Working MuGuard Source

Hello again

Well since i developed a way to get of evade hacks on compatibility mode, i come back using this source, and now again im having problem with this soft " Hide Toolz "
The soft, is a driver to load any process in Hiden mode, so any aplicattion that is hiden with it can bypass the launcher...
I found somethings interesting:
* If u put the 32 bits string of this soft in your source it wont work, couse the soft load in a hiden mode also and it "changes" its strings somehow, and same way, it can always be launched first....then load hack in hide mode, close the loader soft and then open your game.

* If u put the main.exe in hiden with this aplication, the source will get the hacks that are "cloacked"... so its a hint :)

if u interest in some "developing" please comment ;)
here is the string of HIDE TOOLZ

Code:
{0x41155C, {0x55, 0x8B, 0xEC, 0x83,  0xC4, 0xF0, 0xB8, 0x84, 0x14, 0x41, 0x00, 0xE8, 0xC8, 0x22, 0xFF, 0xFF, 0xB8, 0xBC, 0x15, 0x41, 0x00, 0xE8, 0x5E, 0x4B, 0xFF, 0xFF, 0x8B, 0x15, 0xDC, 0x23, 0x41, 0x00}},	// Hide Toolz 2.1
 
Re: [Release] Working MuGuard Source

i mean fixing GS code mistakes,
for example jewelmix bug, server sied code just accepts jewel mixing and unmixing packets without full check, just checks for use of chaos box


or take a look at RecvPositionSetProc - it's a crazy one function :D


i don't know about new versions of gs, but old gses don't check attack distance, attack mobs in tarkan from lorencia :D


what about attacking in non-attack area? gs has check for map attribute, but it's wrong, some bytes to fix and will never be able to attack in non-attack area =)


a lot of examples =) and this things can easily be fixed =)


PS talking about muguard
here is a cute bot :D


And whit anothers packets tools? for example AutoBuff Bots or SpeedHacks how to control all in server side... i think is not very easy...
 
Last edited:
OK
I followed the video, but the DLL doesn't block the program...

Here is the 32 bytes
PHP:
{0x514467, {0x49, 0x75, 0xF7, 0xE9, 0x4F, 0xFF, 0xFF, 0xFF, 0x90, 0x8B, 0x02, 0x83, 0xC2, 0x04, 0x89, 0x07, 0x83, 0xC7, 0x04, 0x83, 0xE9, 0x04, 0x77, 0xF1, 0x01, 0xCF, 0xE9, 0x38, 0xFF, 0xFF, 0xFF, 0x5E}}, 	//Anti Alt-Tab

Did I do something wrong?
 
Re: [Release] Working MuGuard Source

good antihack = good rootkit, that protects process in ring3 and in ring0(user mode and kernel mode), so good antihack protection must begin with rootkit writing guides =)

That is not true, you can make a driver to check DKOM, SSDT hooks, and many other editing and wont be consider rootkit. Also preventive methods of anti hook on ring 3 would make the rest of the job. Probably injecting library will be the only malware fuction on an a invasive anti cheat. The rest is perfectly non malware. :ott1:

anyway, even if you will write a good rootkit, you will meet another problem, cryptography, you can have the best rootkit, but you will have to check the presence of it on server side, here you will need knowledges of cryptography or at least you will have to know how to work with 3rd party libraries

Serpent / RSA / BlowFish / SHA / AES

Plenty of examples in google for C++ coders. those focus the attacker on find the public key only and are pretty good resisting bruteforce (specially AES and Serpent).

another thing, public antihacks are easy to bypass, because you know how they work + if many server uses it, someone that will create a bypassing tool - will work on other servers

This is true, on a certain level. You can always protect your code with virtualization methods, permutations, metamorph, etc, etc. Plus preventive methods, CRC and a own made packer, you can make things difficult. At least for the MU community knowledge.

so the question - is it worth to spend a lot of time for things that will be bypassed in a week =)
anyway it's interesting to learn smth new, for example kernel mode programming :D by i don't feel that it's time for me for learning it

It depends if its for money it will worth the time spended, if its for public i guess not.

And kernel programming is allmost the same has ring3 (dont kill me kernel coders) but essentially its allmost the same. I think if you good coding on ring3, passing to kernel wont be a problem :thumbup1:

so conclusion is in writing a server side protections, finding holes, mistakes and fix it, so noone will be able to by pass it, cause everything is controled on server side

There is studys about method for protecting in whole server side, wich havent bring any success yet, client its essential part of what the cheater/atacker will try to mod. So mix protection (Client & Server) is a good way, more if they are both communicated all the time.

Cheers.
 
Any one explain to me why the antihack doesnt block the programs I added in the 32 bytes dump?
 
I want to be a programmer: D

How do these codes do I use the expression naısl Do you know il injected
 
Re: [Release] Working MuGuard Source

which one is better: the gameguard from mu korea or this one?
I cracked the 1.05T main and left the gameguard activated... it works perfect... I was wondering which one would be better? :rolleyes:

i liked this one better personally you should just test both and see for yout self
 
Founded one bug...When you kill any mob/player > Client crashes...Does any know any solutions about it? Tested ot 1.07H Main.
I have managed to temporary resolve this by disabling ChangeSerial(). what exactly changeserial do? and also dll not working in 64bit os. Can anyone tell me how to work around the source code for this dll to work with 64bit? I search the net and stuck in WOW64, anyone here can help?
 
compile the source using an c++ compile program (like visual studio)
if you dont know how to do this look for a tutorial in google or the forum
 
Re: [Release] Working MuGuard Source

any pro can make a video how to get 32 bytes of the offset
it wll help many dont know how to do
like me hehe
hope some one can make for newbi
thx
i do not make a video, but in 3 pictures you can see how is made (no matter how old is this thread this theme is actual, i think):


 
Back