. Do some research and you can easily find much better methods of detour detection.

#4 - At least check for hooks on ExitProcess/GetProcAddress/GetModuleHandle. Those are also easy ways to bypass this "antihack".

 

[MisterKid]

Updated link
@ Mootie Ty

 

[Deviant]

hey sir can you add splash thingy?

 

[MisterKid]

Erm Mootie your way is invalid.
DWORD dwAddr = GetProcAddress(hModule, "QueryPerformanceCounter");
Will get you the function address when the dll has the export.
Kernal32.dll exports QueryPerformanceCounter right?

if(*((BYTE*)dwAddr) == 0xE9)
It is not possible to do it like this

I found another way to block functions. The new way just replaces the function if it can find the function addres But using the same method you be able to bypass the antihack :S (only if you know the function addres) Most Flyff server has their neuzes unpacked so it would be easy to find the addres.