Gamerz Online

Hi again, seems like new clients appears more offen than i visit the toilet these days.
So i'll write a complete guide and share my latest TRose.exe v149 without gameguard.

I thought i'd do a better release this time around, last time was a real patchjob.
Firstly, what you need todo this time, is to remove gameguard from ever loading.
For you who know programming, you use CreateProcessA to make a new application appear from your own application. This is also possible in Delphi with ShellExecute or the normal WinAPI Run.

Which case, what we want todo this time around is to make gameguard not to load.
And then remove the check which will check if gameguard has been loaded.
Because normally, if gameguard has not been loaded, TRose.exe will close.

Removing gameguard.des from loading:

You want to find this line:

and change it to


Why, am i doing this?

Because at the address 0058F93C the coding for launching gameguard.des exists.
We do not want that to load. The value being compared, is always less than the the compare value.
Hence it will jump when the value is less or equal than the eax-value.
AHA! So that means if we change it to jump if greater or equal, the jump will never take place right?
Thats totaly correct. The value will never be greater than the value compared, and when we change jle to jge, the jump will never be made. Cool huh?
This is how the CreateProcessA code-section looks like:



Removing the gameguard.des check:

You want to find this line:

and change it to


Why, am i doing this?
Well simply put. At call sub_535605 it jumps to ExitProcess. We do not want the process to Exit.
Hence we change the code never to get to the place where the call is made.
Meaning this place:


If it turns out that the compare equals 1 it will jump and exit the process.
We just change the jnz to jz because we know, it always will be 1.
And when Jump Zero never gets a 0 compare value, the jump never will be made.

You could of course also change the cmp ds:dword_6D4CDC, 1 ; to cmp ds:dword_6D4CDC, 0 ;
I just changed the actual jump because, that's what i felt like

Removing the check for which controls if gameguard.des exists

We'll probably have to remove the check, which controls if gameguard.dex exists right?
Along with all those other weird checks which will appear when something is wrong with gameguard.

Find: jz short loc_52F507

replace with:


Here you once again just change the jump offset never to take place.
dword_67CEE8 holds the value 755h(Something you recognize perhaps?)
Yes thats the Gameguard Is Valid number. Edx in the compare function does in this case hold 262
which is the not valid number in Gameguard. Meaning, in this case edx since we do not have gameguard, edx will get loaded with 262. And when it does a compare with 755 it will notice they are not the same and flag us with diffrent warning messages. Since the value is not the same, the result will be 0, and JZ (Jump if Zero) will take place. We simply change the Jump to jump if not zero
meaning the jump will never take place since it will always be Zero.

You could use JE(Jump Equal) but the result will be the same.
You could also change cmp edx, ds:dword_67CEE8
to cmp edx, 262h instead. Because then, it would also make sure the jump is never taken.

But, how do i change?
Either you use OllyDBG, or a hex editor.
Im quite sure some of you will have no clue still what im talking about.
It will require some minior hexing knowledge.
And if you use Ollydbg you can simple use the Menu alternative: Assemble
to rewrite the new function.

And from Olly save the changes directly.


Enjoy!

Nevyn