Code: Select all
Anti-CE thread:
MK11.exe+F303910 - 48 83 EC 08 - sub rsp,08 { 8 } <-- use this on creation and RET it
MK11.exe+F303914 - 48 89 3C 24 - mov [rsp],rdi
MK11.exe+F303918 - 48 83 C4 D0 - add rsp,-30 { 208 }
MK11.exe+F30391C - 55 - push rbp
MK11.exe+F30391D - 48 87 6C 24 28 - xchg [rsp+28],rbp
MK11.exe+F303922 - 48 C7 C5 FEFFFFFF - mov rbp,FFFFFFFE { -2 }
MK11.exe+F303929 - 48 87 6C 24 28 - xchg [rsp+28],rbp
MK11.exe+F30392E - 5D - pop rbp
MK11.exe+F30392F - 41 55 - push r13
MK11.exe+F303931 - 4C 8B 6C 24 48 - mov r13,[rsp+48]
MK11.exe+F303936 - 49 89 DD - mov r13,rbx
MK11.exe+F303939 - 4C 89 6C 24 48 - mov [rsp+48],r13
MK11.exe+F30393E - 41 5D - pop r13
MK11.exe+F303940 - 41 54 - push r12
MK11.exe+F303942 - 4C 8B 64 24 50 - mov r12,[rsp+50]
MK11.exe+F303947 - 49 89 EC - mov r12,rbp
MK11.exe+F30394A - 4C 87 64 24 50 - xchg [rsp+50],r12
MK11.exe+F30394F - 41 5C - pop r12
MK11.exe+F303951 - 48 8D 6C 24 50 - lea rbp,[rsp+50]
MK11.exe+F303956 - 48 81 C5 8FFA8D6A - add rbp,6A8DFA8F { 1787689615 }
MK11.exe+F30395D - 48 89 B5 71057295 - mov [rbp-6A8DFA8F],rsi
MK11.exe+F303964 - 55 - push rbp
MK11.exe+F303965 - F7 D5 - not ebp
MK11.exe+F303967 - 33 2C 24 - xor ebp,[rsp]
Thread creation:
MK11.exe+F308225 - 4C 8D 44 24 28 - lea r8,[rsp+28]
MK11.exe+F30822A - 83 E2 00 - and edx,00 { 0 }
MK11.exe+F30822D - 48 8D 4C 24 20 - lea rcx,[rsp+20]
MK11.exe+F308232 - 48 81 C1 45B0B819 - add rcx,19B8B045 { 431534149 }
MK11.exe+F308239 - 49 81 E8 B1F3F2AC - sub r8,ACF2F3B1 { -1393364047 }
MK11.exe+F308240 - 49 89 80 B1F3F2AC - mov [r8-530D0C4F],rax
MK11.exe+F308247 - C7 81 BB4F47E6 00000000 - mov [rcx-19B8B045],00000000 { 0 } <-- skip this so 0x4 is maintained and thread created suspended
MK11.exe+F308251 - 51 - push rcx
MK11.exe+F308252 - F7 D1 - not ecx
MK11.exe+F308254 - 33 0C 24 - xor ecx,[rsp]
MK11.exe+F308257 - 41 09 D9 - or r9d,ebx
MK11.exe+F30825A - 4C 8D 05 5F815FF2 - lea r8,[MK11.exe+19003C0] { (-1607119895) }
MK11.exe+F308261 - F7 D1 - not ecx
MK11.exe+F308263 - 48 8D 64 24 08 - lea rsp,[rsp+08]
MK11.exe+F308268 - FF 15 02E3C908 - call qword ptr [MK11.exe+17FA6570] { ->KERNEL32.CreateThread }
MK11.exe+F30826E - 51 - push rcx
And here's the version string:
Code: Select all
MK11.exe+5A4A2E - 48 8B F0 - mov rsi,rax
MK11.exe+5A4A31 - 48 89 44 24 38 - mov [rsp+38],rax
MK11.exe+5A4A36 - 48 8D 15 C3F5A202 - lea rdx,[MK11.exe+2FD4000] { (21DBB980) } <-- pointer to version
MK11.exe+5A4A3D - 48 8D 8C 24 88000000 - lea rcx,[rsp+00000088]
MK11.exe+5A4A45 - E8 E66FCEFF - call MK11.exe+28BA30
MK11.exe+5A4A4A - 48 8B E8 - mov rbp,rax
MK11.exe+5A4A4D - 48 89 44 24 58 - mov [rsp+58],rax
[MK11.exe+2FD4000] -> 21DBB980 -> "0.118-16-CL138037"
Why am I posting the version as well? So you know which one the first snippet applies to.
One can imagine why this game's slowly going down the drain
No more challenges, Nether? Aww