[Collab] Devilian - Multi-Hack

[aktinidio]

I didnt know about the refine stone exploit. I didnt use it.
I used master skill 4-5h ago for 2minutes.Than i restarted game client and i closed the hack.

[Parog]

I updated the first post with this information:

READ FIRST, IMPORTANT!!

There has been a few bans since I put the speed hack in the multi-hack. I don't have enough information to figure out exactly what is triggering it, so until then, here's what I can conclude if you want to stay safe.

Even without hacking you DC and crash if you go too far during the lag spikes Trion is experiencing. While using the speed hack, you will DC easier as you will go further, faster.

The DC shuts the client completely and reports what happened without asking the user. (Using the process: GnCrashReporter.exe)

What is included in that report? for every game that does this; it also includes the modules attached to the game. Cheat Engine is a module that attaches to the game and they can see it in the report when it crashes IF THE REPORT IS SENT. That's the only thing I can see triggering the bans.

Today I will work on making the multi-hack a lot less detectable. In the meantime, here's what you can do to protect yourself;

1. When you notice skills are not going off / mobs are not moving / lag in general; STOP MOVING. If you have a pack of mobs on you, run in small circles as you would when fightning them, to make sure you're close to the position you were when the server started lagging when they stop. That way Trion's servers don't say you took at 50 meter step. This applies even if you're not using hacks, it'll reduce DCs.

2. Kill this process: GnCrashReporter.exe. (CTRL+ALT+DEL, then processes, find the one with that name and then "End task".) -- Next time you crash, nothing will be sent to Trion. This may or may not be a good thing, but for now, it's a lot better than them seeing Cheat Engine was running when it crashed.

If you played on Korean or Taiwan servers and know of other tricks or guidelines to keep the users safe, post them here and I will give you reputation for your contribution.

aktinidio, do you remember what the message was exactly?

[Parog]

I didnt know about the refine stone exploit. I didnt use it.
I used master skill 4-5h ago for 2minutes.Than i restarted game client and i closed the hack.

I still have the master skills saved in my skill tree and am not banned. If that was it, it would have crashed when you applied them, not 5 hours after. Stop using the hack for the time being if you spent money on your account, subscribe to the thread and wait for an update. I'll work as fast as I can, but I can't promise it'll be undetected even then.

[Flays]

sorry for my english.

It's not the speedhack or something...
It's cheat engine (if you connect cheat engine to devilian exe). Eu seadrift used 100% gameguard, you get a kick after 5-20 minutes (crash) with message "GameGuard initialization error" and after that, you get a ban in the next 5-30 minutes...

i think trion gets a message from gameguard and gives you a instant ban without seeing the logs

with my first test-account i was trying the instant sphere cast and with the second....something like money glitch with item's etc.

[Parog]

sorry for my english.

It's not the speedhack or something...
It's cheat engine (if you connect cheat engine to devilian exe). Eu seadrift used 100% gameguard, you get a kick after 5-20 minutes (crash) with message "GameGuard initialization error" and after that, you get a ban in the next 5-30 minutes...

i think trion gets a message from gameguard and gives you a instant ban without seeing the logs

with my first test-account i was trying the instant sphere cast and with the second....something like money glitch with item's etc.

The NA server doesn't display the gameguard splash screen when launching it, and I can't see it as a process like i usually can if it was on. Can anyone playing on the EU server tell me if they see a splash screen for gameguard? I'm looking into bypassing it right now as this is definitely what is happening, I'm just not sure it's enabled for NA yet, although it doesn't make sense.

[Flays]

forgot to say...


tested it with steamclient and the normal one from the side

[Parog]

forgot to say...


tested it with steamclient and the normal one from the side

Are you playing EU OR US? Do you see anything that says game guard when you first launch the game or a process in task manager that says gameguard or GG?

Without answers I really can't tell what is happening guys. I'll go around gameguard if I have to, but before I work on that, I need to know when it starts, as it doesn't seem to be running on my end for the US servers.

[mephuser1000]

The NA server doesn't display the gameguard splash screen when launching it, and I can't see it as a process like i usually can if it was on. Can anyone playing on the EU server tell me if they see a splash screen for gameguard? I'm looking into bypassing it right now as this is definitely what is happening, I'm just not sure it's enabled for NA yet, although it doesn't make sense.

To Parog,

Higher/Newer versions of Gameguard have *invisible loading screens*. It's definitely loaded in the NA Devilian-Glyph Client. The scary thing is that Gameguard will always download new signatures to update itself even when the main game doesn't need patching.

Bypassing Gameguard or making Cheat-Engine undetectable is an *expensive* paid premium service across the various boards.

Anyway for a Senior/High-ranking/Experienced "Game Modifier" like you, you wouldn't be going in naked with a public version of Cheat-Engine right? You must have certainly employed a *what you call it* Ring-0 (not sure) hiding driver?

Somewhere down your line of work, you must have immunized your computer not to let *sensitive stuff* go out unnoticed.

Most importantly, this page is listed within the top 5-10 search results of Google Search for the keywords "Devilian cheat". It's so easy for Trion to visit this page for details.

Anyway not that worried, since you can just pay $ to buy progress in the game. The bans are not as bad as NCSoft's bans.

[aktinidio]

I played on EU server. There is no gameGuard logo. in task manager there is not gameguard, gg, or any task that i dont know what it is. Only the GlyphCrashHandler, GoogleCrashHandler. Btw, before i get banned, I crashed serveral times but choose not to send information to Trion.

[Flays]

[Parog]

Stop using this entirely for now. Next time I update it, it'll be obfuscated, changed several ways and won't show up as cheat engine. Thank you all for your help.

I did this to learn and help people learn, and the next time I release it will be a learning process as well. Sorry for the loss. I'll temporarily remove the links and reup a non plain text version soon.

[Parog]

I'm done for today, but here are some strings from the game that are relevant to what happened today. Anyone who wishes to participate / learn / contribute / point us in the right direction, there will be a private group, send me PM me if you're into reversing and are interested. These discussions / more sensitive information will stay in hidden forums to protect users when hacks are released.


*cough*

.\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthglyph.cpp
.\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthgameguard.cpp

This looks like a really fun function to play with.

004B74EE  PUSH OFFSET 03A4C720                     UNICODE "ignore admin level stored at database and override it"

Address    Disassembly                               Text String

004A359E  PUSH OFFSET 039AB770                     UNICODE "gameguard ini"
004A35D6  PUSH OFFSET 039AB78C                     UNICODE "npgg_ini"
004AC01E  PUSH OFFSET 039DB0A8                     UNICODE "EHackCheckType"
0085544B  PUSH OFFSET 039AAA48                     UNICODE "processAntiHackQueue failed (game guard demon process killed)"
00855676  PUSH OFFSET 039AAF94                     UNICODE "deserialize_stream"
00855714  PUSH OFFSET 039AAC94                     UNICODE "client-memory"
00855797  PUSH OFFSET 039AACB0                     UNICODE "(NULL)"
008559E9  PUSH OFFSET 039AAC28                     UNICODE "GameClientSplash"
00855CD2  PUSH OFFSET 039AAC28                     UNICODE "GameClientSplash"
00856005  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085611B  PUSH OFFSET 039AB51C                     UNICODE "AntiHackClientAuthImmortal"
00856320  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00856436  PUSH OFFSET 039AB554                     UNICODE "AntiHackClientAuthImmortal~"
00856666  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00856782  PUSH OFFSET 039AB5C8                     UNICODE "checkAntiHackAuth"
008569DF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00856AF4  PUSH OFFSET 039AB59C                     ASCII "finalize"
00856CDF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00856DF4  PUSH OFFSET 039AB58C                     ASCII "initAntiHack"
00856FDF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008570F8  PUSH OFFSET 039AB618                     UNICODE "isInitialize"
008572DF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008573F8  PUSH OFFSET 039AB634                     UNICODE "isWorking"
008575DF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008576F8  PUSH OFFSET 039AB5EC                     UNICODE "processAntiHackQueue"
008578E2  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008579FB  PUSH OFFSET 039AB648                     UNICODE "set_user_id="
00857C02  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00857D1B  PUSH OFFSET 039AB5A8                     UNICODE "setWindowHandle"
00858161  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00858271  PUSH OFFSET 039AB7A0                     UNICODE "AntiHackClient"
0085844D  PUSH OFFSET 039AB78C                     UNICODE "npgg_ini"
0085851D  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085862A  PUSH OFFSET 039AB7C0                     UNICODE "GameGuard.Init="
008587E6  PUSH OFFSET 039A3C14                     UNICODE "Error"
008588FC  PUSH OFFSET 039AB7E0                     UNICODE "GameGuard Init Error:"
00858B89  PUSH OFFSET 039AC05C                     UNICODE "Devilian"
00858E70  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00858F86  PUSH OFFSET 039AC070                     UNICODE "~AntiHackClient"
00859221  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00859338  PUSH OFFSET 039AC1FC                     UNICODE "GameGuard.NPGameMonCallback"
00859575  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008595FC  PUSH OFFSET 039AC238                     UNICODE "GameGuard.NPGameMonCallback.HostID"
008597B0  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008598C7  PUSH OFFSET 039AC0E8                     UNICODE "eventCheckAntiHackAuth"
00859AB1  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00859BBE  PUSH OFFSET 039AC118                     UNICODE "host_id"
00859D7D  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00859E8A  PUSH OFFSET 039AC128                     UNICODE "GameGuard.Auth3 size full ="
00859FE2  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085A068  PUSH OFFSET 039AC160                     UNICODE "GameGuard.Auth3="
0085A340  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085A459  PUSH OFFSET 039AC0C0                     UNICODE "GameGuard finalize"
0085A6A2  PUSH OFFSET 039A3C14                     UNICODE "Error"
0085A7BC  PUSH OFFSET 039AC1FC                     UNICODE "GameGuard.NPGameMonCallback"
0085AA40  PUSH OFFSET 039AB6A0                     UNICODE "d:\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthgameguard.cpp"
0085AA6E  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085ABB9  PUSH OFFSET 039AB764                     ASCII "host_info"
0085ADBF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085AED8  PUSH OFFSET 039AC090                     UNICODE "GameGuard initAntiHack"
0085B28C  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085B3AA  PUSH OFFSET 039AC184                     UNICODE "Anti-Hack guardPtr null"
0085B63C  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085B758  PUSH OFFSET 039AC1B4                     UNICODE "responseToAntiHackServer"
0085B9DE  PUSH OFFSET 039A2C68                     UNICODE "unknown"
0085B9F5  PUSH OFFSET 039AB6A0                     UNICODE "d:\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthgameguard.cpp"
0085BAB9  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085BB4D  PUSH OFFSET 039AC1E8                     UNICODE "Anti-Hack"
0085BD70  PUSH OFFSET 03F26630                     ASCII "list<T> too long"
0085BEC3  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085BFDC  PUSH OFFSET 039AB5A8                     UNICODE "setWindowHandle"
0085C205  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085C31B  PUSH OFFSET 039AC2BC                     UNICODE "AntiHackClientAuthXLProtect"
0085C520  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085C636  PUSH OFFSET 039AC2F4                     UNICODE "AntiHackClientAuthXLProtect~"
0085C866  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085C982  PUSH OFFSET 039AB5C8                     UNICODE "checkAntiHackAuth"
0085CBDF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085CCF4  PUSH OFFSET 039AB59C                     ASCII "finalize"
0085CEDF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085CFF4  PUSH OFFSET 039AB58C                     ASCII "initAntiHack"
0085D1DF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085D2F8  PUSH OFFSET 039AB618                     UNICODE "isInitialize"
0085D4DF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085D5F8  PUSH OFFSET 039AB634                     UNICODE "isWorking"
0085D7DF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085D8F8  PUSH OFFSET 039AB5EC                     UNICODE "processAntiHackQueue"
0085DAE2  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085DBFB  PUSH OFFSET 039AB5A8                     UNICODE "setWindowHandle"
0085DFD4  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085E0E5  PUSH OFFSET 039AC480                     UNICODE "AntiHackClientAuthXignCode::AntiHackClientAuthXignCode"
0085E276  PUSH OFFSET 039AA05C                     UNICODE "Init"
0085E301  PUSH OFFSET 039AC4F0                     ASCII "XignCode create"
0085E3C2  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085E4D1  PUSH OFFSET 039AC500                     UNICODE "attempt ZCWAVE_SysInit"
0085E670  PUSH OFFSET 039AA05C                     UNICODE "Init"
0085E77C  PUSH OFFSET 039AC530                     ASCII "XignCode ZCWAVE_SysInit (msec)"
0085E92F  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085E9B5  PUSH OFFSET 039AC550                     UNICODE "attempt ZCWAVE_SysEnterW"
0085EA62  PUSH OFFSET 039AC584                     UNICODE "./XignCode/client/"
0085EA67  PUSH OFFSET 039AC5AC                     UNICODE "Kw_cjsPitNjH"
0085EA81  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085EB0F  PUSH OFFSET 039AC5C8                     UNICODE "ZCWAVE_SysEnterW failed"
0085EBE9  PUSH OFFSET 039AA05C                     UNICODE "Init"
0085EC6E  PUSH OFFSET 039AC5F8                     ASCII "XignCode ZCWAVE_SysEnterW (msec)"
0085ED41  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085EDC7  PUSH OFFSET 039AC61C                     UNICODE "attempt ZCWAVE_SendCommand"
0085EE96  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085EF24  PUSH OFFSET 039AC654                     UNICODE "ZCWAVE_SendCommand failed"
0085EFD2  PUSH OFFSET 039AA05C                     UNICODE "Init"
0085F057  PUSH OFFSET 039AC688                     ASCII "XignCode ZCWAVE_SendCommand (msec)"
0085F1E0  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085F2F6  PUSH OFFSET 039AC6B0                     UNICODE "AntiHackClientAuthXignCode::~AntiHackClientAuthXignCode"
0085F5D5  PUSH OFFSET 039AC334                     UNICODE "x3.xem"
0085F5E9  PUSH OFFSET 039AC344                     UNICODE "xcorona.xem"
0085F6EE  MOV EAX,OFFSET 039AC35C                  UNICODE "\x3.xem"
0085F6F3  MOV ESI,OFFSET 039AC36C                  UNICODE "\xcorona.xem"
0085FA25  PUSH OFFSET 03F26630                     ASCII "list<T> too long"
0085FAF6  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085FB8B  PUSH OFFSET 039AC950                     UNICODE "AntiHackClientAuthXignCode::callbackMyUserInfoImpl"
0085FC67  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085FCF6  PUSH OFFSET 039AC9B8                     UNICODE "read user key"
0085FDD3  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085FE54  PUSH OFFSET 039AC9D4                     UNICODE "ZCWAVE_OK"
0085FF6F  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0085FFF5  PUSH OFFSET 039AC9E8                     UNICODE "ZCWAVE_E_USER_INFO_ACCESS_DENIED"
008600EA  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008601FA  PUSH OFFSET 039ACA30                     UNICODE "ZCWAVE_E_USER_INFO_IS_NOT_READY"
00860426  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00860542  PUSH OFFSET 039ACA70                     UNICODE "AntiHackClientAuthXignCode::callbackOnProbeCompleteImpl"
008607C0  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008608DD  PUSH OFFSET 039AC820                     UNICODE "AntiHackClientAuthXignCode::checkAntiHackAuth"
00860ACE  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00860BE9  PUSH OFFSET 039AC820                     UNICODE "AntiHackClientAuthXignCode::checkAntiHackAuth"
00860C09  PUSH OFFSET 039AC87C                     UNICODE "ZCWAVE_ProbeEx failed"
00860E8F  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00860FA8  PUSH OFFSET 039AC778                     UNICODE "AntiHackClientAuthXignCode::finalize"
00861210  PUSH OFFSET 039AC3C0                     UNICODE "d:\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthxigncode.cpp"
0086123E  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00861389  PUSH OFFSET 039AB764                     ASCII "host_info"
008615BF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008616D8  PUSH OFFSET 039AC720                     UNICODE "AntiHackClientAuthXignCode::initAntiHack"
008619ED  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00861B03  PUSH OFFSET 039AC8E8                     UNICODE "AntiHackClientAuthXignCode::processAntiHackQueue"
00861B23  PUSH OFFSET 039AC8A8                     UNICODE "eventResponseToAntiHackServer"
00861D3C  PUSH OFFSET 039AC3C0                     UNICODE "d:\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthxigncode.cpp"
00861F32  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0086204B  PUSH OFFSET 039AC7C8                     UNICODE "AntiHackClientAuthXignCode::setWindowHandle"
00862314  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0086242B  PUSH OFFSET 039ACB20                     UNICODE "AntiHackClientAuthGlyph::AntiHackClientAuthGlyph"
008625EA  PUSH OFFSET 039A3C14                     UNICODE "Error"
008626FF  PUSH OFFSET 039ACB88                     UNICODE "Glyph Security Startup() failed"
00862900  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00862A16  PUSH OFFSET 039ACBC8                     UNICODE "AntiHackClientAuthGlyph::~AntiHackClientAuthGlyph"
00862CAA  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00862DC3  PUSH OFFSET 039ACC78                     UNICODE "AntiHackClientAuthGlyph::checkAntiHackAuth"
008631CF  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008632E8  PUSH OFFSET 039ACC30                     UNICODE "AntiHackClientAuthGlyph::finalize"
008634D0  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
008635E9  PUSH OFFSET 039ACCD0                     UNICODE "AntiHackClientAuthGlyph::isInitialize"
008639B6  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
00863AD1  PUSH OFFSET 039ACD68                     UNICODE "AntiHackClientAuthGlyph::scanComplete"
00863D61  PUSH OFFSET 039ACDB8                     UNICODE "d:\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthglyph.cpp"
00863E15  PUSH OFFSET 039ACDB8                     UNICODE "d:\buildbot_slave\publisher-enus-live\build\native\gameclientlib\antihackclientauthglyph.cpp"
00864152  PUSH OFFSET 039A8110                     UNICODE "AntiHack"
0086426B  PUSH OFFSET 039ACD20                     UNICODE "AntiHackClientAuthGlyph::setUserId"

[xviet4xlife]

I already breakpoint all those function through Steam version of Devilian online. None of them are active except occasionally antihackclientauthglyph.cpp. Game guards is not active. I did get "AntiHack" unicode active after i disconnected, which i'm assuming is what sends Trion information in case the server detects a possible hack.



Still not ban yet from level 1 - 46. Speed hacked, messed with my XYZ coords. And unlimited mana. Everything is fine with me. Do not use on gameguard protected version obviously.

[Parog]

I already breakpoint all those function through Steam version of Devilian online. None of them are active except occasionally antihackclientauthglyph.cpp. Game guards is not active. I did get "AntiHack" unicode active after i disconnected, which i'm assuming is what sends Trion information in case the server detects a possible hack.



Still not ban yet from level 1 - 46. Speed hacked, messed with my XYZ coords. And unlimited mana. Everything is fine with me. Do not use on gameguard protected version obviously.

What I don't get is why do some people have a gameguard protected version. I'm using glyph to launch it, and it even has something to pass the glyph ID to gameguard, no ban yet either.

[xviet4xlife]

What I don't get is why do some people have a gameguard protected version. I'm using glyph to launch it, and it even has something to pass the glyph ID to gameguard, no ban yet either.

I'm guessing if they play the game in any other way besides using Steam to download the game, and playing on a Steam account. I could be wrong, simply because all i know is playing Devilian online through Steam.