Originally Posted by
masterboy120
You need to place a hook on get tick count...
if you placed a hook on get tick count, a bad string would be passed through that function. All you have to do to tell pb that everything is ok..
Code:
if(strstr(buffer, "Bmk GetTickCount 5 c9c9c9c9c9")){
strcpy(buffer, "Bmk GetTickCount 5 c9c9c9c9c9 ba0000fe7f8b02f762040facd018c390");
}
That will tell pb that there is no hook on that function and all the bytes were as they are suppose to be.
Credits to Strife
What if the strings get updated? Which i heard they are usually.
Also, i think, maybe, with the PB checks, that, it has its own like code, then the MD5 of the file. Since it has an MD5. So, maybe, if you find out that first "code", then find the original MD5 of WarRock.exe, then you always return that correct string? So... how do we find out what is the string for WarRock.exe AND the PBCL.dll?
Alright, well, i relogged, and got banned, once again LOL
Heres the log.
Code:
B+1000 ff000 018B62AE302B24D0AD5DAAEA5D21ACFE
B+100000 100000 76D396E0B14448B7D64444DC9E514E03
B+200000 100000 1424129BB6A2F91BDA71D849F6F0A5EE
AMy dx C:WINDOWSsystem32d3d8.dll size=1179648 md5=42803EC60803C1A0754671E9183458F1
B+300000 100000 BF26F6099AB0BEA2DDB01B7E0FABCEA0
B+400000 91fff 822ED0618B62EF08A5E517568E97076B
B* d3d8.dll 10347 1_8bff558bec6aff6858c1aa6d64a10000
Bmk OpenProcess 21 518D04245068********6A00FF15********50FF15 8bff558bec83ec208b45108945f88b45
B+200000 100000 1424129BB6A2F91BDA71D849F6F0A5EE
B+300000 100000 BF26F6099AB0BEA2DDB01B7E0FABCEA0
B+400000 91fff 822ED0618B62EF08A5E517568E97076B
AMy dx C:WINDOWSsystem32d3d8.dll size=1179648 md5=42803EC60803C1A0754671E9183458F1
B* d3d8.dll 10347 1_8bff558bec6aff6858c1aa6d64a10000
Bmk OpenProcess 21 518D04245068********6A00FF15********50FF15 8bff558bec83ec208b45108945f88b45
Bmk GetTickCount 5 c9c9c9c9c9 ba0000fe7f8b02f762040facd018c390
B c 55FA0 E82B6F0100594050 xxxxxxxxxxyyyyxxxxxxxxxxxxxxxxxxxxxxxxxx F7D7C2E305C952605E179120A79DA84A
I *think* i remember just scanning the memory with cheat engine, and finding values, was not detected.
Maybe, we can find the value of the pointer that the strings are held under? And just log those somehow? VIA DLL injection and/or CE memory scan? Just a theory...