Project 1999 - Making Norrath Great Again

Daidraco

Golden Baronet of the Realm
9,312
9,421
Leadership of DA were shady and tried whatever they could to get ahead. I was in DA originally (2009) because I like to be an underdog, but pretty quickly I realized the leader and officers would lie to GMs, exploit (e.g. phinny pull), train, or do anything they could to win. It was odd because usually it's the leading guild who does shady stuff to keep the up and comers down. That's how live was. Anyway, I jumped ship to IB around that time and was quite pleased at how legit they kept it. Never trained, lied, etc. It was funny having DA accuse us of having GMs in our back pocket because I saw so much shady stuff in DA and zero in IB. DA were just not as good of players with much worse leadership who whined and lied to get ahead.

"Back pocket" accusations were just haters being haters
Im pretty sure you're referring to Fish Bait. Salty/Tyen and Abacab trained the fuck out of IB, no matter what zone we were in. You guys could be raiding D'vinn for all the fucks I care and those two would still train your asses. A big incident happened in Fear when they trained IB and we lost Dracoliche because of it, (GM intervention etc.) which was the final straw for a lot of people. We broke up Fish Bait that night and made DA. I know - because I was a founding Officer of DA. A lot of people lump DA in with Fish bait, and I get that. We were basically the same people, but under different leadership and... to me at least, it showed.

A fucking book about my time in DA:
In retaliation, it seemed like IB trained the shit out of us every chance we were ahead and was your typical top dog keeping the next in line in beta status. Its questionable that it was so easy for you to move over to IB from DA because flipping switches wasnt exactly easy for the people that I saw do it. If it revolved around a shitty player, it would be one thing. But I saw some very knowledgeable, and in terms of EQ - skillful, people that were playing IB's needed classes, get turned away quick as shit. Suicide if you didnt have a sure invite, cause we would rarely let them back into DA. What was there next choice, really? The next closest guild was that European guild and at that time, they were lucky to field 20 people at a raid. Either way, you were friends with IB members and put them first, far ahead of DA. Whether you admit that or not. Not calling you out, cause I really could give a shit now..

The European guild, the swedish guild, all of them... we used them for their numbers and it would secure us a kill - losing only 1 item out of everything that dropped for their help. Usually, plenty happy to take the shittiest of the items. Which is basically where we recruited from and Im pretty sure I was called a Scalper by more than one guild leader. This, imo, is when we started pushing IB's shit in and beating them to spawns. (When you have people from all over the world in your guild - it didnt matter when a boss popped.)

DA didnt start to become shit till a guild member that was friends with people in IB got ShowEQ from a special "Bard" officer in IB (without throwing out names directly). Which proved that IB had been using ShowEQ for quite some time. I thought fair game, myself - because ShowEQ was a pretty big edge. Hell, I even used it. I would be helping someone get a Pegasus Cloak and even then, we would be racing IB members to Pegasus Spawns. Like.. wtf? Thats when you really knew that ShowEQ was just a widely used secret among your top guilds and if you werent using it - you were only hurting yourself. Like any hack, when you're using it - you can immediately pick up on someone else using it. - Im glad Secrets hacked the client and fixed the use of ShowEQ. But even now, through the grape vine of this forum - There is apparently a hack for that hack so people can keep using it. Caught only when a fake NPC location is given, but never spawned. Then the unmentioned tool that modifies a VPN to allow you to connect multiple accounts from the same location with minimal lag - even though the accounts werent allowed to be online from the same IP. (Im not network savvy, but I believe thats how it works.)

The downfall of DA was when a large group of its core members found a Dupe and the GM's took them out. That shit made me quit the game in hindsight. Abacab, or Raren? Cant remember which, ran up to one of the other guys in on it and handed him a naggy cloak, mana stone and some planar robe and he shortly poofed after that. Rogean popped his ass and kicked him - later asking for all that shit he traded back. I found out in the P99 forum that not only was it that group, but a group of people in IB were popped and a few people from other guilds. Who knows where it originally came from cause all of them claim to have found it first, and maybe they did. The interesting part about that though, was that most of the IB members that were banned were unbanned shortly after that. We can assume it was cause a lack of proof, but was it really?... I mean c'mon. No one else was unbanned, but they magically were?.. Really? gtfo

The only reason I bring up those incidents up is because out of the entire time I was an Officer in that guild - DA rarely was alone in the shadiness and in fact, was in my opinion a much better guild to be in for the person that wasnt a whiny little bitch. IB continued to lead the way and was often the source of so much shit that its hard to believe you didnt know about any of it. If anything, you werent in the leadership circle and had dick all clue about what was really happening. Notice I never pointed out all the petty shit that took place between our guilds.


--- Side Story, Edit ---
You guys took a Magician from us that used to be part of DA which made me question the entire membership of your guild. The reason he quit DA was because one of our members played an Erudite Cleric and had the two small lines under his eye. Something was happening in the news at the time that was all about thugs/gangsters and it got brought up in voice chat that Kadeem was a Crip and he couldnt figure out why we were saying that, only till he realized that the two lines under his eyes were reminiscent of Tear Drops. It really isnt that funny when I talk about it now, but for the majority of the guild - people laughed and thought it was funny. Especially when Kadeem embraced it and him and Necrious were Rob and Big or some shit. The Magician on the other hand, a white, very feminine sounding guy took the most offense of all to it. The black guy in the guild was even laughing, so it made the magician look all the more fucking dumb because no one ever said a fucking thing about black people. You werent a magician by chance, were you Dabamf? ... Kidding, kidding!
tongue.png
 

pharmakos

soʞɐɯɹɐɥd
<Bronze Donator>
16,306
-2,236
some shady stuff happened with the Severilous kill tonight? wasn't there myself, were any of you guys there?
 

Pooch

Lord Nagafen Raider
87
28
LOL draco i remember that edit story about the mage. We were on our way to phinny and he cried in voice chat about it then /guildquit lol.
 

Dabamf_sl

shitlord
1,472
0
Im pretty sure you're referring to Fish Bait. Salty/Tyen and Abacab trained the fuck out of IB, no matter what zone we were in. You guys could be raiding D'vinn for all the fucks I care and those two would still train your asses. A big incident happened in Fear when they trained IB and we lost Dracoliche because of it, (GM intervention etc.) which was the final straw for a lot of people. We broke up Fish Bait that night and made DA. I know - because I was a founding Officer of DA. A lot of people lump DA in with Fish bait, and I get that. We were basically the same people, but under different leadership and... to me at least, it showed.

A fucking book about my time in DA:
In retaliation, it seemed like IB trained the shit out of us every chance we were ahead and was your typical top dog keeping the next in line in beta status. Its questionable that it was so easy for you to move over to IB from DA because flipping switches wasnt exactly easy for the people that I saw do it. If it revolved around a shitty player, it would be one thing. But I saw some very knowledgeable, and in terms of EQ - skillful, people that were playing IB's needed classes, get turned away quick as shit. Suicide if you didnt have a sure invite, cause we would rarely let them back into DA. What was there next choice, really? The next closest guild was that European guild and at that time, they were lucky to field 20 people at a raid. Either way, you were friends with IB members and put them first, far ahead of DA. Whether you admit that or not. Not calling you out, cause I really could give a shit now..

The European guild, the swedish guild, all of them... we used them for their numbers and it would secure us a kill - losing only 1 item out of everything that dropped for their help. Usually, plenty happy to take the shittiest of the items. Which is basically where we recruited from and Im pretty sure I was called a Scalper by more than one guild leader. This, imo, is when we started pushing IB's shit in and beating them to spawns. (When you have people from all over the world in your guild - it didnt matter when a boss popped.)

DA didnt start to become shit till a guild member that was friends with people in IB got ShowEQ from a special "Bard" officer in IB (without throwing out names directly). Which proved that IB had been using ShowEQ for quite some time. I thought fair game, myself - because ShowEQ was a pretty big edge. Hell, I even used it. I would be helping someone get a Pegasus Cloak and even then, we would be racing IB members to Pegasus Spawns. Like.. wtf? Thats when you really knew that ShowEQ was just a widely used secret among your top guilds and if you werent using it - you were only hurting yourself. Like any hack, when you're using it - you can immediately pick up on someone else using it. - Im glad Secrets hacked the client and fixed the use of ShowEQ. But even now, through the grape vine of this forum - There is apparently a hack for that hack so people can keep using it. Caught only when a fake NPC location is given, but never spawned. Then the unmentioned tool that modifies a VPN to allow you to connect multiple accounts from the same location with minimal lag - even though the accounts werent allowed to be online from the same IP. (Im not network savvy, but I believe thats how it works.)

The downfall of DA was when a large group of its core members found a Dupe and the GM's took them out. That shit made me quit the game in hindsight. Abacab, or Raren? Cant remember which, ran up to one of the other guys in on it and handed him a naggy cloak, mana stone and some planar robe and he shortly poofed after that. Rogean popped his ass and kicked him - later asking for all that shit he traded back. I found out in the P99 forum that not only was it that group, but a group of people in IB were popped and a few people from other guilds. Who knows where it originally came from cause all of them claim to have found it first, and maybe they did. The interesting part about that though, was that most of the IB members that were banned were unbanned shortly after that. We can assume it was cause a lack of proof, but was it really?... I mean c'mon. No one else was unbanned, but they magically were?.. Really? gtfo

The only reason I bring up those incidents up is because out of the entire time I was an Officer in that guild - DA rarely was alone in the shadiness and in fact, was in my opinion a much better guild to be in for the person that wasnt a whiny little bitch. IB continued to lead the way and was often the source of so much shit that its hard to believe you didnt know about any of it. If anything, you werent in the leadership circle and had dick all clue about what was really happening. Notice I never pointed out all the petty shit that took place between our guilds.


--- Side Story, Edit ---
You guys took a Magician from us that used to be part of DA which made me question the entire membership of your guild. The reason he quit DA was because one of our members played an Erudite Cleric and had the two small lines under his eye. Something was happening in the news at the time that was all about thugs/gangsters and it got brought up in voice chat that Kadeem was a Crip and he couldnt figure out why we were saying that, only till he realized that the two lines under his eyes were reminiscent of Tear Drops. It really isnt that funny when I talk about it now, but for the majority of the guild - people laughed and thought it was funny. Especially when Kadeem embraced it and him and Necrious were Rob and Big or some shit. The Magician on the other hand, a white, very feminine sounding guy took the most offense of all to it. The black guy in the guild was even laughing, so it made the magician look all the more fucking dumb because no one ever said a fucking thing about black people. You werent a magician by chance, were you Dabamf? ... Kidding, kidding!
tongue.png
Wait, maybe I'm thinking of another guild. This was fall 2009, at the beginnings of fear and hate. There was a big incident at phinny when the guild I was in basically exploit pulled him and sparked this huge forum thread of them vs IB. That was the incident that made me leave the guild and join IB. I remember salty being a huge fag and training people and also generally sucking at the game, but does anyone remember the guild I'm talking about with phinny? It was definitely in existence when tyenfag was still fagging around
 

Siliconemelons

Avatar of War Slayer
10,917
15,391
Ain't the phinny pull "sploitz" fraps still in RnF? At the time, and still today phinny is such a fickel mob to pull a simple video of him inc always lookss like a sploit lol
 

Dabamf_sl

shitlord
1,472
0
Haha oh shit. My bad then. I remember thwt video. Yea transcendence. I was in that kill, and left the guild shortly after.
 

Siliconemelons

Avatar of War Slayer
10,917
15,391
In all honesty as a normal little nubling in the guild as said above... Every raid I was on was kosher, and if they had many many people using showEQ than they put a good front of slave driven trackers legit tracking as cover... the 10/15+ man online with afk check poopsocking fear fire ring... the first use of the train away and engage CT (my soulleech!) everything I had attended was legit and everyone I talked to never gave lean to spoits or hacks- while being on the other side we could see that IB was able to do things quicker than us in many instances...not all of that was they are better players- I witnessed many instances of GM rezzes and the GM just left once they got the IB clerics back in etc. Who was Bunn...I always remember his cleric Bunn because its a coffee pot- he was the only one I knew that used show eq- and admitted it bc he got hit by batphoning a fake draco rogean used to test showEQ use.

With Durisons money grab RMT departure I wont ever think that his communication with me during my time in the guild was ever fully fact- but as a normal member there was never ever any officer/leadership spoken word of sploits hacks etc. and they must have kept one hell of a front to not only me but every other member.
 

Dabamf_sl

shitlord
1,472
0
That's interesting, because my memory is of several shady things happening with trancendence's leadership. I remember some instance of them petitioning GMs after losing a race fair and square and claiming a train or something when it clearly didn't happen. I had seen several shady things before the phinny kill; that was just the catalyst. I never once saw anything shady while in IB. Xzerion had stopped being a gm because people were obsessed with the speculation that he was cheating.

Not saying you're wrong or anything. That's just what I experienced. It's interesting how that drama is so salient after all these years. I had to think longer to remember what class I played than to remember the guild drama. I can still recite exactly what happened in 2002 in my guild's major forum dispute from live.
 

a_skeleton_02

<Banned>
8,130
14,248
Coming from a standard player, never and officer or in with the cool kids crowd, it's all perception... I was never at any raid where there was shenanigans of exploit accusation etc. I must have just missed all of them! The biggest "thing" I was ever a part of was the "Sprite Golem incident" and that made a little p99 meme so it's all good!
Early TMO had a lot of help from Uthgaard when we started raiding/competing against IB. IB had the same thing with Hobby and others. It is all corrupt.
 

Daidraco

Golden Baronet of the Realm
9,312
9,421
I didnt think Durison started the RMT shit till much later though? Around the time Sky opened up, from what I understood. Long after I quit playing and Transvestence was way dead and gone. A few months past the birth of TMO. (Which is still weird that when TMO was being made, I didnt see Edarion, Opalopa or anyone from the original guild that I played with except Happyfeet. Happyfeet didnt recognize my name, so Im not even 100% its the real happyfeet and I tanked for him. But whatever.)

No one openly talked about ShowEQ. Not even in DA when it became widely used among the officers and the "clique". It was always behind a locked voice chat if we did. Im sure Pooch remembers me getting a port up to Hate with a group and making my way (as a warrior) over to Maestro area at full spawn by myself. I did it on several occasions. When you can watch one monitor and see where everything is, avoiding aggro just becomes a joke. To be more specific about its use, now, I saw a screenshot of the ShowEQ map showing Veeshans Peak. What guild it was, much less the member, Ill leave up to you. (and no, its not another emulator server lol)

The only thing Im curious about is if __ is using it, is there really a way to circumvent Secrets security measure - or are they just being overlooked out of favoritism.

(And yea, EverQuest drama is so easy to remember cause the shit is like School. You could be in 12th grade and still bang on someone cause of some shit they did in grade school. Not to mention, it has like its own reward when it worked out in your favor.)
 

Secrets

ResetEra Staff Member
1,879
1,884
The only thing Im curious about is if __ is using it, is there really a way to circumvent Secrets security measure - or are they just being overlooked out of favoritism.
I'm not even sure what's completely in the security thing, because it's Rogean's, not mine, and I haven't been assed to reverse it. I made that very clear because there's some people thinking I added backdoors to the code, which is not the case - Rogean has full source code access to the DLL, and he is the only one as far as I know that has access to its codebase. Basically, Rogean holds the keys to that, not any single developer. They all have to go past him to get something added.
And it's packed with Themida, coupled with VM macros. The technology is outlined here (see: SecureEngine)Oreans Technology : Software Security Defined.

That being said, I don't believe it is bypassed. Most of the people I've seen in this community can't even read assembly let alone dump VM-protected applications.
 

Daidraco

Golden Baronet of the Realm
9,312
9,421
I'm not even sure what's completely in the security thing, because it's Rogean's, not mine, and I haven't been assed to reverse it. I made that very clear because there's some people thinking I added backdoors to the code, which is not the case - Rogean has full source code access to the DLL, and he is the only one as far as I know that has access to its codebase. Basically, Rogean holds the keys to that, not any single developer. They all have to go past him to get something added.
And it's packed with Themida, coupled with VM macros. The technology is outlined here (see: SecureEngine)Oreans Technology : Software Security Defined.

That being said, I don't believe it is bypassed. Most of the people I've seen in this community can't even read assembly let alone dump VM-protected applications.
I could have swore you popped into our Team Speak one day and told us about it. I guess I just assumed you made it. Though from what I remember, it was kind of hard to understand you when you were using voice manipulation software.
wink.png
I really have no idea how any of that shit works. Most of my work has been with Honorbuddy and Rebornbuddy over the last few months between C++ and C#. Complete side projects and one of those projects has continued to make me money from a game Im not even subbed to anymore! *pats self on the back* But still, that stuff is very basic and it blows my mind that people pay for it.

However, If Themida is really what its packed up with - from my understanding, itll take a bit more time, but the shit is still on the users computer. So in essence - something like IDA-Pro would make Themida its fine, sweet ass bitch. (At least, this is my opinion. You may know more.) All of which can be pirated, so its not like your average user doesnt have access to this stuff. Also, we have some very.. very... strong programmers in THIS community (much less those that can reverse engineer), so are you talking about the P99 community in particular? Which yea, most are pants on head retarded. All Im essentially saying is that if people want to crack the shit, they will. Just like if someone wants in your house bad enough, theyll find a way. Shits not rocket science, and themida isnt exactly hot shit.

"That being said" I have absolutely no clue about VM protection - but my point still stands about someone wanting to crack shit. For god sakes, steam games are hacked in less than a day for example.
 

Secrets

ResetEra Staff Member
1,879
1,884
I could have swore you popped into our Team Speak one day and told us about it. I guess I just assumed you made it. Though from what I remember, it was kind of hard to understand you when you were using voice manipulation software.
wink.png
I really have no idea how any of that shit works. Most of my work has been with Honorbuddy and Rebornbuddy over the last few months between C++ and C#. Complete side projects and one of those projects has continued to make me money from a game Im not even subbed to anymore! *pats self on the back* But still, that stuff is very basic and it blows my mind that people pay for it.

However, If Themida is really what its packed up with - from my understanding, itll take a bit more time, but the shit is still on the users computer. So in essence - something like IDA-Pro would make Themida its fine, sweet ass bitch. (At least, this is my opinion. You may know more.) All of which can be pirated, so its not like your average user doesnt have access to this stuff. Also, we have some very.. very... strong programmers in THIS community (much less those that can reverse engineer), so are you talking about the P99 community in particular? Which yea, most are pants on head retarded. All Im essentially saying is that if people want to crack the shit, they will. Just like if someone wants in your house bad enough, theyll find a way. Shits not rocket science, and themida isnt exactly hot shit.

"That being said" I have absolutely no clue about VM protection - but my point still stands about someone wanting to crack shit. For god sakes, steam games are hacked in less than a day for example.
Yeah - Themida is way different than any other packer, but ONLY if it's used correctly and ONLY if it's past the version that had the exploit where you could bypass the VM protection entirely.

Here's a view of a DLL through IDA 6.1 packed w/ Themida:

0f351f7a64.png


That's not an ordinary DLLMain/entry point for sure.

You'd have to unpack it from memory - but wait, there's more.

Even if you unpack it from memory, you dump Themida's VM with it. The code is obfuscated by using a virtual machine that has a different architecture than x86 embedded in the application itself. This machine translates x86 instructions to something like ARM, RISC, etc, and that virtual machine makes it near-impossible unless you've done reversing by hand. This makes it really hard to actually see what is going on, unless the code returns something, in which case you can get the return value and modify it. It's not like WoW pservers where you can hook functions and start flying; it's a bit more complex than that.

Most companies run into issues that involve crashes with commercial games and framerate issues with Themida, so isn't always used if at all in most major games. It also has a high probability of being detected as a virus, because virus scanners cannot see the code until it's unpacked in memory (at which point if it IS malicious, you're far too late unless you're sandboxed), thus they label it Themida/GEN in most of their heuristics and it causes issues with most companies. (see: p99 technical forums.) That's why you see commercial games get cracked.

In regards to the community, I was referring to the P99 one. Even in EQEmulator/MQ2 there's not that many reverse engineers, maybe 6 total I know of, with 3 not working on their projects anymore.

That's not to say someone couldn't figure it out through other ways, but the chances of them figuring out a DLL aimed to target an application without knowing the application's code structure or the DLL's purpose itself is kind of hard, and I assume you can imagine so having dealt with programs such as Honorbuddy and Rebornbuddy how hard it is to not have the source code to one application, let alone one that is obfuscated and one that is not.
 

Daidraco

Golden Baronet of the Realm
9,312
9,421
Even if you unpack it from memory, you dump Themida's VM with it. The code is obfuscated by using a virtual machine that has a different architecture than x86 embedded in the application itself. This machine translates x86 instructions to something like ARM, RISC, etc, and that virtual machine makes it near-impossible unless you've done reversing by hand. This makes it really hard to actually see what is going on, unless the code returns something, in which case you can get the return value and modify it. It's not like WoW pservers where you can hook functions and start flying; it's a bit more complex than that.
/////////////
That's not to say someone couldn't figure it out through other ways, but the chances of them figuring out a DLL aimed to target an application without knowing the application's code structure or the DLL's purpose itself is kind of hard, and I assume you can imagine so having dealt with programs such as Honorbuddy and Rebornbuddy how hard it is to not have the source code to one application, let alone one that is obfuscated and one that is not.
rrr_img_74787.jpg


Virtual Deobfuscation? Its open source and IDA Pro also has a plugin for it. Originally designed for malware (which you reminded me of this plugin via your malware remark). Im no where near as advanced as you when it comes to this shit. I really have never had the urge to break any software, much less a bug. But I saw this on the Blackhat feed last year and you can still see the video of it for an in depth look. It takes what you say is a lengthy process and makes it trivial.

 

Secrets

ResetEra Staff Member
1,879
1,884
Pretty sure, even with this plugin, you'd have to reconstruct the function and emulate what it's doing, especially when it comes to some of the network layer stuff.
That's why I said you'd need to know the target application as well; it does you no good when you see a reference to a memory address that you have no idea what it does, but the author of a library does and targets that specific spot.

I'll admit some of that is beyond even myself, but basically the way Themida works is:

Enter function <-> Bogus Conditionals, JMPs, and loop arounds that make no sense to a decompiler <-> Virtual Machine running inside the memory space (think VMWare) <-> return value <-> more jmps/bogus code <-> push returned value <-> Returned, continue on with normal code

The plugin you linked I believe aides with the conditional/bogus code portion. I'm not too sure about the VM part or if it'll work on that.