GG Bypass and Multiclient

Quick Reference
Quote:
Originally Posted by zerosignal
Download and install OllyDBG, this requires basic knowledge how to use it.

* In Shaiya installed folder, open "game.exe".
* Make sure you have selected the "game.exe" Executable Module (View -> Executable Modules).
* To do a Intermodular call search, right click on ASM Code window, select Search for -> All intermodular calls. It's useful to sort by Destination.
* To do Text string search, right click on ASM Code win, select Search for -> All referenced text strings. Then in the results, right click, then Search for text.

Code:

search for Intermoduler call kernel32.CreatMutexA
Under CMP EAX,0B7
Change JNZ to JMP.
Look for USER32.FindWindowA
Under TEST EAX,EAX
Change JE to JMP


Search for ASCII "nProtect GameGuard".
Directly underneath it.
Change from JNZ to JMP.


Search for IC the first kernel32.GetCurrentProcessId.
Above it look for TEST AL,AL.
Underneath change JNZ, to JMP.


Search for IC the second last kernel32.CreateProcessA.
Scroll up till you see ASCII "enc: %s".
Below it should be a set of PUSH commands,
Change the 3rd last PUSH 1 to PUSH 0.


Search for IC last kernel32.GetExitCodeProcess.
Above it look for the first MOV EAX,262.
Change from MOV EAX,262 to MOV EAX,755.

(Optional - So you do not have to pass start game arguments to exe)
search for ASCII "start game",
Under TEST EAX,EAX
Change from JE to JMP.

Credits:
Jewbacca (Ploxoraus).
Everyone else who contributed.
Detailed Instructions
Quote:
Originally Posted by Lucky_Phil
Detailed tutorial on making a No GameGuard Multi-Client executable.

So far the tutorials i have seen here are good, but for all you absolute newbies with none/next-to-none experience with Ollydbg here is a detailed tutorial on making the hacked client. (GG Bypass and Multi-Client)

Before you begin:
Make a backup of your game.exe file. I normally just make a copy of it in the same folder, except rename it to game.bak. That way, if you screw things up, you can easily delete the bad file, and then rename game.bak back to game.exe.

STEP 1

Download OllyDbg. Download links are at the bottom of this post
Install and open OllyDbg.
Click File>Open or press F3
Navigate to the folder Shaiya is installed in. (this is probably in C:\AERIA GAMES\Shaiya, depending on install)
Open game.exe



STEP 2
In the big section that pops up, do the following:

Right Click>Search For>All intermodular Calls
In the window that appears /fills up with information, sort the results by destination. (this can be done by clicking on the column header)


Now remember that procedure. In the rest of this tutorial i will only be referring to it as searching for IC's.

STEP 3

So search for IC's and scroll down until you find kernel32.CreatMutexA. (in the destination column)
Double click on the first kernel32.CreatMutexA
3 lines under the line that is now highlighed (the kernel32.CreatMutexA), you should see JNZ SHORT game. in the middle column.
Double click the JNZ bit, and in the small window that pops up, change JNZ to JMP and click Assemble


Code:

1: Search for All intermodular calls
2: Sort by Destination
3: Scroll down till u find USER32.FindWindowA, and double click on it
4: Under the command TEST EAX,EAX change 1st JE to JMP


STEP 4

Search for IC's
Scroll to find kernel32.GetCurrentProcessId, and double click on the first one.
A couple of lines up in the middle column should be JNZ game.(numbers)
Double click on it, and change the JNZ to JMP, and click Assemble.



STEP 5

Search for IC's
Scroll to find kernel32.CreateProcessA, and double click on the second last one.
Above that, about 5 or 6 lines up, will be PUSH 1, and InheritHandles = TRUE.
Double click on it, and change the PUSH 1 to PUSH 0, and click Assemble



STEP 6

Press Ctrl+F
In the Find Command window that appears, copy in MOV EAX,262
In the line that Olly navigates to, double click it, and change to the MOV EAX,262 to MOV EAX,755 then click Assemble



STEP 7

Right Click>Search for>All referenced text strings
Scroll to find ASCII "start game", and double click on it
About 5 lines under you should see JE game.(numbers)
Double click on it, and change the JE to JMP



STEP 8

Right Click>Search for>All referenced text strings
Scroll to find ASCII "nProtect GameGuard", and double click on it
Directly under it you should see JNZ SHORT game.(numbers)
Double click on it, and change the JNZ to JMP



STEP 9

Right Click>Copy to executable>All modifications
In the new window that appears, Right Click>Save File and save it in the Shaiya folder.



STEP 10

Make a copy of the shorcut on your desktop/start menu, and called it "No GG Shaiya" or something. You probably shouldnt delete the original shortcut, so that you can update shaiya when you need to. Sometimes an update will not patch the game.exe, but when it does then just follow the above steps again.
In the new shortcut you made, Right Click>Properties
In the bit that says "C:\Aeria Games\Shaiya\game.exe", add start game to the end.
Your new shortcut should look like "C:\Aeria Games\Shaiya\game.exe" start game
Click Ok and you are done!


Credits:
Jewbacca (Ploxoraus).
ZeroSignal.
Everyone else who contributed.

OllyDbg Download links
Download Page: Download
http://www.ollydbg.de/download.htm
Direct Download Link: www.ollydbg.de/odbg110.zip