Angelic Haven

Need an update soon

2007-04-01T22:15:00.000+08:00

Have been really busy lately with all my common tests and stuff. Finally, its all over and i can have a short breather. Omg napfa is on tuesday. Looks like i am really fated to check in early. Somehow despite being exercising i still am so unfit. Sianz this time its sure fail , hope i can pass the july one and stay out for two months more. Well my blog is in a dead mess, really unmotivated to update it haiz!

New years resolutions

2007-01-07T22:06:00.000+08:00

Haiz, its only a week since i wrote down my new years resolutions and they are coming back to haunt me already. I am feeling nien up and tired. Hope i can preserver and hold up against the nien upness.

Sianzzz

2007-01-02T00:40:00.000+08:00

Haiz, a year has come to pass and another has arrived. As usual, like every few days of the start of the year, i feel hopelessly lost! Maybe I am suffering from preschoolbeginningphobia wtf bbq%#%@, I feel restless and tired but on the other hand i cant seem to sleep. Yesterday on the first day of the year 2007 was a day that i will definitely not forget! Tommy brought his gf to show us !!! lol i am feeling lame! It was the day where i walked one of the longest distances in my life! After the fireworks and countdown, we went to chillax at Indian Kopitiam and waste time. We begin our journey from the usual every year affair billiards. After billiards we walked all the way from city hall to SGH, the journey tok 3 hours and we were wondering aimlessly in search for a cab during the whole time. Alas, wat a event to mark the year where we will be legel.

AnyWayz here is my new year resolutions
This was thought of seconds before the fireworks blew off at countdown 2007

1. Score straight As for A levels (difficult but not impossible I will strife to achieve)
2. NAFA GOLD/SLIVER ( difficult also but i have been gyming hope for the best!! =) )
3. Be more outspoken ( i think i am juz anti social this has been on my list for 17 years )
More that i hope to achieve
4. Cant think of any at the moment will update

HAHA new joke of the year Ding Jie got remembered as T by Tommy's gf

New hobby

2006-12-23T01:19:00.000+08:00

Lol i have obtain a new hobby that is to flame ppl online.

Christmas

2006-12-22T01:45:00.000+08:00

Wow 2 months since i last posted, and once again another year has passed and christmas is approaching once again. Anywayz a spade of bad luck seems to be rushing over me lately, i seem to be breaking things in the most impossible of ways, first the torch light, haiz it wasnt even my torchlight, we were juz partying the night out in Indonesia and i happen to be looking at the torch light. A few swings and bang it crashed into the ground! Broke into a few pieces, luckily Ben was there to assemble it back. Shocking is i was still holding to the strap and neither the strap nor the torch was broken, so how the hell did the torch dislocate itself from the strap?
Round 2 back in singapore, i was closing my house door, then suddenly the door creak open, turns out 2 screws has fallen off and the knob was no in line with the hole!!!!!! How the hell do u break ur own door, i think thats a first. Luckily my father was there to fix it after giving me a dressing down of course. :sad:
Anyway few pics of NEMO
[img]http://good-times.webshots.com/photo/2408814400099881451Hiarsz[/img]

Day of reckoning

2006-10-10T20:47:00.000+08:00

Alas, a year has passed, tml i think i will get back my promotional exam results. How i will fare, i simply cannot say. I already feel breathless typing such thinks out! Ha! I really dunno what to say. Speechless in front of my computer; Thats surely a first. Well i sure hope all well ends well, started this year coming from last year quite strong, hope i can end it strong too..
Seriously i dun understand how ppl find the time to blog. No i have lots of time but i juz dun want to do it.

A look at my past

2006-09-30T21:59:00.000+08:00

I have had alot in my mind recently, with the promotional exams and such. Today, one fine saturady, i look thru all my bookmarks that i have collected over the years. Visiting every single site that i use to visit since i first bought my computer. Wow, i realised that within this 1 year i have lost so much of myself. Old interest fade and are replace by new ones ......

A project

2006-08-07T00:42:00.000+08:00

Recently i lost my hp and thus with my hp all my contacts, memories are lost. I decided that i will start a project on compiling all my friends no. Life sucks ppl move on but deep down they still dun want to let go.

2-1 Holland advances

2006-06-17T03:12:00.000+08:00

Ha ha after watching a a 6-0 win by Argentina, I was thrilled to watch the next match in the opening moments of the game 3 goals were socred to by Holland and 1 by Ivory Coast. Apart from that my damn tag box is lagging like shit, try to fix it............

Beautiful Game

2006-06-16T03:51:00.000+08:00

Today, i watched the world cup match between England and T&T. I knew England was going to stampede over the much weak T&T thus i was reluctant to watch it. However, I decided to watched it anyway. It was the 70 th minute through the game with both sides at nil-nil. This was when I wondered whether T&T will manage to score and upset and draw with England. I whispered a silent prayer for the team that did not give up fighting hoping that they could mange a draw. Then a late goal by Crotch, luck finally ran out for T&T . I sigh in disappointment as I knew it was over and T&T would ultimately lose. The match ended with a 2-nil defeat by England......

Let the GAmes begin

2006-05-26T22:07:00.000+08:00

The june holidays have offically begun..... After 3hrs of gruelling gp paper, the boy has finally return home to his com. Arghhh 500 attempt on UCE failed. Dunno what the hell is kernal data retriever and how to enable it.

YAY no school tml...

2006-05-25T00:17:00.000+08:00

It has been 2 weeks since i have soooooo much free time, having no school the next day feels great. Then its the Holidays, sadly to get there i muz get pass my GP midyear paper so suay........... Signing up for jamming course... I want to be a drummer. Sian my UCE's do not seem to be working... Stealthmode is giving me trouble. Dunno what to edit. Guess it back to the drawing board...

YAY no school tml...

2006-05-25T00:08:00.000+08:00

HAHA

2006-05-18T22:37:00.000+08:00


<script type="text/javascript">script>
<script type="text/javascript"
 src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
script>


<form method="get" action="http://www.google.com/custom" target="google_window">
<table border="0" bgcolor="#000000">
<tr><td nowrap="nowrap" valign="top" align="left" height="32">
<a href="http://www.google.com/">
<img src="http://www.google.com/logos/Logo_25blk.gif" border="0" alt="Google" align="middle" width="75" height="32">img>a>
td>
<td nowrap="nowrap">
<input type="hidden" name="domains" value="vener88.googlepages.com">input>
<input type="text" name="q" size="31" maxlength="255" value="">input>

<input type="submit" name="sa" value="Search">input>
td>tr>
<tr>
<td>&nbsp;td>
<td nowrap="nowrap">
<table>
<tr>
<td>
<input type="radio" name="sitesearch" value="" checked="checked">input>
<font size="-1" color="#ffffff">Webfont>
td>
<td>
<input type="radio" name="sitesearch" value="vener88.googlepages.com">input>
<font size="-1" color="#ffffff">vener88.googlepages.comfont>
td>

tr>
table>
<input type="hidden" name="client" value="pub-5704991703407029">input>
<input type="hidden" name="forid" value="1">input>
<input type="hidden" name="ie" value="ISO-8859-1">input>
<input type="hidden" name="oe" value="ISO-8859-1">input>
<input type="hidden" name="flav" value="0000">input>
<input type="hidden" name="sig" value="bBTV0YJd3BS_JGrC">input>
<input type="hidden" name="cof" value="GALT:#008000;GL:1;DIV:#336699;VLC:663399;AH:center;BGC:FFFFFF;LBGC:336699;ALC:0000FF;LC:0000FF;T:000000;GFNT:0000FF;GIMP:0000FF;FORID:1;">input>
<input type="hidden" name="hl" value="en">input>
td>tr>table>
form>


<body bgcolor="#FFFFFF" background="http://vener88.googlepages.com/bk1.GIF" leftmargin="40">

P>

<H2 style="MARGIN: 0in 0in 6pt"><u><font color="#6600CC" face="Tahoma" size="7">
MY TUTORIALfont>u>H2>
<p style="MARGIN: 0in 0in 6pt"><font face="Tahoma" size="7" color="#FF0000">
NOTE: THE STRINGS ARE EXAMPLES ONLY DO NOT COPY!!font>p>
<p style="MARGIN: 0in 0in 6pt"><font face="Tahoma" size="7" color="#FF0000">IF I
SEE ANYONE COPYING I WILL REMOVE THE SCREENSHOTS IMMEDIATELY.font>p>
<p style="MARGIN: 0in 0in 6pt"><font face="Tahoma" size="7" color="#FF0000">
THANK YOU.font>p>
<H2 style="MARGIN: 0in 0in 6pt"><span style="font-weight: 400">
<font face="Tahoma" size="3">
_____________________________________________________________________________________________font>span>H2>
<H2 style="MARGIN: 0in 0in 6pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'; text-decoration:underline">

<FONT color=#6600cc face="Tahoma" size="6">INTRODUCTIONFONT>SPAN>H2>
<P style="MARGIN: 0in 0in 6pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">Imagine that you are fighting a war, but you do not know what your army is planning or what they have already done. So, do you think you can win the war? The answer a definite no. Same with bypassing nProtect, Cheat Engine and nProtect is fighting against each other, so to learn how to bypass it, we'll have to learn how nProtect works and Cheat
Engine works.FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">&nbsp;FONT>SPAN>P>
<H2 style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'; text-decoration:underline">
<FONT color=#6600cc face="Tahoma" size="6">Chapter 1: How nProtect WorksFONT>SPAN>H2>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">What nProtect do are:FONT>SPAN>P>

<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">1. FONT>SPAN>P>
<TABLE style="MARGIN: auto auto auto 2.3pt; BORDER-COLLAPSE: collapse; mso-table-layout-alt: fixed; mso-padding-alt: 2.75pt 2.75pt 2.75pt 2.75pt" cellSpacing=0 cellPadding=0 border=0> <THEAD> <TR style="mso-yfti-irow: 0"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 482.3pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=643> <P style="MARGIN: 0in 0in 6pt 39.75pt">
 <FONT face="Tahoma"><U>
 <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">Hijack kernel functionSPAN>U><SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">: For hacking application (e.g. cheat engine) to modify a game, it'll have to call some system function (e.g. openprocess()) to modify the game. So what nProtect do is it hijacks the system functions. Here is a monologue if you don't understand:<SPAN style="mso-spacerun: yes">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; SPAN>nProtect: Let me hijack the system first....SPAN>FONT>P>

TD>TR>THEAD> <TBODY> <TR style="mso-yfti-irow: 1"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 482.3pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=643> <P style="MARGIN: 0in 0in 6pt 39.75pt">
   <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
   <FONT face="Tahoma">kernel32.dll: Arghh...... (terminated)FONT>SPAN>P>
TD>TR> <TR style="mso-yfti-irow: 2"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 482.3pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=643> <P style="MARGIN: 0in 0in 6pt 39.75pt">
     <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
     <FONT face="Tahoma">nProtect: Put a fake one there....FONT>SPAN>P>

TD>TR> <TR style="mso-yfti-irow: 3"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 482.3pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=643> <P style="MARGIN: 0in 0in 6pt 39.75pt">
     <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
     <FONT face="Tahoma">Fake kernel32.dll: kernel32.dll at your service!FONT>SPAN>P>
TD>TR> <TR style="mso-yfti-irow: 4"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 482.3pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=643> <P style="MARGIN: 0in 0in 6pt 39.75pt">
     <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
     <FONT face="Tahoma">CheatEngine: Hello kernel32.dll, may I call openprocess(..)....FONT>SPAN>P>

TD>TR> <TR style="mso-yfti-irow: 5; mso-yfti-lastrow: yes"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 482.3pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=643> <P style="MARGIN: 0in 0in 6pt 39.75pt">
     <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
     <FONT face="Tahoma">Fake kernel32.dll: My foot, get lost!FONT>SPAN>P>
TD>TR>TBODY>TABLE>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">&nbsp;FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">2.FONT>SPAN>P>

<TABLE style="MARGIN: auto auto auto 2.75pt; BORDER-COLLAPSE: collapse; mso-table-layout-alt: fixed; mso-padding-alt: 2.75pt 2.75pt 2.75pt 2.75pt" cellSpacing=0 cellPadding=0 border=0> <THEAD> <TR style="mso-yfti-irow: 0; mso-yfti-lastrow: yes"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 481.85pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=642> <P style="MARGIN: 0in 0in 6pt 39.75pt">
 <FONT face="Tahoma"><U>
 <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">Scan for suspicious program:SPAN>U><SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'"> Thanks to Dark Byte, that he wrote a kernel that bypasses the hijackation. Again, the INCA (nProtect company) got angry, and they decided to do revenge. So what they did is search through the memory and if they found an array of bytes that is uniquely Cheat Engine, they'll make your computer reboot. So that is why we got to change detected strings.SPAN>FONT>P>
TD>TR>THEAD> <TBODY> <TR> <TD>&nbsp;TD>TR>TBODY>TABLE>
<P style="MARGIN: 0in 0in 6pt 39.75pt">

<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">&nbsp;FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT face="Tahoma">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">3.<BR style="PAGE-BREAK-BEFORE: always" clear=all>SPAN>FONT>P>
<TABLE style="MARGIN: auto auto auto 2.75pt; BORDER-COLLAPSE: collapse; mso-table-layout-alt: fixed; mso-padding-alt: 2.75pt 2.75pt 2.75pt 2.75pt" cellSpacing=0 cellPadding=0 border=0> <THEAD> <TR style="mso-yfti-irow: 0; mso-yfti-lastrow: yes"> <TD style="PADDING-RIGHT: 2.75pt; PADDING-LEFT: 2.75pt; BORDER-LEFT-COLOR: #ece9d8; BORDER-BOTTOM-COLOR: #ece9d8; PADDING-BOTTOM: 2.75pt; WIDTH: 481.85pt; BORDER-TOP-COLOR: #ece9d8; PADDING-TOP: 2.75pt; BACKGROUND-COLOR: transparent; BORDER-RIGHT-COLOR: #ece9d8" vAlign=top width=642> <P style="MARGIN: 0in 0in 6pt 39.75pt">
 <FONT face="Tahoma"><U>
 <SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">Misc:SPAN>U><SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'"> Since nProtect have already done so many evil things, it does not hurt to do more. As there are too many, I won't elaborate too much on this. A few examples are: Hiding maplestory.exe, change setting of ProcessGuard for us, disabling compatibility mode for use.....etcSPAN>FONT>P>

TD>TR>THEAD> <TBODY> <TR> <TD>&nbsp;TD>TR>TBODY>TABLE>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">I think after reading this chapter, you already have some knowledge on how nProtect works.FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">&nbsp;FONT>SPAN>P>
<H2 style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'; text-decoration:underline">
<FONT color=#6600cc size=6 face="Tahoma">Chapter 2: How Cheat Engine WorksFONT>SPAN>H2>
<p style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;p>
<P style="MARGIN: 0in 0in 6pt 39.75pt">

<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">Visualization is a very good method to learn:FONT>SPAN>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: center">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="13.JPG/13-full.jpg">
<font face="Tahoma">
<IMG style="" src="13.JPG/13-full.jpg">font>A>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma"><BR style="mso-ignore: vglayout" clear=all>
font><SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">Although visualization is good, but I will still do some explanation here. CheatEngine.exe is mainly user interface, that means that it does not do much modification to the target, its job is mainly to communicate with you and dbk32.dll, although it still do some modification like use kernel32.dll to do modification if dbk32.* died. Dbk32.dll helps dbk32.sys to communicate with CheatEngine.exe. Dbk32.sys does most modification and debugging.font>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">(copied form John's tutorial)FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>

<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">Known ways to bypass itFONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">A:Block API calls form GGFONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">B:Edit exe so it won't run GG but most exe are encryptedFONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">C:Make/modify something so it won't get detected(In this case CE)FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>

<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma"><STRONG style="font-weight: 400">Chapter 3:What does GG
detects?STRONG>FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma"><STRONG style="font-weight: 400">Strings and code, to get
them, you will need to dump GG ,after GG scans the memory, the strings are thrown into
some kind of temporary storage. You will need to get it.STRONG>FONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<STRONG style="font-weight: 400"><FONT face="Tahoma">You ask. Why dump? Can't we just dissemble GG to get the strings?FONT>STRONG>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<STRONG style="font-weight: 400"><FONT face="Tahoma">We can't unless we crack
their modified UPX encryption.FONT>STRONG>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">

<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<STRONG style="font-weight: 400"><FONT face="Tahoma">Then why does the dump works?FONT>STRONG>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<STRONG style="font-weight: 400"><FONT face="Tahoma">GG need to decrypt them in order to read them/scan with them.FONT>STRONG>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<STRONG style="font-weight: 400"><FONT face="Tahoma">How to dump?FONT>STRONG>SPAN>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: center">P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: center">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="http://www.photohosting.info/uploads/07d498f0e7.gif">
<font face="Tahoma">
<IMG style="" src="http://www.photohosting.info/uploads/07d498f0e7.gif">font>A>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: center">P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">Credits to DEOfont>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">After dumping we can open it with Ce or some kind of hex
viewer.font>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">DB Filter out the unneeded stuff (available from the Download page)font>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">Go to address 0 and scroll down until you see what looks like wordsfont>SPAN>P>

<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">Orfont>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">Search for "GBHACK"font>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">I filtered out the unwanted strings and code and its
available at the Detected strings page.font>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;P>
<H2 style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'; text-decoration:underline">
<FONT color=#6600cc size=6 face="Tahoma">Chapter 5:Modifying CEFONT>SPAN>H2>

<p style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;p>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#ff0000" face="Tahoma">NOTE: If you know nothing about
Delphi, compiling meanings ect I suggest you skip this part to chapter 6:Author notesFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">You will need to sourceFONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">You can A:Download it from the download pageFONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; B:CVSFONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">

<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT color=#ff0000 face="Tahoma">BIG NOTE:Its HEIJNEN1 not HEIJNENLFONT>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<font face="Tahoma">&nbsp;&nbsp;&nbsp;&nbsp;<FONT color="#ffcccc">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&gt; FONT>
font><SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman">
<FONT color="#ffcccc" face="Tahoma">1.FONT>SPAN>SPAN><FONT color="#ffcccc"><SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'"><FONT face="Times New Roman"><SPAN style="font-style:normal; font-variant:normal; font-family:Tahoma; mso-list:Ignore; mso-fareast-font-family:Times New Roman">&nbsp;&nbsp;&nbsp;&nbsp; SPAN>FONT>SPAN>FONT><SPAN style="FONT-SIZE: 14pt; COLOR: white; mso-fareast-font-family: 'Times New Roman'"><FONT size=4>
<FONT color="#ffcccc">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-fareast-font-family: 'Times New Roman'">Go to SPAN>FONT>SPAN>FONT>

<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'"><A href="http://www.wincvs.org/download.html">
<FONT face="Tahoma" color=#ffcccc>http://www.wincvs.org/download.htmlFONT>A>SPAN>FONT><SPAN style="FONT-SIZE: 14pt; mso-fareast-font-family: 'Times New Roman'; color:white"><FONT face="Tahoma" color=#ffcccc> and download WinCVSFONT>SPAN>SPAN>P>
<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 2.SPAN>FONT><SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman"><FONT color="#ffcccc" face="Times New Roman"><SPAN style="font-style:normal; font-variant:normal; font-family:Tahoma">&nbsp;&nbsp;&nbsp;&nbsp; SPAN>FONT>SPAN>
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-fareast-font-family: 'Times New Roman'">Install itSPAN>FONT>P>
<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp; 3.SPAN>FONT><SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman"><FONT color="#ffcccc" face="Times New Roman"><SPAN style="font-style:normal; font-variant:normal; font-family:Tahoma">&nbsp;&nbsp;&nbsp;&nbsp; SPAN>FONT>SPAN>

<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-fareast-font-family: 'Times New Roman'">Open command promptSPAN>FONT>P>
<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp; 4.SPAN>FONT><SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman"><FONT color="#ffcccc" face="Times New Roman"><SPAN style="font-style:normal; font-variant:normal; font-family:Tahoma">&nbsp;&nbsp;&nbsp;&nbsp; SPAN>FONT>SPAN>
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-fareast-font-family: 'Times New Roman'">Change to the directory you want the CESPAN>FONT>P>
<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<SPAN style="mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma" color="#ffcccc">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp;eg.Type "cd desktop"FONT>SPAN>P>

<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 5.SPAN>FONT><SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman"><FONT color="#ffcccc" face="Times New Roman"><SPAN style="font-style:normal; font-variant:normal; font-family:Tahoma">&nbsp;&nbsp;&nbsp;&nbsp; SPAN>FONT>SPAN>
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-fareast-font-family: 'Times New Roman'">Type “SPAN><I>cvs -d :pserver:cvsanon@heijnen1.demon.nl:/CECVS loginI><SPAN style="mso-fareast-font-family: 'Times New Roman'">“ and press SPAN>FONT>P>
<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-fareast-font-family: 'Times New Roman'">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;enter. Note: password is “SPAN><I>cvsanonI>”FONT>P>

<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 6.SPAN>FONT><SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman"><FONT color="#ffcccc" face="Times New Roman"><SPAN style="font-style:normal; font-variant:normal; font-family:Tahoma">&nbsp;&nbsp;&nbsp;&nbsp; SPAN>FONT>SPAN>
<FONT color="#ffcccc" face="Tahoma">Type '<I>cvs -d :pserver:cvsanon@heijnen1.demon.nl:/CECVS checkout "Cheat Engine I>FONT>P>
<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma"><I>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Delphi” I>', press enter and wait for it to finish.FONT>P>
<P style="MARGIN: 0in 0in 6pt 75pt; TEXT-INDENT: -0.25in; mso-list: l0 level1 lfo1; tab-stops: list .5in left 75.0pt">
<FONT color="#ffcccc" face="Tahoma">
<SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;7.SPAN>FONT><SPAN style="mso-list: Ignore; mso-fareast-font-family:Times New Roman"><FONT color="#ffcccc" face="Times New Roman"><SPAN style="font-style:normal; font-variant:normal; font-family:Tahoma">&nbsp;&nbsp;&nbsp;&nbsp; SPAN>FONT>SPAN>

<FONT color="#ffcccc" face="Tahoma">Done,the source will be in the desktopFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;P>
<H3 style="MARGIN: 0in 0in 6pt 39.75pt"><u><font color="#FF00FF" face="Tahoma">SUB TOPIC 4.1-Introductionfont>u>H3>
<p style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;p>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">CE can be
separated into&nbsp;4 parts-FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#3333ff face="Tahoma">DriverFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#3333ff face="Tahoma">The interfaceFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#3333ff face="Tahoma">DLLsFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#3333ff face="Tahoma">Assisting programsFONT>P>

<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">The interface can also be called UI or GUI(I will use UI). The driver consist of only DBK32.sys.Its written in
C. It also contains a simple rootkit, some antivirus programs may detect it.FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;P>
<H3 style="MARGIN: 0in 0in 6pt 39.75pt"><u><font color="#FF00FF" face="Tahoma">SUB TOPIC 4.2 - Teh Driverfont>u>H3>
<p style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;p>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">As we all know, the driver is detected but there's a catch. Detected strings&nbsp;are not the the dump as the dumper only dumps usermode instead of kernel mode. (see chapter 6 for more details)FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">If you want to, find a kernel dumper and dump it.FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">OrFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">use the comment and uncomment method (also shown in the faq):FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#ff0000 face="Tahoma"><FONT color=#ffcccc>OK,
here's an example. Nprotect detects the string fox <BR><BR>and here is the code <BR><BR>"The quick brown fox climbed over the fence" <BR><BR>but we do not know
nprotect detects what but we do know is in that line In CE the "code" will be a few hundred lines long. <BR><BR>The way to comment <BR>comment out everything NOT everything in the real code or you will get errors <BR><BR>{The quick brown fox climbed over the fence} <BR><BR>result - undetected but useless because there is no
instructions if you pressed a button <BR><BR>slowly <BR><BR>the quick brown {fox climbed over the fence} <BR><BR>form this you decrease the search area(fox climbed over the fence) <BR><BR>result - same as above <BR><BR>The quick brown fox climbed {over the fence} <BR><BR>result - detected but we cross out "over the fence" <BR><BR>The quick brown {fox} climbed over the fence <BR><BR>result - undetected BINGO. <BR>Change fox to wolf = undetected <BR><BR>instead of 8 words
CE has thousands. So allot of work must be done.FONT> FONT>P>

<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#ffffff face="Tahoma">But DB save us all that trouble he search and got 3 strings that is detected(641,more in 710,714)Which is <FONT color=#ffff66>CEdriver52FONT>,<FONT color=#ffff66>DBKproclist51FONT> and <FONT color=#ffff66>DBKThreadList51FONT><FONT color=#ffffff>.After DB saw everybody is modifying the source, he made it a little easier but putting them in one file FONT><FONT color=#3366ff>Driver.datFONT><FONT color=#ffffff>. Its formally in FONT><FONT color=#3366ff>DbkDrvr.CFONT><FONT color=#ffffff>.FONT>FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#ffffff face="Tahoma">DB also implanted a new function - hideme, But to prevent BSOD(Blue Screen Of Death)/explorer crashes he disabled it but was later found by kittonkicker. You will need to uncomment it.FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color=#ff0000 face="Tahoma">

WARNING: Blue screens and crashes(crash not reboot)&nbsp;may cause permanent damage to the RAM or HDD,use it carefully disable all unnessarary process before trying/testing.
If you faced this kind of&nbsp;problems please&nbsp;disable it and bypass another way(may take a few days/hours).
I know someone&nbsp;did.FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">Changing the stringsFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">
<FONT color="#FFFFFF">Rename&nbsp;FONT>&nbsp;<FONT color=#ffff66>CEdriver52FONT>,<FONT color=#ffff66>DBKproclist51FONT>
<font color="#FFFFFF">andfont> <FONT color=#ffff66>DBKThreadList51 FONT><FONT color=#ffffff>in FONT><FONT color=#3366ff>Driver.datFONT><FONT color=#ffffff>.FONT>font>P>

<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT face="Tahoma">
<font color="#FFFFFF">Uncomment hideme function (//:hideme(object);) infont> <FONT color=#3366ff>DbkDrvr.CFONT><FONT color=#ffffff>.FONT>FONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma" color="#FFFFFF">For
the dumb idiots uncomment is to delete &quot;//&quot; so it would be &quot;hideme(object)&quot;font>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT face="Tahoma">
<font color="#FFFFFF">Renamefont> <FONT color=#ffff99>dbk32.dllFONT>

<font color="#FFFFFF">infont> <FONT color=#3366ff>SourcesFONT>
<font color="#FFFFFF">andfont> <FONT color=#3366ff>sources.ceFONT>
<font color="#FFFFFF">(as the pictures shown below)font>FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: center">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="untitled11.JPG/untitled11-full.jpg">
<font face="Tahoma">
<IMG style="" src="untitled11.JPG/untitled11-full.jpg">font>A>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt">&nbsp;P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: center">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="untitled12.JPG/untitled12-full.jpg">

<font face="Tahoma">
<IMG style="" src="untitled12.JPG/untitled12-full.jpg">font>A>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><FONT color="#FFFFFF" face="Tahoma">Compile it as shown belowFONT>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: center">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="untitled8.JPG/untitled8-full.jpg">
<font face="Tahoma">
<IMG style="" src="untitled8.JPG/untitled8-full.jpg">font>A>P>
<P style="MARGIN: 0in 0in 6pt 39.75pt"><font face="Tahoma">&nbsp;font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="untitled9.JPG/untitled9-full.jpg">
<font face="Tahoma">
<IMG style="" src="untitled9.JPG/untitled9-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="untitled10.JPG/untitled10-full.jpg">

<font face="Tahoma">
<IMG style="" src="untitled10.JPG/untitled10-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffffff face="Tahoma"><FONT color=#3366ff>DBK32.sysFONT> will appear in the source folder.FONT>P>
<H3 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma">SUBTOPIC 4.3 - DLLsfont>u>H3>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">Before going to the Ce itself we need DLLs.FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffcccc face="Tahoma">DLL is an acronym - Dynamic Linked LibraryFONT>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">Its a library full of sets of instructions, Its use to save both space and memory.FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">There are 6 DLLs but only 3 are only needed, the rest are optional but I
recommend you to compile it.FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">List the the 6 DLLs-FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma"><FONT color=#3366ff>CEhook.dllFONT>
<font color="#FFFFFF">&lt;----very importantfont>FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma"><FONT color=#3366ff>DBK32.dllFONT>
<font color="#FFFFFF">&lt;----most importantfont>FONT>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma"><FONT color=#3366ff>
Stealth.dlFONT><FONT color=#FFFFFF>lFONT><font color="#FFFFFF">&lt;----not very important (if you can really make
CE undetected)font>FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#3366ff">D3DX81ab.dllfont><font color="#FFFFFF">&lt;-----optionalfont>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#3366ff">d3dx9.dllfont><font color="#FFFFFF">&lt;-----optionalfont>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma"><FONT color=#3366ff>emptydll.dllFONT><font color="#FFFFFF">&lt;-----optionalfont>font>P>
<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>

<font color="#FF00FF" face="Tahoma">SUB TOPIC 4.3.1font>u>H4>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Lets start withfont> <FONT color=#3366ff>DBK32.dllFONT><font color="#ffffff">.font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Openfont> <font color="#3366ff">dbk32.dprfont>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">BEWARE:Use Delphi to open it, DO NOT double click it or you will suffer as they will appear in windows instead of sections.FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">

<font color="#FFFFFF" face="Tahoma">See the exports?font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Change them font> P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Eg:font><FONT color=#ffff99>OpFONT>--&gt;<font color="#ffff99">abc1font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">The end result will be like the picturefont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Then renamefont> <FONT color=#3366ff>Dbk32.dllFONT>

<font color="#FFFFFF">into something else.font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">So isfont> <font color="#3366ff">dbk32functions.pasfont>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="14.JPG/14-full.jpg">
<font face="Tahoma">
<IMG style="" src="14.JPG/14-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Note:font><FONT color=#3366ff>Dbk32functionsFONT>
<font color="#FFFFFF">andfont> <FONT color=#3366ff>Dbk32.dllFONT>

<font color="#FFFFFF">does not need to be the same.font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">After that, open font><font color="#3366ff">Dbk32functionsfont>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Change the the exports (font><FONT color=#ffff99>op,rpm,wpmFONT><font color="#FFFFFF"> ect)font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">More pictures to helpfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font face="Tahoma">

<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="24.JPG/24-full.jpg">
<IMG style="" src="24.JPG/24-full.jpg">A><IMG style="" src="23.JPG/23-full.jpg">font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">to the same you renamed like the above picturefont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#ffff99">Opfont>--&gt;<font color="#ffff99">Abc1font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Change them all,or you will get errors.font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">There will be 1-3 for each exportfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">

<FONT color=#ff0000 face="Tahoma">BEWARE: I recommend to to manually search(search function)&nbsp;and replace instead of using the replace function.FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">BEWARE:It may take an hour or two without the proper tools. ^_^FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Still not afraid?font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Compile itfont>(<FONT color=#666666>CTRL+F9FONT>)font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">And your done.font>P>

<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma">SUB TOPIC 4.3.2font>u>H4>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Next&nbsp; we will go tofont> <FONT color=#3366ff>CEHOOK.dllFONT>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Same drill asfont> <font color="#3366ff">DBK32.dllfont>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">

<FONT color=#3366ff face="Tahoma">NOTE:For Borland users, you need to delete/comment out "system;" in usesFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Then use font> <FONT color=#666666>search in filesFONT>&nbsp;<font color="#FFFFFF">and search forfont><FONT color=#ffff66> FONT><FONT color=#ffff99>myhookFONT>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Rename them to something else.font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Compile it.font>P>
<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left">

<span style="font-weight: 400"><font color="#FFFFFF" face="Tahoma">SUB TOPIC 4.3.3font>span>H4>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Next we will go tofont> <FONT color=#3366ff>stealth.dllFONT>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Same drill as font><font color="#3366ff">dbk32.dllfont>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Just compile it nothing needs to be changed.font>P>
<H3 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma">SUBTOPIC 4.4 THE USER INTERFACEfont>u>H3>

<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma">SUBTOPIC 4.4.1font>u>H4>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">So what to modify?font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Strings which is located in the string page but...font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma">
<font color="#FFFFFF">File names\uses font> <BR><FONT color=#ffff99>* newkernelhandler <BR>* cefuncprocFONT> <BR><BR>

<font color="#FFFFFF">Gui font> <BR><FONT color=#ffff99>* 00400000 <BR>* 7fffffff <BR>* syndiv.com/ce <BR>* 80000000 <BR>*cheatengine <BR>*cheat engine <BR>*nextscanbutton <BR>*scanvalue <BR>*myhookFONT> FONT>P>
<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma">SUBTOPIC 4.4.2font>u>H4>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">We will start with file names\usesFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">Change it in Delphi(right click on the
file)! Unless&nbsp;I told you so.FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="18.JPG/18-full.jpg">
<font face="Tahoma">
<IMG style="" src="18.JPG/18-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">&nbsp;font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma">
<font color="#FFFFFF">Then search in files forfont> <FONT color=#ffffcc>NewkernelhandlerFONT>

<font color="#FFFFFF">and change them all even without quotes!font>FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">Note: Most should be under "uses"FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma">
<font color="#FFFFFF">Repeat forfont> <FONT color=#ffff99>cefuncproc.pasFONT>FONT>P>
<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<FONT color="#FF00FF" face="Tahoma">SUBTOPIC 4.4.3FONT>u>H4>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Next its value strings(hex)font>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffff99 face="Tahoma">* 00400000 <BR>* 7fffffff&nbsp; <BR>* 80000000FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma">
<font color="#FFFFFF">Change them all using font> <FONT color=#999999>Find in FilesFONT>FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffffff face="Tahoma">Use <FONT color=#999999>replaceFONT> if needed.FONT>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">Note: You must change it to a driffent value!
Not into letters/names!FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">Eg:-2/+2 from the valueFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><FONT face="Tahoma"><FONT color=#ffff99>00400000FONT> &gt; <FONT color=#ffff99>00400002FONT>FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">Note: they are 8 digit hex(all are)FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffcccc face="Tahoma">Hexadecimal = 0 1 2 3 4 5 6 7 8 9 A B C D E FFONT>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffcccc face="Tahoma">Decimal = 0 1&nbsp;2 3 4 5 6 7 8 9FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="19.JPG/19-full.jpg">
<font face="Tahoma">
<IMG style="" src="19.JPG/19-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">There are more than that, change it,FONT>SPAN>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">Repeat for <FONT color=#ffff99>7ffffff,80000000FONT>FONT>SPAN>P>

<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left">
<SPAN style="COLOR: #FF00FF; mso-fareast-font-family: 'Times New Roman'; text-decoration:underline">
<FONT face="Tahoma">SUBTOPIC 4.4.4FONT>SPAN>H4>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Next is form strings/main stringsfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffff99 face="Tahoma">*cheatengineFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffff99 face="Tahoma">*cheat engineFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffff99 face="Tahoma">*nextscanbuttonFONT>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffff99 face="Tahoma">*scanvalueFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">scanvalue will have a few hundred, change scanvalue2 too.font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">Change them in the object settings, If you are
dumb, look BelowFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="15.JPG/15-full.jpg">
<font face="Tahoma">
<IMG style="" src="15.JPG/15-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">and in events if neededfont>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="21.JPG/21-full.jpg">
<font face="Tahoma">
<IMG style="" src="21.JPG/21-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">And the project settingsfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">Note: you can also change it so it won't show the version number.FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="17.JPG/17-full.jpg">
<font face="Tahoma">
<IMG style="" src="17.JPG/17-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Then change them in all the files(*.pas) you see
it. Change them all not just strings.font>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Seriouslyfont>P>
<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma">SUBTOPIC 4.4.5font>u>H4>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">ALL imports font> P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffff99 face="Tahoma">*Exports of dbk32.dllFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#ffff99">*dbk32.dllfont><font color="#ffffff">(this a string not loaddbk)font>font>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#ffff99">*myhookfont><font color="#FFFFFF">(searchfont><font color="#FFFFFF"> for it)font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="20.JPG/20-full.jpg">
<font face="Tahoma">
<IMG style="" src="20.JPG/20-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;P>
<H4 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma">SUBTOPIC 4.4.6font>u>H4>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Change the&nbsp;unimportant detected stringsfont>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">*syndiv.com/ceFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color="#FFFFFF" face="Tahoma">Change it to anything you likeFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">And Compile it. It should be A ok.If you done it right.font>P>
<H3 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma" size="3">SUBTOPIC 4.5 Assisting Programsfont>u>H3>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">*systemcallsignal.exeFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">

<FONT color=#3366ff face="Tahoma">*trainerwithassembler.exeFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">Note:Systemcallretriver.exe uses "newkernelhandler" so rename your renamed kernelhandler back to newkernelhandler.pas before you continue.But you will need to change it to the renamed kernelhandler in Delphi.(subtopic 4.4.4)FONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#3366ff">*Systemcallretriever.exefont><font color="#FFFFFF">(changefont><font color="#FFFFFF"> anything if needed)font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#3366ff">*Kernelmoduleunloader.exefont><font color="#ffffff">(changefont><font color="#ffffff"> anything if needed)font>font>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">compile themfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">By now you should have a little idea how
Delphi workfont>P>
<H3 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma" size="3">SUBTOPIC 4.6 Checkingfont>u>H3>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Use my dll checkerfont>(<FONT color=#3333ff>cetools.exeFONT>)
<font color="#FFFFFF">to check dll and driver for detection.font>font>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">If none are detected,thenfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Use CE 5.2(compiled by DB) to target your ce.Open memory view&nbsp;and search for the detected strings(none should be there)font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">If its there, there are 2 ways to solve itfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Go back to Delphi to modify font> P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">ORfont>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Use a hexeditor(I recommendfont> <FONT color=#3366ff>HEXWORKSHOPFONT>
<font color="#FFFFFF">from the download page)font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">BTW:Use your brains on thisfont>P>
<H3 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<font color="#FF00FF" face="Tahoma" size="3">SUBTOPIC 4.6 Buildingfont>u>H3>
<p class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;p>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma">
<font color="#FFFFFF">Downloadfont> <FONT color=#3366ff>cetools.exeFONT>

<font color="#FFFFFF">which is available from the download page to build it.font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">ORfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">You can manually build themfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">It should havefont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">cheatengine.exeFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">dbk32.dllFONT>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">dbk32.sysFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">cehook.dllFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">stealth.dllFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">driver.datFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">systemcallsignal.exeFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#3366ff face="Tahoma">trainerwithassembler.exeFONT>P>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left"><font face="Tahoma"><FONT color=#3366ff>Systemcallretriever.exeFONT><font color="#FFFFFF">(changefont><font color="#FFFFFF"> anything if needed)font>font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Then test your cefont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">Note it may prompt you to run Systemcallretriever.exe,RUN ITFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ff0000 face="Tahoma">Or get kerneldata.dat from CE 5.2 folder.FONT>P>
<H2 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<FONT color=#6600cc size=6 face="Tahoma">CHAPTER 5 : THANKS TOFONT>u>H2>

<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffffff face="Tahoma">DB-For creating CEFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#ffffff face="Tahoma">JOHN-for getting me to modify ce in the first place and provided the introductionFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">DEO-for providing the dump tutorialfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">lXcid-as a friend and motivatorfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">last but not least font> P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">

<font color="#FFFFFF" face="Tahoma">INCA-for creating GG so noobs can't hack games.font>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">Muahahahahafont>P>
<H2 class=separator style="CLEAR: both; TEXT-ALIGN: left"><u>
<FONT color=#6600cc size=6 face="Tahoma">CHAPTER 6 : Author's NotesFONT>u>H2>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<FONT color=#99ff99 face="Tahoma">Green stuff in the pics are just commentsFONT>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">&nbsp;P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<font color="#FFFFFF" face="Tahoma">No more version numberfont>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<A style="border-width:0px; MARGIN-LEFT: 1em; MARGIN-RIGHT: 1em; BACKGROUND-COLOR: transparent; cssFloat: " href="22.JPG/22-full.jpg">

<font face="Tahoma">
<IMG style="" src="22.JPG/22-full.jpg">font>A>P>
<P class=separator style="CLEAR: both; TEXT-ALIGN: left">
<SPAN style="COLOR: white; mso-fareast-font-family: 'Times New Roman'">
<FONT face="Tahoma">To be continued!!! SERIOUSLYFONT>SPAN>P>

Major revamp

2006-05-13T11:07:00.000+08:00

Ha today i feel a sense of accomplishment having revamp my blog. I have started the morning doing juz this. later.....

Sooooooooooooo long liao

2006-05-06T15:59:00.000+08:00

Ayia, juz notice how long i never come visit my blog liao. Sian to much schoolwork. Pi is an additional stress... Bz wif making my UCE too...HAHA juz for fun thou, not much interest in the game anymore so ..., no use having it. Juz want to learn something new.. BZ looking for a new template too... HAHA use this template for too long liao
JP
Sigining out

8days....

2006-03-31T01:59:00.000+08:00

Well, it has been 8 days after my last post. Today, we went to eat ice cream for our class outing. HAHa, I love ice cream had a great time there. We ordered 2 earth quakes per table and feasted on them before going for the fries. Well the mixture of hot and cold juz gives you the feeling of heavan and earth. W00t. Late this nite, why am i still AWAKE? Cos i have to fucking do my PI. I am so tireddddddddddddddddddddddddddddddddd.... See i fell aslp while typing this post. Anyway, damn tired so signing off.......................

Wasstup

2006-03-23T22:47:00.000+08:00

Nurse Nancy

Two doctors are in the hallway complaining about nurse Nancy.

''She's out of control!'' the first doctor says. ''She does everything backwards. Just last week I told her to give a man two milligrams of morphine every ten hours, she gave him 10 milligrams every two hours, he alomost died!''

''That's nothing,'' said the second doctor, “earlier this week I told her to give a man an enema every 24 hours, she tried to give him 24 enemas in one hour!''

All of a sudden they heard a blood curldling scream from down the hallway.

''OH MY GOD! I just realized that I told nurse Nancy to prick Mr. Smiths boil!'''

HAH got this from comedy central

I deserve a first class seat

A blonde gets on an airplane and sits down in the first class section of the plane. The stewardess rushes over to her and tells her she must move to coach because she doesn't have a first class ticket. The blonde replies, "I'm blonde, I'm smart, I have a good job, and I'm staying in first class until we reach Jamaica."

The disgusted stewardess gets the head stewardess who asks the blonde to leave. The blonde yet again repeats "I'm blonde, I'm smart, I have a good job and I'm staying in first class until we reach Jamaica." The head stewardesses doesn't even know what to do at this point because they still have to get the rest of the passengers seated to take off; the blode is causing a problem with boarding now, so the stewardess gets the copilot.

The copilot goes up to the blonde and whispers in her ear. She immediately gets up and goes to her seat in the coach section. The head stewardess asks the copilot in amazement what he said to get her to move to her correct seat. The copilot replies, "I told her the front half of the airplane wasn't going to Jamaica."

Two jokes to lighten up the day. Stormy since i am Sick!

HEHE

2006-03-12T02:46:00.000+08:00

Wow so much time has past since I came back here. Very bz week for me. Another 4 days of orientation. This time the orientation like quite boring most of the time xing bu zai yan. Maybe bcos i have gone thru the first orientation so been there done tat. The peeps of this time orientation also not so friendly unlike the first orientation Going to the police station was quite fun though, play all the silly games. This time i got into class 1T30, haha, half of the ex 1T18 members are there so yay most of the ex classmates are there but sian Von, Paddy, Phong, Everlyn, Lin and Louisa all in other classes. Appealing to go to a maths, physics, chem and econs class. Hope i can get in or else i am stuck with the wierd combi of BCMH. Weird rite. HAHA, but wadever the case my new resolution is to play less of the fucking maple and dota and wok on my studies. Anyway its 3 am liao but i am still playing dota, dunno how i am going to wake up o crash esmond's church tml, HAHA he will be in for a big surprise.

w00t

2006-03-04T16:15:00.000+08:00

HAHA, so long since I last visited. Juz got my posting yesterday, guess is back to Cj for me.

WAAH

2006-02-22T23:06:00.000+08:00

Another damn day. Maths i think i fail liao.... I dunno what i was doing the whole time. My mind was in a daze and only after the bell rang i snapped out off it. Basket. So confirm fail liao. When to collect my specs todae. W00T $140 fly away. Luck not very good todae.

WEE LOOK AT ME

2006-02-19T14:23:00.000+08:00

Hehe, juz for Fun

OMG CBOx IS DOWn

2006-02-15T21:54:00.000+08:00

Today another sian day. During PE, my specs broke due to some exciting basketball action. Actually, some1 was juz swinging his arms madly and it fell to the ground. I had a boring time in maths and gp todae, not being able to see anything that is further than 2 metres.Thankfully todae is a short day . Took a cab to the specs shop, waahhh the lens cost $140 to repair. Oh my homie. T

Boring Day

2006-02-13T20:28:00.000+08:00

Use internet explorer to view my blog pls. Thx.
Today is a boring day. Wif lectures occupying half the day, I cant help but not want to doze off. I skipped the last period of chinese class and when home striaght to sleep. Dunno why nowasdays i feel so tired. Today i filled in my Jae. Really hope I can get into ACJC always wanted to get it.

More prove that gameguard hurst ur com
red means BAD
After recovering my com
YAY its recovered!!!

GameGuard

2006-02-12T10:10:00.000+08:00

TamaDe, knew there was something wrong wif gameguard. I was surfing around when I saw this http://seclists.org/lists/bugtraq/2005/Jan/0209.html
Bugtraq: Unrestricted I/O access vulnerability in INCA Gameguard

Vulnerability:
nProtect Gameguard is an application bundled with multiplayer games which
hides the game application process, monitors the entire memory range,
terminates applications defined by the game vendor and INCA to be cheats,
blocks certain calls to DirectX functions, and auto-updates itself.

To achieve some of these ends the program uses a kernel driver by the name
of nppt9x.vxd (Windows9x) and npptnt2.sys (Windows NT).

Due to the nature of Windows 9x design, the vulnerability we are about to
discuss has no bearing. A malicious individual could achieve the same ends
on Windows 9x without the need of the npptnt2.vxd driver.

This kernel mode driver allows any process to access it, and it modifies the
I/O permission mask for the calling process to allow unrestricted I/O in
user mode. The design of modern operating systems does not generally allow
for any I/O access from user mode code for system stability and security.

The driver uses undocumented kernel function Ke386SetIoAccessMap and
Ke386IoSetAccessProcess to achieve this; the driver is very similar to the
PortTalk sample available at
http://www.beyondlogic.org/porttalk/porttalk.htm.

Allowing a process unrestricted I/O access has the following risks:

1. If the process behaves unexpectedly (for example, a stack corruption
returning to arbitrary code), I/O instructions could be issued, leading to
potential problems with the system, bad data, etc.
2. A malicious process could elevate its privilege level on the system by
using direct hardware access to read / write the hard disk, program the DMA
controller, etc., or it could damage the system by resetting CMOS,
formatting the hard drive, etc.

The driver is installed as a system service. Even when Gameguard and the
multiplayer game(s) are closed, the driver continues running. The driver is
accessible under a non-admin account and is activated every boot. It does
not uninstall when the application is removed and in fact will not even
uninstall if selected in Device Manager and told to uninstall. The driver
must be deleted manually, and the registry must be edited to remove the
remaining reference.

It is true that even with this vulnerabilty the user must still be tricked
into running a malicious application that exploits it. However, in South
Korea, where the Gameguard service is widely used, net cafes have become
part of the social fabric. These machines are ripe fruit for damage.

At the more challenging level, one could use this hardware access to turn
the PC into a zombie. One could datamine information (bypassing NTFS
permissions), commit DDoS attacks, or escalate privileges on the system, by
putting the IDE controller into PIO mode, searching the disk for the system
DLLs, and replacing them with code altered to grant admin privilege. The
possibilities at this level of hardware access are nearly endless.

The nProtect Gameguard program is very rare here in North America, despite
the impressive partner list of INCA. It would be premature, however, to
presume that the installed base for this exploit is tiny. Just two of the
games on the INCA partner list - Lineage I and Lineage II - have a total of
four million active subscribers worldwide. This is not including the users
who have cancelled their accounts with a game service that uses Gameguard,
or future buyers who will purchase a game service that uses Gameguard.

Reproduction and Proof of Concept:

See attached NPPTNT2Access.cpp for proof of concept attack.

See http://www.lineage2.com/pds/pds_ts_client.html to download the Lineage
II PTS client, which is bundled with Gameguard. Please make sure to run the
lineageii.exe in order to patch up to the newest version. The driver is not
initially installed until the first login to the game world. In order to
install the driver without having an active subscription, please add the
following registry keys, which are standard for a non-PnP or NT4-style
driver, and reboot.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPPTNT2]
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,57,00,49,00,4e,
00,

44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,

00,5c,00,6e,00,70,00,70,00,74,00,4e,00,54,00,32,00,2e,00,73,00,79,00,73,00, 00,00
"DisplayName"="NPPTNT2"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPPTNT2\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,0
2,

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,

00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,

05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,

20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,

00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01, 00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NPPTNT2\Enum]
"0"="Root\\LEGACY_NPPTNT2\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Solutions/Fixes:

nProtectRemover.cpp source has been provided to allow the creation of a
self-removal tool.

It is important to note the following:

Under an admin account, Gameguard will automatically replace any deleted
piece of itself upon the launching of the game application. Under a
non-admin account, the game application will not even function without the
driver in place. The user is forced, by fears of being compromised or by
the simple fact that the game will not run, not to play at all. The
alternative is for the user to exercise extreme caution in the applications
he or she chooses to run. Virus scanners will not detect or warn a user in
advance. In light of these issues, the burden upon the user is very high.

I knew there was something wrong wif gameguard when it started lagging my com, so Maple pls remove your lousy gameguard. It does not deter hackers as they probably got a bypass to bypass this stupid program....

Hi

2006-02-11T22:20:00.000+08:00

Ya this is my new blog. Damn sian O lvl got 11 points only. Ya today whole day maple maple maple. My character is in cass. Stupid Erfalas. Finally finish my new blog, with a better layout then the last. Spend a few hours looking throught the javascript.Look back soon for a chatbox and a hits counter... You see that chio bu mage over there, she is the one that got me hook on maple. After seeing the cute prepaid card wif her pic, i totally bowed over to maplestory. Anyway, this blog is still under construction thus pls bear wif it. Feel free to comment on it. By the way i want to thank this great guy Profire for his excellent template. Oh yah this is POD for u, i love listening to this song when playing maple. Makes you feel very on fire right, acts an adreneline booster. Anyway, yah is back to school on monday. Class 1T18 rocks!!!!!!

HIHI

2006-02-11T22:05:00.000+08:00

Welcome to my new blog.