MzBot2 API Beta 2

May 4, 2007

This have been sitting on my Desktop for a long time, and now I am itching to release it.
This probably will help people making their own bot, or customize MzBot… etc
( Hint: This can be used to bypass ACTools, figure it out yourself! )

Who:
By Zuan, of course. All files signed, do check it.

What:
This is a DLL ( with .lib or .h ), that would use MzBot to provide bypassed SendInput function call.

When:
Now!

Where:
Zuan’s blog!
DL Link: http://filexoom.com/files/2006/12/20/49476/MzBot2%20API%20Beta%202.zip

http://www.divshare.com/download/623977-461

How:
If you know how to do dynamic DLL loading, then you probably know what to do… ( Most of you should know dynamic DLL loading… )
If you don’t, and use BC++ or VC++, then you can use the header file. ( One extra layer with the header, so not so recommended. )
If you use other language, ( except Java and some “You-just-shouldn’t-write-a-bot-with-it” language. ) then you probably can make use of the .lib and .def file…

APIs:
InitMzBot() (DLL) / MzBot_Init() (.h) — Init the module, locate MzBot process, if it return 0, means failed.
AltSendInput() (DLL) / MzBot_SendInput() (.h) — Bypassed function for you to play with. =) Do not call if not init.-ed.


MzBot 2.0 Beta 2

March 26, 2007

I was very busy over the past few weeks, so I didn’t really do any MzBot development.

Today, I freed up 2 hour, and added in 2 extra command, and 1 IPC.

Sorry, some rants here:File system is the WORST IPC I have ever tried!

Ok, let me introduce the new features:
- ss command, this command will allow you to send keyboard scan code. Eg:
ss 29
Would help you press the Ctrl key once, which is the attack key.
- mc command, this command will allow you to stimulate a left mouse click. Eg:
mc
Would help you to LeftClick once
- File system IPC. Now your programme can send command to MzBot! With this feature, you can now write a GUI to MzBot, by sending MzBot commands (vs) to it.
Also, you can write your own bot by sending the ss and mc command to MzBot!
How you can do this is:
- Try to access C:\toBzM.comm.instr
- If the file is empty, or not found, MzBot is probably ready.
- Write whatever command you want MzBot to do in the file
- Close the file.
- When the file is empty, or not found again, MzBot have done the command.

By the way, starting from this version, all MzBot from me will be signed, meaning that you can check the integrity of the file.

Note: If your programme is using MzBot for botting function, please do add in “Botting component powered by MzBot”

Download points:
http://filexoom.com/files/2006/12/20/49476/MzBot_Lite-2.0.0-Beta2.zip
http://filexoom.com/files/2006/12/20/49476/MzBot_Lite-2.0.0-Beta2.rar


A warning about the future

March 18, 2007

Please do read through this blog entry. This is very important! It not only about game hacking, it is also about the freedom to use your computer!

Current situation
If the Terms of Service is not in place, it is actually fully legal for anyone to modify the memory of any online game to achieve the so-called effect as hacking.

Also, as nProtect GameGuard doesn’t come with an End-User License Agreement, we are free to do anything to it. It is perfectly legal.

Also, our playing field with the anti-hacking software is almost leveled. In the ring0, in ring 3, all they have got is 1 extra undocumented API, which doesn’t really affect alot.

Furthermore, we are able to cheat in game, because they are putting data that aren’t supposed to be in our computer, into our computer. Just to save the computational resource on their side.

All because it is on our computer, and we own our computer.

What happens after Windows Vista is introduced
Perspective from a game cheater ( or hacker ):
There are various new technology introduced, that may be disadvantageous to us.

- PatchGuard
All our kernel hooking technic is now impossible, as it will immediately trigger a Bug Check, or in slang, we call it Blue Screen of Death.

Even MzBot will cease to work, since it alters kernel structures, which is checked by PatchGuard, and will be offer a reboot immediately if it is found altered.

Dual’s SaruenGang, which make use of a clever MSR hook, will cease to work also, since PatchGuard will check almost all CPU registers and structures, including LDT, GDT ( Now you cannot make 0×00400000 a ring0 segment. ), CRx ( All control registers ) and IDT ( Interrupt Descriptor Table ).
Please do take note that it is not the programme that is blocked.

It is the method that is blocked.

You may think that you can bypass PatchGuard, but all public methods are patched almost immediately.
Finding your own method is very hard, and is probably beyond almost all of us noobs.
Leeching a method is probably also very difficult.

Also to note, in the Windows Vista End User License Agreement, it state that you are not supposed to work around any technical restriction. That means you are not supposed to bypass PatchGuard. By bypassing PatchGuard, you invalidate your Windows Vista license, and you may be charged and thrown in jail for unauthorized use of software. ( Unlike cheating in online game, you only get banned. )

- Address Space Layout Randomization
This may change the address of every hack every reboot, meaning each time you restart your computer, address of “hacks” like godmode and vacs will change.

- What’s gonna come in Vista Service Pack 1
There’s some APIs that are designed for Anti-Virus company in Vista Service Pack 1. Some APIs are to set application “invulnerable” to memory editing, meaning that the operating system ( Windows Vista ) will disallow any program to edit MapleStory’s memory.

Details about this API is still unclear, maybe they will disable all DLL injection to that process or just add another internal kernel structure that NtProtectVirtualMemory will check to prevent other processes from setting that process’ page to writable… etc… There are too many possibility. However, most probably it will be very very hard to bypass, and probably will involved PatchGuard in the process too.

- TC ( Trusted Computing )
This is the most lethal and fatal to all game cheaters. However, this won’t get implemented so soon. And yes, this is the technology (Palladium) that Microsoft claimed that will stop all virus, malware and spyware… ( But the fact is: It doesn’t stop any virus/malware/spyware… )

You can read more about TC here ( I recommend you to read it all, although it is quite long, but you can do it later, some people just aren’t patient on important stuff… ):
http://www.cl.cam.ac.uk/~rja14/tcpa-faq.html
Also to note, the above is written by a Professor of Security Engineering at the Computer Laboratory in University of Cambridge.

Maybe you will wonder, so what if TC allows music publisher to delete pirated MP3s on my computer without my consent, or what if Trusted Computing allows Microsoft to format my computer if they think my Windows is pirated ( Very oftenly, Microsoft mistaken a fully licensed Windows for a pirated one. )

We should pay attention to a technology in TC, that is memory curtaining. That is, the CPU will disallow anyone from reading a piece of memory, not to mention writing to it. This is implemented from hardware level, and is very easy to bypass: ( Try it at your own risk. )
- Shutdown your computer
- Yank the CPU off the main board, get a hammer and smash it to pieces.
- Yank the TPM ( Trusted Platform Module ) off the main board.
And you are done, but your computer won’t start anyway…
The memory curtain feature is impossible to bypass, unless you follow the steps above ( destroy the hardware ), or miracles happened.

You might think: Ha! Luckily, they haven’t implement it in the hardware yet. When they start selling hardwares with these terrible features, I can just refuse to buy them!

Then too bad, you are wrong. All PCs sold in 2006 comes with the TC, some in 2005 comes with the TC. Just that the software ( Windows ) didn’t activate/use it, so you can still do all the vac and godmode in game.

- Regarding Cheat Engine for Windows Vista
Many just think that we should just wait for Cheat Engine for Windows Vista to come out. However, this thought is too naive.

However, yes, the Cheat Engine for 64-bit Windows Vista will come. Cheat Engine itself does a lot of Direct Kernel Object Manipulation and modifying CPU registers. However, this is not possible on Windows Vista, so it would take a lot of time to make CE run on Windows Vista. Or perhaps Dark Byte just doesn’t want to port Cheat Engine to such a limited platform.

Various efforts by ordinary users in Cheat Engine Forum or other forums to create an Undetected Cheat Engine would probably lead to nothing in the end. Since there’s too many to be done, and very possibly beyond them. ( Making CE run on Vista is not simple find and replace… )

Even if such a Cheat Engine is made, it probably will be very limited, and easily defeated by nProtect GameGuard, as iNCA can afford to pay Microsoft. And this time, we cannot bypass by replacing “detected strings”.

Further adding onto this, the future Cheat Engine that run on Windows Vista won’t be able to help you get ride of various Windows Vista “technical restrictions”.

Therefore, we can conclude Windows Vista is a very hostile environment for Cheat Engine.

From a normal user’s view:
- TC
As we mentioned earlier, TC will stop you from piracy, and even stop legitimate users from using their computers.

- Forced to upgrade to Windows Vista by incompatibility
When a user starts to use Windows Vista, it will force all users around him/her to upgrade to Vista, which cost alot.
Microsoft will also stop support for Windows XP, and stop providing updates, so people are forced to upgrade to Vista.
By hook or crook, they will make you upgrade to Vista.

- Forced to upgrade your hardware.
Vista have a very high requirement for hardware, and with the “XP” hardware, Windows Vista would lag, and therefore encourage you to buy new hardware.
Many are upgrading their hardware just because of Windows Vista.
( For Singaporean: An example would be the IT Show from 8th March – 11th March 2007 )

All in all
With the introduction of these new technology(s) like Windows Vista and TC, our computer is no longer ours. Cheating in online game due to game author abusing our CPU ( those data should be processed in their computer, the server. ) will be the history. They will be free to abuse our CPU anyway they like.

What can we do?
We can do nothing, Microsoft and other company’s just rich, they have got their market monopoly, we can do nothing but let them control our computer, and let them control how we use the computer as well…

Or maybe not, we can voice our opinion to the company(s), we have to show them: We want our freedom back! We want our computer to obey us, not them!

But how?
- We can refuse to downgrade to Windows Vista, so the game company will not drop the support for Windows XP. ( On Windows XP, we have partial control on our computer, that’s why nProtect GameGuard can still stand. On an Operating System that we truly have control on, nProtect would be dead… )

- Throw Microsoft complaint letters on PatchGuard, TC, and various technology that take away our freedom. ( Erm… don’t get emotional and use vulgar? )

- Reject any service that use TC, so TC will not be wide spread. ( We cannot reject computer that support TC, since they quietly put it in our computers… The chance’s over. )

- Inform others about the danger of Windows Vista. ( Recommended for everyone. )

- Use free Operating Systems, for those who are courageous to do it. But mind you, you might not like it, since most games only run on Windows. You know it is hard to break out of software monopoly.

- Join free software development. ( For the leets only. ) Just for your information, Cheat Engine is a piece of Free Software, it is released under APL, which is considered an open-source license.
Helping open source software development is good learning opportunity for those who really want to learn computing/computer science.
There are many other open source projects other than Cheat Engine, go look around and see which you can join. Eg:
- The K Desktop Environment project.
- The ReactOS project. ( This is a clone of Windows, for those who want more knowledge on rootkitting and Windows Internal, go for this one. )
- The Linux Kernel. ( Probably for anyone at Dark Byte’s level. )
and there are more, just google around.

( Note to those who are attracted to Windows Vista’s theme: Go for a Mac instead, Vista’s theme’s just a rip off of Mac OS X. )


Update on MzBot ( For UCE developers )

March 13, 2007

As we know, if you start MzBot before you start your UCE, the UCE will screw up. However, there’s a fix to this. I am actually surprised that no body came up with it.

Look for the handler of IOCTL_CE_INITIALIZE in DBKDrv.c, looks like this: (I formatted it a bit so it looks nice)
i=-25;//takes some longer to load now....
while (i=pinp->AddressOfWin32K) &&
((UINT_PTR)PossibleKeServiceDescriptorTableShow[i].ServiceTableAddressOfWin32K+pinp->SizeOfWin32K)) &&
((UINT_PTR)PossibleKeServiceDescriptorTableShow[i].ArgumentTable>=pinp->AddressOfWin32K) &&
((UINT_PTR)PossibleKeServiceDescriptorTableShow[i].ArgumentTableAddressOfWin32K+pinp->SizeOfWin32K)) &&
(PossibleKeServiceDescriptorTableShow[i].TableSizeAssociatedIrp.SystemBuffer=(UINT_PTR)KeServiceDescriptorTableShadow;

DbgPrint("KeServiceDescriptorTableShadow[0]=%p",&KeServiceDescriptorTableShadow[0]);
DbgPrint("KeServiceDescriptorTableShadow[1]=%p",&KeServiceDescriptorTableShadow[1]);
DbgPrint("KeServiceDescriptorTableShadow[2]=%p",&KeServiceDescriptorTableShadow[2]);
DbgPrint("KeServiceDescriptorTableShadow[3]=%p",&KeServiceDescriptorTableShadow[3]);

AddSystemServices();
break;
}
}
i++;
}

Then you replace it with:
if ( (ULONG) ((PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)+0x40))->ServiceTable == (ULONG) KeServiceDescriptorTable->ServiceTable ) {
KeServiceDescriptorTableShadow = (PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)+0x50);
ntStatus=STATUS_SUCCESS;
} else if ( (ULONG) ((PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)+0x140))->ServiceTable == (ULONG) KeServiceDescriptorTable->ServiceTable ) {
KeServiceDescriptorTableShadow = (PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)+0x150);
ntStatus=STATUS_SUCCESS;
} else if ( (ULONG) ((PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)-0x40))->ServiceTable == (ULONG) KeServiceDescriptorTable->ServiceTable ) {
KeServiceDescriptorTableShadow = (PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)-0x30);
ntStatus=STATUS_SUCCESS;
} else if ( (ULONG) ((PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)-0x20))->ServiceTable == (ULONG) KeServiceDescriptorTable->ServiceTable ) {
KeServiceDescriptorTableShadow = (PSERVICE_DESCRIPTOR_TABLE) (((ULONG)KeServiceDescriptorTable)-0x10);
ntStatus=STATUS_SUCCESS;
}

if ( ntStatus == STATUS_SUCCESS ) {
*(UINT_PTR*)Irp->AssociatedIrp.SystemBuffer = (UINT_PTR)KeServiceDescriptorTableShadow;
AddSystemServices();
}

NOTE: I never tried this code before, but I am certain that it will work, if you met any problem, do reply to this post.


MzBot_Lite-2.0.0-Beta! Open for public testing!

March 10, 2007

Recently I am quite busy, so only till now that I spend sometime into programming/hacking.

The new version of MzBot — 2.0.0, is now under public beta!

However, don’t be too happy:
- Auto-skills not available.
- It is a “Lite” version, only CLi ( Command Line interface ), HKi ( Hotkey Interface ), since Borland lags the hell outta of my comp.

MzBot’s not yet freezed for 2.0.0, that means there might be other stuffs added in later.
- Auto-skills might be added in later, no time for that one as of now.
- Scripting might be added in later

If you experience any problem, please do notify me. ( Reply to this post perhaps? )
If you want new features, you may contribute to this project. ( I will consider giving you the source. )
( MzBot might be released under GPL later on. )
If you experience problems regarding auto-potting, do post the log ( those that appear on screen. ), while you are auto-potting. ( You might want to just post a line, and tell me where the HP/MP potting position is set to at that time. )

Also, there is a letter for iNCA embedded in the MzBot, just like the previous versions. ( A command would save it to the disk, can you find it? )

I might open up a website as MzBot’s homepage (probably will include an SVN/CVS), but later on, since I am quite busy recently. ( Check back later on. )
Download mirror1:
http://www.live-share.com/files/175157/MzBot_Lite-2.0.0-Beta.zip.html
Download mirror2: http://www.rogepost.com/n/0665053261
File size: ~ 7k

NOTE: If you hate the command prompt ( CLi ), just ignore it and use the hotkey of previous version. ( There’s no change in the hotkeys, although the whole thing is recoded )
EDIT: download mirror 2 added because live-share doesn’t seemed to support Singapore ISPs… AP File Host + AP ISP == Phail!


MzBot

February 18, 2007

1. When it all started
Oct/Nov 2006, when my final year examination is over ( In which I slacked and scored only 73% ), I am really have an amount of time for me to spend on hacking.
One of my friend, tsj4j ( Spencer Thang, from RI ), came and ask me for a simple Autoclicker for use in Trickster Online, which also use the nProtect GameGuard. So I just use the same simple method of bypassing the usermode hook, and inject into the game process.
However, he later reported back to me that it doesn’t work!
I instructed him to briefly debug the Autoclicker, it ended up that the loophole of allowing the game process to bypass the SSDT hook is patched.
That inspired me to screw their hook.

2. November holiday, when I am bored
I went back to Taiwan on Mid November…
That was when I thought of the SSDT relocation, which is documented in both my blog ( See the MSBot case ) and in Dual’s blog.

3. Ideas put in action
At the end of the November, I wrote the driver and tested it out. ( The command line debugging utility for MzBot.sys, TiMBuS seen it before. )
The GUI is done on the 1st of December.
That night, my mom went to hospital to look after my grandpa ( who died just recently.. T_T ), so I can sleep anytime I want…
Around the midnight, I thought I want to leave something for the iNCA people, just in case it leaked out, so I wrote and embedded a letter to iNCA in MzBot. ( You all should try to get it out? )
I don’t really treat MzBot as an important project, neither would it be public, that’s why I didn’t really give it a proper protection, I only packed it with ASPR, and added a small anti-unpack ( Still can’t fool SunBeam.. )

4. Sigh…
Around the end of Feb 2007, many people in MSS requested me for MzBot, so I made a version that expires on 15 Feb, and gave it out, by sending it to them individually.
Then, somebody gave it to BrandonMS ( Thanks to SunBeam for notifying me. ), that’s how it all got leaked…

Appedix 1: Regarding the Autopotting:
The autopotting is working on my computer, so I don’t see why it isn’t working on yours…
There’s a way to make MzBot bypass MSBot or MSPro, but it is private. I only told 1 person about it, so if you are the person, you should know better than to leak.


Sigh… I wish I can #undef LEAKERS and LEECHERs…

February 17, 2007

This have been the major problem for almost all MapleStory cheating community — Leakers, Leechers, and spammers.

There was 3 recent case that discouraged me in great extent:
1. The Rajinn and ZTrainer case:
ZTrainer is one of the internal DA project, just a trainer with most of the usual functions like auto-CC, auto-pot and stuffs, it was made around Aug 2006.
Later, Rajinn was expelled out of the Dark Alliance, the reason being mainly pissing dL off.
However, he already have the ZTrainer source code the time he is expelled. Later, I went to tell him why he is expelled. He is so angry that he asked me to suck his d*ck… ( I ain’t g@y… )
Then, he just renamed ZTrainer into JinnTrainer, without any credit given. Furthermore, he claimed that ZTrainer just sucks…
Halfway through his renaming, he still have the face to come and ask me how to move a label in my ZTrainer… -_-”
2. The Linosal and DA website case:
The Dark Alliance was set up on the new year of 2006, or perhaps before that, by Kenshim and Zaros.
I joined in around April, when I made ZE, the first UCE in the MapleStory hacking history.
Around August, both Kenshim and Zaros went inactive, and I was elected the new leader. I then decided to fork out the DA from the CE Forum. Linosal volunteered to host the new forum.
Everything is fine till this Feb, when all of a sudden, all public can visit the Dark Alliance forum. At first, I thought the DA site is hacked, however, later Linosal say that he “liberated” the forum!
Just to earn a few dollars from the google ads he put up on the site after he “liberate” it, he betrayed all of us…
3. The MzBot issue:
Will be posted in the next blog entry.