Just wanna go on record and say that anti egg / anti curse works and so far hasn't gotten me or anyone else using it banned, so that should ideally be a standalone thing for the time being.
From study, the logic of the anti-cheat seems pretty straight-forward.
Imagine you have a function..
[code]48 83 EC 28 - sub rsp,28
..
..
48 8B C2 - mov rax,rdx
..
x - 48 83 C4 28 - add rsp,28
C3 - ret[/code]
..and you want your anti-cheat to verify [I]integrity [/I]of [B]mov rax,rdx[/B] instruction. You can:
[LIST]
[*]have a function that would [I]read-up [/I]the bytes that make-up [B]mov rax,rdx[/B] (48, then 8B, then C2) and
[LIST]
[*]verify them individually; error out if changed
[*]compute a result with the bytes (example: 48+8B+C2) and check it; if not the expected value, error out
[/LIST]
[*]use [I]displace[/I] markers that would basically create a hook in your function and re-route function flow through your checker
[/LIST]
[code]
48 83 EC 28 - sub rsp,28
..
..
E9 xx xx xx xx - jmp checker
..
48 83 C4 28 - add rsp,28
C3 - ret
checker:
sub rsp,28
..
..
mov rax,rdx
..
{ do integrity check of this function and all others involved in processing; self-integrity }
..
add rsp,28
jmp back
[/code]
Well, with [B]Dark Souls Remastered[/B] the latter one happens. There are several functions where displace is used, thus forcing the said function to execute an integrity check. This can happen on a timed event as well. What you'd do to bypass it is to restore the original instruction in the example function's flow - put mov rax,rdx back - and/or kill the checker. By kill I mean modify it in such a way that it either returns instantly (thus not executing) or find out where the "is code modified" condition is (usually the compare between a computed hash and hash stored in an already-computed table of hash values).
Additionally, keep in mind the checker is checked by another check :) And you'll have to reproduce your method on it as well.
Luckily, there's 3 "checks" in DSR:
[LIST]
[*]first one checks displaced code, as well as preset ranges
[*]second one checks first one among preset ranges
[*]third one is not a check per-se; what it does is to [B]overwrite[/B] code with its original (which implies an image of this code was already created somewhere; most likely using [B]CreateFileMapping[/B] API)
[/LIST]
Once I have some free time, I will post more information :p
Bandai should really learn from Ubisoft's [I]Assassin's Creed: Unity/Syndicate[/I]; that's one brutal integrity check.
BR,
Sun
Last edited by SunBeam on Tue Jun 05, 2018 11:01 am, edited 2 times in total.
[B][USER=338]notPhokz,[/USER] [/B]could you also check durability script? It doesn't work for[B] d[I]ragon greatsword[/I], [I]dragon king greatax[/I]e .[/B]
Is it possible to change the effect of the armor you're wearing? I'm trying to make it look like it emits fire. I'm looking in "last armor highlighted" but I don't see anything that would change visual effects. Unless I'm missing something? I'm pretty new to this, so yeah, I suck.
CElet here to ask a dumb question. Is it possible to get the visual effect from Quelaag's sword, the fire swinging, on other weapons? Or is it a model exclusive kind of ordeal? Also is anyone else crashing since the update with Fly Mode?
Last edited by PvtVain on Thu Jan 01, 1970 12:00 am, edited 1 time in total.
