tisdag 12 juli 2011

Modifications on Gunz.exe

There is some small tricks you can do to enhance either your private server or mod a public one for hacking interests.

A few years ago, i worked with x1nixmzeng to create a new gender in a private server we were making, the Goblin.
All animations and models we just simple took from the quest monster with the same name.
We never finished this project but we did however get pretty far, here is some pictures;





For doing this, you had to modify Gunz.exe with ollydbg to remove the 2 gender limit, and you also had to add the new gender in system.mrs and add all the new models for your new character.

The part i noticided with this is that you can make a character with whatever genderid you want on which privateserver (which havn't made some mod to prevent it) you want, which could possibly be abused for an easy way to bufferoverflow the matchserver.exe

Here's some notes we made while making this;

models/character.xml < sex
default/Charcreate.xml < newgender
system/string.xml < add new gender

heroman01 & herowoman01 = sex'es





asm

00416470 |. 68 207C5E00 PUSH theduel2.005E7C20 ; ASCII "heroman1"

00416477 |> 68 147C5E00 PUSH theduel2.005E7C14 ; ASCII "herowoman1"



0041720D |. 68 207C5E00 PUSH theduel2.005E7C20 ; ASCII "heroman1"

00417214 |> 68 147C5E00 PUSH theduel2.005E7C14 ; ASCII "herowoman1"

004173DE |. 68 207C5E00 PUSH theduel2.005E7C20 ; ASCII "heroman1"

004173E5 |> 68 147C5E00 PUSH theduel2.005E7C14 ; ASCII "herowoman1"

00473685 |. BF 207C5E00 MOV EDI,theduel2.005E7C20 ; ASCII "heroman1"

00473802 . BF 207C5E00 MOV EDI,theduel2.005E7C20 ; ASCII "heroman1"

0047381B . 68 147C5E00 PUSH theduel2.005E7C14 ; ASCII "herowoman1"

00473837 > 68 207C5E00 PUSH theduel2.005E7C20 ; ASCII "heroman1"



female(herowoman01):
005E7C13 0068 65 ADD BYTE PTR DS:[EAX+65],CH
005E7C16 72 6F JB SHORT theduel2.005E7C87

male(heroman01):
005E7C1F 0068 65 ADD BYTE PTR DS:[EAX+65],CH
005E7C22 72 6F JB SHORT theduel2.005E7C93