https://bugs.winehq.org/show_bug.cgi?id=36671
Anastasius Focht focht@gmx.net changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords| |download, obfuscation Status|UNCONFIRMED |NEW URL| |http://download.aeriagames. | |com/files/games/us/ava/csd/ | |ava_us_downloader.exe CC| |focht@gmx.net Version|unspecified |1.7.19 Ever confirmed|0 |1
--- Comment #3 from Anastasius Focht focht@gmx.net --- Hello folks,
confirming.
AVA is protected by XIGNCODE3 anti-cheat engine which is a replacement for GameGuard.
So garbage got swapped out with garbage.
http://www.wellbia.com/dp/?q=en/node/24
List of implemented "features":
--- quote --- An accurate activate system
Detection non-clinet bot via using "One-time excutable code" patent Reject general hacking tool and mutant via using "Win32 API calling pattern and frequency" patent Game management company is able to manage illegal system/Mac address/user account/reject hardware Emergency pattern creating tool provide (Game managment company is able to handle it) Detect and reject VPN access (Game managment company is able to handle it) Detect of DirectX modulation and illegal call Detect of WDDM driver modulation Detect modified of function about time Detect time modified via using time server Detect of game client local time modification Detect of major kernal function modification Detect DLL injection Detect virtual memory code injection Detect harmful thread Detect harmful window creation in game Detect keyboard highjacking in game Detect illegal control of DHCP Detect Nuking/drop hack Detect auto click Detect software/hardware macro Detect message hook Detect multy client Detect VEH/SEH modify and register Check game client hash Detect call specific function in game Detect game resource modification Reject game process memory accessing Reject game process handle accessing Reject game process message transmission Reject game process keyboard/mouse input transmission Reject game window GDI accessing Reject debug interrupt handler modification Reject calling kernal function directly Reject stealth process/module/driver Reject kernal/user mode debugging Detect excuted on virtual environment --- quote ---
Several executables are wrapped with Themida protection scheme:
--- snip --- -=[ ProtectionID v0.6.5.5 OCTOBER]=- (c) 2003-2013 CDKiLLER & TippeX Build 31/10/13-21:09:09 Ready... Scanning -> C:\AeriaGames\AVA\Binaries\AVA.exe File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 7314944 (06F9E00h) Byte(s) [File Heuristics] -> Flag : 00000000000001001101000000110011 (0x0004D033) [Entrypoint Section Entropy] : 4.09 [!] Themida v2.0.1.0 - v2.1.8.0 (or newer) detected ! [i] Hide PE Scanner Option used - Scan Took : 0.571 Second(s) [00000023Bh tick(s)] [533 scan(s) done]
Scanning -> C:\AeriaGames\AVA\Binaries\XIGNCODE.USA\x3.xem File Type : 32-Bit Dll (Subsystem : Win GUI / 2), Size : 1548808 (017A208h) Byte(s) -> File Appears to be Digitally Signed @ Offset 0178E00h, size : 01408h / 05128 byte(s) [File Heuristics] -> Flag : 00000000000001001101010000110111 (0x0004D437) [Entrypoint Section Entropy] : 4.07 [!] Themida v2.0.1.0 - v2.1.8.0 (or newer) detected ! [i] Hide PE Scanner Option used - Scan Took : 0.335 Second(s) [00000014Fh tick(s)] [229 scan(s) done] --- snip ---
From some game hacker site:
--- quote --- splash.xem --> splash.bmp --> XIGNCODE Splash Bitmap tray.xem --> tray.ico --> XIGNCODE Tray Icon x3.xem --> x3.dll --> XIGNCODE System xm.exe --> xm.exe --> XIGNCODE Message Printer xmag.xem --> xmag.xem --> XIGNCODE File Archive xsg.xem --> xsg.dll --> XIGNCODE System Guard xxd.xem --> xxd.dll --> XIGNCODE WatchDog Process --- quote ---
Doesn't like relay nor running or attached debuggers (crapload of watcher threads) :) Fixing some of the insufficiencies can help to make Wine achieving better compatibility with other apps/games but I doubt it can make this scheme fully work.
Besides dealing with native API and low level structures in invasive ways, it has a kernel driver part which probably employs nasty trickery which Wine is not made for to detect kernel/usermode hooks.
$ ls -1hs total 2.9G 3.4M aeria_ignite_install.exe 2.9G ava_gamedata_v9.exe 568K ava_us_installer_20140905.exe 280K DotNetFx35ClientSetup.exe
$ sha1sum * 76fdde78caaf472d2cbdc0b858d02bbd9fafb42b aeria_ignite_install.exe 8e22137db59d7c64c89e93fea1c9cf5546b43344 ava_gamedata_v9.exe 3a5c5eb7c0aa6d7de9bb4fae3608176dd90a3792 ava_us_installer_20140905.exe 2d1200a3f30b4f9a377950c7258c75e1f7293e58 DotNetFx35ClientSetup.exe
$ wine --version wine-1.7.30-181-gffd3135
Regards