STEALTH EDIT plugin not working with CE 6.8.1 - bug: AddCloakedSection Failed ??? What does it mean?

[marek1957]

I will tell you why. This game Asphalt 9 for PC WINDOWS has anti-cheat implemented in the game. If you change ANY OF THE BYTES you are immediately send to CHEATER BOARD and then YOU CANNOT PLAY MULTIPLAYER MODE with LEGAL PLAYERS and YOU CANNOT EARN CLUB REPUTATION POINTS - to avoid that, I wanted to use STEALTH EDIT plugin to BYPASS THIS ANTICHEAT IN GAME but when you activate STEALTH EDIT PLUGIN in this game, the game is automatically closing. Do you understand now?

[l0wb1t]

Okay and what does your cheat above do?



I may have a solution, if open debugger doesnt flag you also as cheater.



You can test this for Inf Nitro:

Enable the code below, after it's activated, go to This Adress:

[B]_Nitro[/B]

Now right click on:

[B]and dword ptr [edx],00[/B]

and choose "Change register at this location" paste this in the EIP box:

[B]newmem_Nitro[/B]



See if you still get flagged as Cheater







[CODE=nasm][ENABLE]

aobscanmodule(_Nitro,Asphalt9_w10_x86_rtl.exe,83 22 00 83 62 04 00 8B 0D) // should be unique

alloc(newmem_Nitro,$1000)

registersymbol(newmem_Nitro)

registersymbol(_Nitro)

label(code_Nitro)





newmem_Nitro:

mov eax,(float)100

code_Nitro:

and dword ptr [edx],00

and dword ptr [edx+04],00

jmp _Nitro+7





[DISABLE]



unregistersymbol(_Nitro)

unregistersymbol(newmem_Nitro)

dealloc(newmem_Nitro)[/CODE]

[marek1957]

my cheats do unlimited nitro and ghost mode. This is not solution for making stealth edit plugin workable brother.

[l0wb1t]

I know, but this doesn't change any original bytes in the game ;)

It works like a stealth plugin, aslong the game doesn't detect the attached debugger and flags you



Cheat is active, and no memory has changed.

[IMG]https://puu.sh/BdCtQ/5aac727a1a.png[/IMG]

[marek1957]

hey l0wbit. I checked your methode. Still game know that it is something changed in memory or registers OR game know that something is FREEZED (unlimited nitro) - so we need stealth edit plugin updated OR we must do the NITRO RATIO that nitro will be depleting but not so fast like normally.

[l0wb1t]

Is that normal? i just finished some races, no idea what i did. i tried making infinite nitro, and changed some codes. i never finished all this stuff, this happened after modifying codes lol



[MEDIA=youtube]x_UbCUKICBg[/MEDIA]

[koderkrazy]

[QUOTE="l0wb1t, post: 55295, member: 6208"]Is that normal? i just finished some races, no idea what i did. i tried making infinite nitro, and changed some codes. i never finished all this stuff, this happened after modifying codes lol[/QUOTE]

I think yes. This happened to me after I finished my first race with throughout orange nitro boost.

If you look at those stats they are smaller ones.. This won't happen again :P

[l0wb1t]

i was just wondering because i never did all that stuff by myself, like 3000 barrel rolls xD

[marek1957]

Yes, this is normal - I got the same effect when I first time hack nitro in this game - you just found an adress which is affecting a lot of other things like air time, stunts, perfect run and etc. etc. - this address which is affecting a lot of things it it very easy to detect like a hack, so I found other address for nitro which is only affecting nitro but now I don't know how to write Nitro Ratio for this address.

1534229607

[l0wb1t]

I've made a compare for nitro based on koderkrazys finding. i think without compare all other npc's have unlimited nitro aswell



Seems to work for me

[CODE=nasm]

[ENABLE]



aobscanmodule(_Nitro,Asphalt9_w10_x86_rtl.exe,83 22 00 83 62 04 00 8B 0D) // should be unique

alloc(newmem,$1000)



label(code)

label(return)



newmem:

cmp [edx+4b],0000BAAD

jne code

mov eax,(float)100

code:

and dword ptr [edx],00

and dword ptr [edx+04],00

jmp return



_Nitro:

jmp newmem

nop

nop

return:

registersymbol(_Nitro)



[DISABLE]



_Nitro:

db 83 22 00 83 62 04 00



unregistersymbol(_Nitro)

dealloc(newmem)



{

// ORIGINAL CODE - INJECTION POINT: "Asphalt9_w10_x86_rtl.exe"+2E437



"Asphalt9_w10_x86_rtl.exe"+2E425: 59 - pop ecx

"Asphalt9_w10_x86_rtl.exe"+2E426: 59 - pop ecx

"Asphalt9_w10_x86_rtl.exe"+2E427: 8B C6 - mov eax,esi

"Asphalt9_w10_x86_rtl.exe"+2E429: 5E - pop esi

"Asphalt9_w10_x86_rtl.exe"+2E42A: 5D - pop ebp

"Asphalt9_w10_x86_rtl.exe"+2E42B: C2 04 00 - ret 0004

"Asphalt9_w10_x86_rtl.exe"+2E42E: 55 - push ebp

"Asphalt9_w10_x86_rtl.exe"+2E42F: 8B EC - mov ebp,esp

"Asphalt9_w10_x86_rtl.exe"+2E431: 8B 55 0C - mov edx,[ebp+0C]

"Asphalt9_w10_x86_rtl.exe"+2E434: 8B 45 08 - mov eax,[ebp+08]

// ---------- INJECTING HERE ----------

"Asphalt9_w10_x86_rtl.exe"+2E437: 83 22 00 - and dword ptr [edx],00

"Asphalt9_w10_x86_rtl.exe"+2E43A: 83 62 04 00 - and dword ptr [edx+04],00

// ---------- DONE INJECTING ----------

"Asphalt9_w10_x86_rtl.exe"+2E43E: 8B 0D 88 CA 62 02 - mov ecx,[Asphalt9_w10_x86_rtl.exe+1ABCA88]

"Asphalt9_w10_x86_rtl.exe"+2E444: D3 C0 - rol eax,cl

"Asphalt9_w10_x86_rtl.exe"+2E446: 33 05 8C CA 62 02 - xor eax,[Asphalt9_w10_x86_rtl.exe+1ABCA8C]

"Asphalt9_w10_x86_rtl.exe"+2E44C: 89 02 - mov [edx],eax

"Asphalt9_w10_x86_rtl.exe"+2E44E: 5D - pop ebp

"Asphalt9_w10_x86_rtl.exe"+2E44F: C2 08 00 - ret 0008

"Asphalt9_w10_x86_rtl.exe"+2E452: 55 - push ebp

"Asphalt9_w10_x86_rtl.exe"+2E453: 8B EC - mov ebp,esp

"Asphalt9_w10_x86_rtl.exe"+2E455: F3 0F 10 45 08 - movss xmm0,[ebp+08]

"Asphalt9_w10_x86_rtl.exe"+2E45A: 56 - push esi

}[/CODE]

[marek1957]

hey, I checked your method, I closed all threads (by close I mean SUSPENDED) using PROCESS HACKER ([URL]https://processhacker.sourceforge.io/[/URL]) without 3 or 4 threads which MUST be working because game then dont crash itself, but even if I close all these threads, after activate STEALTH EDIT plugin - the game is crashing... so game is detecting STEALTH EDIT plugin?? Or maybe we must change the name and signature of the plugin to not be detected???

1534243734

hmm, Maybe the problem is with UNLIMITED nitro? What do you think guys? Maybe If weI made a LIMITED nitro but this limited nitro will be depleting in lower time, maybe it will help??? What do you think?

1534243842

I checked also that I can activate STEALTH EDIT plugin when the game is loading, but then when I want to go to garage or make a race, the game is automatically crashing

[koderkrazy]

[QUOTE="l0wb1t, post: 55325, member: 6208"]i think without compare all other npc's have unlimited nitro aswell[/QUOTE]

That function works on all stats of hero and AI cars. :( Not a good place to inject.



Here is a better place to do that:

[CODE=cea][ENABLE]

aobscanmodule(_infiNitroINJECT,Asphalt9_w10_x86_rtl.exe,51 8D 8F C4 00 00 00 80 38 00 74 11 F3 0F 10 47 20)

registersymbol(_infiNitroINJECT)



_infiNitroINJECT+a:

db 90 90





[DISABLE]

_infiNitroINJECT+a:

db 74 11[/CODE]

Enable the script and press space-bar. This code gives you shockwave(double tap space on full nitro) as well.



[USER=11389]@marek1957[/USER] I am not modifying any in memory value here. Just nop a jump statement. Check if this cheat get's flagged, and let me know.



Note: Don't use this cheat in multiplayer. You'll definitely get on 'cheater board' if you finish race in insanely small time.

[l0wb1t]

Is there a way to start with a different account?

[marek1957]

I checked koderkrazy. it is still detectable by game anti-cheat. We must do like I wrote

- make something to use STEALTH EDIT plugin in game



OR



- we must make NITRO RATIO hack

[koderkrazy]

[QUOTE="marek1957, post: 55348, member: 11389"]- we must make NITRO RATIO hack[/QUOTE]

can you explain with example what do you mean by Nitro ratio hack?