heero wrote:Updated 03/16/2011
Unpacked valexe.exe
http://www.mediafire.com/?c6f8y68a2f6o1xw
This is for people who don't know how to unpack valexe.exe
figured I should post this since people have been having problems with multiple window hexing
Belladonna - credit for the original posts
OPENING MULTIPLE CLIENT WINDOWS
For the first string, search for USER32.FindWindowA until you find the block that looks something like this:
Code: Select all
* Reference To: user32.FindWindowA, Ord:0000h
|
:006FAAF8 FF15B0337400 Call dword ptr [007433B0]
:006FAAFE 85C0 test eax, eax
:006FAB00 7407 je 006FAB09 <----------------- This is what we need to look for
:006FAB02 C605A002850001 mov byte ptr [008502A0], 01
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:006FAB00(C)
|
:006FAB09 53 push ebx
:006FAB0A 33FF xor edi, edi
:006FAB0C 6A77 push 00000077
Search:
85 C0 74 07 C6 05 A0 02 85 00 01 53 33 FF 6A 77
Replace:
85 C0 EB 07 C6 05 A0 02 85 00 01 53 33 FF 6A 77
For the second string, search for KERNEL32.CreateMutexA
The values needed are actually under KERNEL32.WaitForSingleObject as seen below
Code: Select all
* Reference To: kernel32.CreateMutexA, Ord:0000h
|
:006FBDFF FF1534317400 Call dword ptr [00743134]
:006FBE05 50 push eax
* Reference To: kernel32.WaitForSingleObject, Ord:0000h
|
:006FBE06 FF1528327400 Call dword ptr [00743228]
:006FBE0C 85C0 test eax, eax
:006FBE0E 0F85CC010000 jne 006FBFE0 <----------------- This is what we need to look for
:006FBE14 0FBE05723C7A00 movsx eax, byte ptr [007A3C72]
Search:
85 C0 0F 85 CC 01 00 00 0F BE 05 72 3C 7A 00
Replace:
85 C0 90 90 90 90 90 90 0F BE 05 72 3C 7A 00
The reason for using 90 90 90 90 90 90 is because the old code had je <address> this new code had jne <address> which means it will only need to jump if its not equal so we can just use NOP (90) to ignore the condition and let the code run.
For the third string, search for mss32._AIL_open_3D_provider@4 until you find the block that looks something like this:
Code: Select all
* Reference To: mss32._AIL_open_3D_provider@4, Ord:0000h
|
:0041B6AA FF1504367400 Call dword ptr [00743604]
:0041B6B0 85C0 test eax, eax
:0041B6B2 7409 je 0041B6BD <----------------- This is what we need to look for
:0041B6B4 5F pop edi
:0041B6B5 5E pop esi
:0041B6B6 32C0 xor al, al
:0041B6B8 5B pop ebx
:0041B6B9 8BE5 mov esp, ebp
:0041B6BB 5D pop ebp
:0041B6BC C3 ret
Search:
85 C0 74 09 5F 5E 32 C0 5B 8B E5 5D C3
Replace:
85 C0 EB 09 5F 5E 32 C0 5B 8B E5 5D C3
That should enable you to run multiple ragnarok clients now.
To disable GameGuard do this
Search for KERNEL32.CreateMutexA then scroll down until you see the code similar to the one below. I have pointed out the code we need to look for.
Code: Select all
* Reference To: kernel32.CreateMutexA, Ord:0000h
|
:006FBDFF FF1534317400 Call dword ptr [00743134]
:006FBE05 50 push eax
* Reference To: kernel32.WaitForSingleObject, Ord:0000h
|
:006FBE06 FF1528327400 Call dword ptr [00743228]
:006FBE0C 85C0 test eax, eax
:006FBE0E 0F85CC010000 jne 006FBFE0
:006FBE14 0FBE05723C7A00 movsx eax, byte ptr [007A3C72]
:006FBE1B 0FBE0D713C7A00 movsx ecx, byte ptr [007A3C71]
:006FBE22 0FBE15703C7A00 movsx edx, byte ptr [007A3C70]
:006FBE29 03C1 add eax, ecx
:006FBE2B 0FBE0D6F3C7A00 movsx ecx, byte ptr [007A3C6F]
:006FBE32 03C2 add eax, edx
:006FBE34 0FBE156E3C7A00 movsx edx, byte ptr [007A3C6E]
:006FBE3B 03C1 add eax, ecx
:006FBE3D 0FBE0D6D3C7A00 movsx ecx, byte ptr [007A3C6D]
:006FBE44 03C2 add eax, edx
:006FBE46 0FBE156C3C7A00 movsx edx, byte ptr [007A3C6C]
:006FBE4D 03C1 add eax, ecx
:006FBE4F 03C2 add eax, edx
:006FBE51 3DC9020000 cmp eax, 000002C9
:006FBE56 0F8584010000 jne 006FBFE0
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:006FBD59(C), :006FBD62(C), :006FBD6B(C), :006FBD74(C), :006FBD7D(C)
|:006FBD86(C), :006FBD8F(C), :006FBD98(C), :006FBDA1(C), :006FBDAA(C)
|:006FBDB3(C), :006FBDBC(C)
|
:006FBE5C B930C68400 mov ecx, 0084C630
:006FBE61 E85AD2FBFF call 006B90C0
:006FBE66 E8A5BBE4FF call 00547A10 <----------------- This is what we need to look for
:006FBE6B 85C0 test eax, eax
:006FBE6D 0F846D010000 je 006FBFE0
Search:
E8 A5 BB E4 FF
Replace:
90 90 90 90 90
That should disable GameGuard for Valkyrie.
