Narvikz

Nice work, Dev, keep it up!

It was developed for almost 10 years keeping pace with microsoft releases, way before XP / ME / 2000 or even 98. I find it hard to link it with any kind of leak opposed to a research project. Afaik windows source code has leaked 3 years or so ago, but prior to that we haven't taken a peek in some decades. idk what's the need for that tin foil hat, Microsoft even provides symbols for most their stuff. It was not based off stolen code.

Yea ok. I will not be discussing this with you, but my fault for dropping it in without any context anyway. ReactOS reached Windows Server 2003 compatibility, then the project was halted due to loss of interest. Anyone who can understand it sees the point has been proven and that kernel integrity checks were not really needed for ReactOS, nor would it make sense enforce its own root authority chain of trust nor Microsoft's in their own research OS. I really hope you're not Frankie. I never seen martysama thread but I remember how annoying that guy was over skype asking for information like he actually needed that money to be partying or something. I am not surprised by the turn of events. bad joke bad

It would literally take me 10 minutes to put together so many words let alone organize them in coherent sentences. Hell if I wanted to fool someone into believing I'm some kindaivy league PhD biochemist for reddit in so many words it'd probably take me more like 20. I'm betting you took 30 minutes to come up with this post alone. Why don't you grab a book in your free time? Oh and BTW reverse engineering is miraculous. Surprise surprise, there's WinServer2003 compatible reversed from source windows: [Hidden Content] mind = blown

Yes everything is possible. I don't think you will though. If you ever get through this import-resources-nonsense issue into the technicalities feel free to HMU, if we're talking about the client that is and not whole back-end server suite, you may be feeling suicidal and I don't wanna get your hopes up

Uh, partly actually, a year ago. Cheats at this point are ridiculously easy to detect or block.. That's not the point however. What I'm saying is unlike anyone else that's tried I can and will deliver. And I'll deliver an overkill solution.

Yea, I know about Frankie and his tricks, when I exposed him he tried to make friends with me for information on how to defeat m2bob, hilarious kid. You wouldn't have an issue with my solution, cheaters wouldn't stand a chance lol About unpacking protection, what's wrong with VMProtect 3? It's really strong I heard. I can't really develop a virtual machine system to run code at within feasible time but might work on something later on.

That is absolutely outrageous. Very good answer to every question I had. Thanks very much, looking for more answers. EDIT: What about solutions on the market? They claim to block m2bob, are they all scamming (not surprised if so)?

So, some of you may know me, my name isn't deeply tied to the metin2 scene but I've appeared enough in it. For those who don't, lets just put it like this: I'm a knowledgeable guy, and I'll prove it. Deeply tied to the cheating community I've worked and stayed under the radar in several anticheats, from small proprietary ones like MLG Anticheat (NewZ), worked on disabling known-to-you anticheats like HackShield without really any difficulty. I've gone up against BattleEye, Valve's Anti Cheat multiple times in multiple games having established a known name in the CS:GO scene, I've since gone up against BattleEye rootkit, and went undetected on state-of-the art anticheats like ESEA. I've defeated anticheats like EAC, ESL Wire, 5EWin, CEVO Celavimus, FaceIt Serverside anticheat where I led public research on how to bypass it and released a full explanation of their tech on popular cheating forums. I've developed Kernel-Mode solutions to cheating in several anticheats like BattleEye, EAC, ESEA, FaceIt client on demand from customers (Oh, did I mention I'm a freelancer?). I've had ties with multiple pay 2 cheat websites and SandMann016 himself and I even worked on one in the past. So, I can deliver. It takes an hacker to beat cheating. If I push this to the market this will be a killing blow on cheating on metin2. Now my questions: Is there still a demand for anti-cheating solutions? Are solutions on the market any good? What is my competition? Thanks everyone

This tutorial is absolutely useless and everyone using it deserves to be exposed to the mediocrity behind it. At very least to have a reliable HWID generator you want to use (as bare minimum, you could do it way more complicated) GetAdaptersInfo to retrieve the MAC Address of the network adapter and DeviceIoControl to get the serial number of the disk, and then hash them combined to generate an unique string to identify the machine.

Hackshield is a useless piece of software, its developers are incompetent.

It's really easy to do something like this. You'll want to store the hashes (use your favourite hash algorithm for this matter) of the remote files in a public location so that it can be accessed by the client, and have an organized tree of your remote files. Whenever the client is booted you'll check the hashes of the local files and match them to the remote server. If they're different then just transfer them (careful about potential memory leaks and make sure to clear your memory buffer to disk from time to time, just general good practises). If the file is missing transfer them anyway.

RPI's CPU is an ARM based CPU, what you installed was probably the arm port of freebsd which anyway won't run these ELF files. You could try and compile it for the ARM architecture with a compiler, perhaps you could even cross-compile it from your original computer if you find a arm cross compiler, maybe it will work, but you can't run the x86-32/x86-64 ELF file directly.

What an executable packer does is running a compression algorithm on the original executable and generate a new executable which will uncompress it on runtime and setup the process environment so you'll run it, depending on how large and how optimized this algorithm is your mileage may vary but it might very well decrease the total size. This is what software like UPX does and to counter this you might either reverse engineer how the compressed payload is uncompressed and do it yourself, intercept the process procedures at runtime right after it is uncompressed but before the process environment is all changed and dump it from memory or dump the final state of the process and rebuild some of its (potentially) damaged sections. Now, probably you're also up to code virtualisation on top of that, which will allow you to store the actual instructions in a byte array as data and run it through a VM that will interpret it, to counter this you'll have to try a little harder. You can't simply decompile a portable executable file, that doesn't make sense, code is interpreted and turned into assembly by a compiler and there's no real reliable way to go back from that, it's just not how it works. Additionally, you should be specifically careful since there's red flags on the executable pointing towards a Ramnit malicious payload, this is a PE Infector virus that once on a machine will search for portable executable files, append a new malicious section and replace their Entry Point to run that malicious section. This will effectively ruin all your programs and there's no coming back from that, so I suggest you do not open that ever. Also, fuck off for bashing an upcoming reverse engineer, you guys are cancer and a shame to the free Internet.

To be honest at the time we talked I wasn't even remotely capable of doing anything remotely close to what I am now, 2-3 years passed I think? Glad to see it's all going well with your business, mine's had better days honestly, there were months where I could easily hit 5K€ back then, now I'm banking none lol, but hey no worries, I'm rethinking on another approach on my projects. You're welcome, I mean, the dude clearly circumvents the piece of bloatware this is meant to primarily work on, but he could've think out of the box and went way further than that, his system is so flawed. Using syscalls for this kind of stuff isn't hard, what's hard is actually getting all the indexes you need to work on all the operative systems you want it to work for, this means easily > 20 indexes for each system function you want to call. There's information online already with the indexes for operative systems ranging from Windows XP to Windows 8, however there's stuff clearly missing there like the Windows Server 2003 R2, Windows Server 2008 R2, Windows 8.1, Windows Server 2012 R2, Windows 10 and Windows Server 2016, you gotta do your homework for those. You can check a public table here: x86 | x86-x64 It's relatively easy to implement them though, you can even do wrappers quite easily if you don't have prologue/epilogue on your function using the naked keyword. EDIT: The patcher files are now located at this subdomain: ni871050_1.vweb02.nitrado.net Obviously Slait's been lurking around and seen this, now there's no public list of files available but the harm that there was to be done was already done by now, I guess it's pointless to just change your subdomain now isn't it Slait?