Clan x86

Technical (Development, Security, etc.) => General Programming => Botdev => Topic started by: Hdx on February 24, 2007, 10:34:16 PM

Title: Lockdown
Post by: Hdx on February 24, 2007, 10:34:16 PM
[Joe Edit: Split from *me* (http://www.x86labs.org:81/forum/index.php/topic,8634.new.html#new)]

Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx
Title: Lockdown
Post by: Joe on March 02, 2007, 04:35:00 PM
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

Dumping StarCraft's RAM image to a file is cheating, results in massive "hash files", and will be broken as soon as someone implements it and Blizzard changes lockdown to hash the location it loaded itself into memory as well.

Just sayin'. :P
Title: Lockdown
Post by: Hdx on March 06, 2007, 12:15:13 PM
It already hashes itself.
From what I've seen/heard it grabs from the dll, the 3 main files, and your gfx buffer.
Something like that.
~Hdx
Title: Lockdown
Post by: Joe on March 06, 2007, 06:22:20 PM
So wait -- for each lockdown, you'd have to have the image of itself in memory? Can that be gotten from the DLL itself without loading it?

The graphics buffer, I think, would be stupidly easy as it's the same each time (lockdown runs at the same point).
Title: Re: Lockdown
Post by: trust on March 06, 2007, 09:02:43 PM
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
[Joe Edit: Split from *me* (http://www.x86labs.org:81/forum/index.php/topic,8634.new.html#new)]

Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

I'm pretty sure I wrote a lockdown plugin for JavaOp v1 if you can find it.
Title: Re: Lockdown
Post by: Joe on March 06, 2007, 09:20:40 PM
I'm almost positive you're confused. :P

The only ones who have gotten lockdown working are Yoni and/or Skywing, or those who have done so and kept it private. But if you did, "flippin' awesome!".
Title: Re: Lockdown
Post by: rabbit on March 06, 2007, 09:51:54 PM
Quote from: OG Trust on March 06, 2007, 09:02:43 PM
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
[Joe Edit: Split from *me* (http://www.x86labs.org:81/forum/index.php/topic,8634.new.html#new)]

Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

I'm pretty sure I wrote a lockdown plugin for JavaOp v1 if you can find it.
Lockdown is a new type of checkrevision created by Battle.net which hashes various parts of memory, and does some other things.  Not channel lockdown, which is retarded.
Title: Re: Lockdown
Post by: abc on March 06, 2007, 09:58:27 PM
** & warz
Title: Re: Lockdown
Post by: Joe on March 06, 2007, 10:09:01 PM
Nope. warz never finished.
Title: Re: Lockdown
Post by: trust on March 06, 2007, 10:25:46 PM
Quote from: rabbit on March 06, 2007, 09:51:54 PM
Quote from: OG Trust on March 06, 2007, 09:02:43 PM
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
[Joe Edit: Split from *me* (http://www.x86labs.org:81/forum/index.php/topic,8634.new.html#new)]

Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

I'm pretty sure I wrote a lockdown plugin for JavaOp v1 if you can find it.
Lockdown is a new type of checkrevision created by Battle.net which hashes various parts of memory, and does some other things.  Not channel lockdown, which is retarded.

oh sorry, yeah I was talking about channel lockdown.
Title: Re: Lockdown
Post by: Furious on March 07, 2007, 07:31:37 AM
Quote from: OG Trust on March 06, 2007, 10:25:46 PM
Quote from: rabbit on March 06, 2007, 09:51:54 PM
Quote from: OG Trust on March 06, 2007, 09:02:43 PM
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
[Joe Edit: Split from *me* (http://www.x86labs.org:81/forum/index.php/topic,8634.new.html#new)]

Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

I'm pretty sure I wrote a lockdown plugin for JavaOp v1 if you can find it.
Lockdown is a new type of checkrevision created by Battle.net which hashes various parts of memory, and does some other things.  Not channel lockdown, which is retarded.

oh sorry, yeah I was talking about channel lockdown.

Lol  :P
Title: Re: Lockdown
Post by: Joe on March 07, 2007, 11:04:28 AM
Quote from: Furious on March 07, 2007, 07:31:37 AM
Quote from: OG Trust on March 06, 2007, 10:25:46 PM
Quote from: rabbit on March 06, 2007, 09:51:54 PM
Quote from: OG Trust on March 06, 2007, 09:02:43 PM
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
[Joe Edit: Split from *me* (http://www.x86labs.org:81/forum/index.php/topic,8634.new.html#new)]

Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

I'm pretty sure I wrote a lockdown plugin for JavaOp v1 if you can find it.
Lockdown is a new type of checkrevision created by Battle.net which hashes various parts of memory, and does some other things.  Not channel lockdown, which is retarded.

oh sorry, yeah I was talking about channel lockdown.

Lol  :P

What a waste of like a kilobit of bandwidth for me.
Title: Re: Lockdown
Post by: Furious on March 07, 2007, 11:05:39 AM
Quote from: Joex86] link=topic=8759.msg111381#msg111381 date=1173283468]
Quote from: Furious on March 07, 2007, 07:31:37 AM
Quote from: OG Trust on March 06, 2007, 10:25:46 PM
Quote from: rabbit on March 06, 2007, 09:51:54 PM
Quote from: OG Trust on March 06, 2007, 09:02:43 PM
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
[Joe Edit: Split from *me* (http://www.x86labs.org:81/forum/index.php/topic,8634.new.html#new)]

Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

I'm pretty sure I wrote a lockdown plugin for JavaOp v1 if you can find it.
Lockdown is a new type of checkrevision created by Battle.net which hashes various parts of memory, and does some other things.  Not channel lockdown, which is retarded.

oh sorry, yeah I was talking about channel lockdown.

Lol  :P

What a waste of like a kilobit of bandwidth for me.

That's what I say when I read half of your topics. *shrug*
Title: Re: Lockdown
Post by: Joe on March 07, 2007, 11:14:10 AM
*shrug*

Note that this is Hdx's topic. :P
Title: Re: Lockdown
Post by: K20A2 on March 10, 2007, 03:18:40 AM
Quote from: Joex86] link=topic=8759.msg110944#msg110944 date=1172871300]
Quote from: HdxBmx27 on February 24, 2007, 10:34:16 PM
Just a note:
Lockdown is completely possible to do in Java ;)
But its not working yet.
~Hdx

Dumping StarCraft's RAM image to a file is cheating, results in massive "hash files", and will be broken as soon as someone implements it and Blizzard changes lockdown to hash the location it loaded itself into memory as well.

Just sayin'. :P

Dumping the "RAM image" is rather useless.  You just need to hash the three versioncheck files using a generated key from the server as well as a hash calculated off of the game's DirectX video buffer.

The whole idea behind lockdown isn't that complicated.  The only hack it checks for is pplug114.bwl (by trying to get the base address of it), but then again if you have a hack loaded, it probably modified the game's memory which is put through hash (not the actual files on disk, once again, it gets the base address of the files loaded).  Just finding exactly what it hashes is the hard part.

It is easier to write your own implementation than to write a workaround for loading Blizzard's version
Title: Re: Lockdown
Post by: Joe on April 11, 2007, 04:38:37 PM
Hm, if you replaced CreateFile, DeleteFile, etc, with stubs, couldn't you actually make your own lockdown DLL's that didn't check for the hacks?
Title: Re: Lockdown
Post by: iago on April 11, 2007, 05:14:59 PM
Quote from: Joex86/64] link=topic=8759.msg114822#msg114822 date=1176323917]
Hm, if you replaced CreateFile, DeleteFile, etc, with stubs, couldn't you actually make your own lockdown DLL's that didn't check for the hacks?
Assuming that the DLL does a checksum on memory (which I'm pretty sure it does), you'd have to fake the checksum, which would be identical to re-implementing it.

Title: Re: Lockdown
Post by: Joe on April 11, 2007, 07:05:33 PM
Right, but you could force StarCraft to use your DLL instead of the one from BNFTP, which does check for hacks, right?
Title: Re: Lockdown
Post by: iago on April 11, 2007, 07:22:24 PM
The one from Battle.net checks for exactly one hack.

The easier thing to do if you want to hack is to load your memory patches after the CheckRevision .dll is unloaded. You can hook LoadLibraryA() and FreeLibrary() safely, because Battle.net's .dll can't check those (kernel32.dll can't be guaranteed to have a consistent checksum).

Better yet, apply patches after the ExtraWork .dll has been unloaded. Then you're even safer.
Title: Re: Lockdown
Post by: warz on April 12, 2007, 02:30:08 PM
Quote from: iago on April 11, 2007, 07:22:24 PM
The one from Battle.net checks for exactly one hack.

Saying that is misleading. Checkrevision only checks for one hack's file name. Since most hacks deal with modifying memory, and the new Checkrevision routines check for that, I'd say it checks for a whole realm of hacks. :P
Title: Re: Lockdown
Post by: iago on April 12, 2007, 02:57:09 PM
Quote from: warz on April 12, 2007, 02:30:08 PM
Quote from: iago on April 11, 2007, 07:22:24 PM
The one from Battle.net checks for exactly one hack.

Saying that is misleading. Checkrevision only checks for one hack's file name. Since most hacks deal with modifying memory, and the new Checkrevision routines check for that, I'd say it checks for a whole realm of hacks. :P
I explained that in the previous post. But Joe is talking about checking for specific .dll's.
Title: Re: Lockdown
Post by: Joe on April 12, 2007, 05:25:26 PM
No, I'm saying that we could write a DLL that has the same functionality as the BnFtp DLL's, but doesn't check for hacks. By patching StarCraft's CreateFile and DeleteFile, we can stick our own DLL in the folder and StarCraft *should* run it instead.
Title: Re: Lockdown
Post by: iago on April 12, 2007, 07:21:01 PM
Quote from: Joex86/64] link=topic=8759.msg114991#msg114991 date=1176413126]
No, I'm saying that we could write a DLL that has the same functionality as the BnFtp DLL's, but doesn't check for hacks. By patching StarCraft's CreateFile and DeleteFile, we can stick our own DLL in the folder and StarCraft *should* run it instead.
Have you read my posts? The new CheckRevision does a checksum on your *memory*! The trick is to re-implement the checksum, which isn't an easy job.

The alternative, as I said, is to load hacks *after* the CheckRevision function runs. It's a whole lot easier than the alternatives.