[ZiDHax][CF EU] Full XTrap Bypass

[zatrax1]

Stuck at STEP4

[Mirco']

Work Perfect (MultiClient, CheatEngine & all what you can do with a bypass)
Tested on EU

[xPaulo]

But i dont find a hack to inject can any one give 1 ? plz :c.

[shurikenkamui]

yeah the same problem...if i use a hack and start after launcher the hack is not injected...so what can i do...and in general with this bypass can i hack coins,rp or something>?

P.S: everything that i'm doing with cheat engine is only visual...so what is the point of bypassing if cheat engine is not working...

[Mirco']

Originally Posted by shurikenkamui

yeah the same problem...if i use a hack and start after launcher the hack is not injected...so what can i do...and in general with this bypass can i hack coins,rp or something>?

P.S: everything that i'm doing with cheat engine is only visual...so what is the point of bypassing if cheat engine is not working...

Look some CE tutorials, you can do much. Example unlimited shot, speed hack, no recoil, super jump, teleport and and and

[lolpho]

Originally Posted by Mirco'

Work Perfect (MultiClient, CheatEngine & all what you can do with a bypass)
Tested on EU

Yours doesn't get stuck on STEP 4 while connecting to a server? Maybe I'm doing something wrong here.

1. Extracted EXE file in a separate folder.

2. Moved everything except the folder labeled xtrap after unzipping into the crossfire folder.

3. Moved the files inside the xtrap folder into the official xtrap folder in the crossfire folder.

4. Run launcher.exe as administrator.

5. Click "RUN" when prompted to run HGWEmu.exe

???? Still get stuck at STEP 4.

[Ruhrocha]

Does it work in CF NA? Seems pretty cool.

[gbpackerfan]

I'm pretty sure it doesn't work for CF NA

[ZiD.]

Originally Posted by Mirco'

Work Perfect (MultiClient, CheatEngine & all what you can do with a bypass)
Tested on EU

Thanks for the vouch buddy.


I will use this as picture in the thread alright?


Please tell me if you have any problems with it


Regards

[walaakongmai]

I get this msvcp110.dll not detected, then I downloaded one and put it in the main folder with the luncher, then now it says that is not for the program, pls reinstall sumthin. help!

[Ende!]

I took a look at your code - this simple approach will only work for CrossFire versions with no HGWC and XTrap server connection enforcement enabled (AFAIK that only applies to EU), as you do not perform any trial to emulate it. You might want to add this to the main post to stop people from asking why they are stuck at STEP 4.

Edit: Another tip: compile your binaries with /MT. This way you don't require the redistributable DLLs. Also, the MSVCR you ship with your release are for debug binaries compiled with VS11, not for VS13 release binaries. That's why people are having problems.



Edit 2:

Originally Posted by Mirco'

Look some CE tutorials, you can do much. Example unlimited shot, speed hack, no recoil, super jump, teleport and and and

Nope, everything you named is detected by either client or serverside checks. You will have pretty hard time bypassing them using CE (at least by using ONLY CE). :P

[sldeez]

hey man can you make it work for Crossfire NA ?

[ZiD.]

Originally Posted by Ende!

I took a look at your code - this simple approach will only work for CrossFire versions with no HGWC and XTrap server connection enforcement enabled (AFAIK that only applies to EU), as you do not perform any trial to emulate it. You might want to add this to the main post to stop people from asking why they are stuck at STEP 4.

Edit: Another tip: compile your binaries with /MT. This way you don't require the redistributable DLLs. Also, the MSVCR you ship with your release are for debug binaries compiled with VS11, not for VS13 release binaries. That's why people are having problems.

Thanks!


Regards

[Slicktor]

Originally Posted by Ende!

I took a look at your code - this simple approach will only work for CrossFire versions with no HGWC and XTrap server connection enforcement enabled (AFAIK that only applies to EU), as you do not perform any trial to emulate it. You might want to add this to the main post to stop people from asking why they are stuck at STEP 4.

Edit: Another tip: compile your binaries with /MT. This way you don't require the redistributable DLLs. Also, the MSVCR you ship with your release are for debug binaries compiled with VS11, not for VS13 release binaries. That's why people are having problems.



Edit 2:


Nope, everything you named is detected by either client or serverside checks. You will have pretty hard time bypassing them using CE (at least by using ONLY CE). :P

Its only a file emulator which emulate xtrapva.dll and hgw(no heartbeart on eu).
The stuck at step 4 on NA/PH is because hgw didn't send the xtrap packet(forgot the packet_name).
XTrap is sending the alives only if the xtrap-threads are alive(WaitForSingleObject/Ex).
At the moment xtrap is easy to bypass ((old and bad source)update the address if you want a bypass) :



btw: crossfire has serverside-hackchecks?

[Ende!]

Originally Posted by Slicktor

Its only a file emulator which emulate xtrapva.dll and hgw(no heartbeart on eu).
The stuck at step 4 on NA/PH is because hgw didn't send the xtrap packet(forgot the packet_name).
XTrap is sending the alives only if the xtrap-threads are alive(WaitForSingleObject/Ex).
At the moment xtrap is easy to bypass ((old and bad source)update the address if you want a bypass) :

You'll get stuck at STEP 4 for any kind of invalid HGWC or XTrap emulation that does not involve completely invalid packets (which result in you being kicked). There's also an XTrap.lib which is linked statically into the game. Let me quote a post I made a while ago on another forum:

Originally Posted by Ende!

 _____________________________________________________________________________
| HGWC.exe                                                                    |
|                                                                             |
| => Establishes connection to HGWC server                                    |
| => Receives tons of CRCs of common 'bad tools' and detected hacks           |
| => Validates integrity of .rez files with CRCs from server                  |
| => Receives the HGWC session-key passed as parameter to the game            |
|     - Key is sent in CF's login-packet                                      |
|     - Invalid key -> kick after server selection (STEP 4)                   |
| => Launches the game process                                                |
| => Keeps alive connection to HGWC server, regularly sends simple heartbeat  |
|    packets                                                                  |
| => Connection is encrypted with a static key, key is later changed to one   |
|    provided by the server                                                   |
| => Tunnels heartbeat-packets from XTrap.lib/XTrapVa.dll in CF process       |
| => Protocol consists of ~ 35 server- and ~ 15 client-opcodes                |
| => Sending incorrect response packets to the server results in a disconnect |
| => Manages bans of specific kinds (didn't dive into that further, emulated  |
|    whole HGWC/XT anyway, so didn't care about the banning stuff)            |
|_____________________________________________________________________________|
                                     |
                                     |
                                     v
 _____________________________________________________________________________
| crossfire.exe                                                               |
|                                                                             |
| => calls 4 (not sure, but I think it were 4) callbacks to assure XTrap.lib  |
|    is initialized correctly (in WinMain, post window creation, post login,  |
|    WndProc - nopping these prevents XT from loading, DC after ~2 min inc)   |
|  _____________                                                              |
| | XTrap.lib   |                                                             |
|   => Establishes encrypted named pipe connection to HGWC                    |
|   => Loads XTrapVa.dll                                                      |
|   => XT-heartbeat packet generation                                         |
|     - 7 server-, 5 client packet types                                      |
|     - obfuscated opcodes                                                    |
|     - static packet length (0x80 bytes)                                     |
|     - receives check requests from server, generates response data          |
|       validated by the server, so nopping does not help, as the server      |
|       expects correct data (checksums, for instance)                        |
|     - on a special opcode, requests heartbeat data generated by XTrapVa.dll |
|   => Statically linked into crossfire.exe                                   |
|  _____________                                                              |
| | XTrapVa.dll |                                                             |
|   => Generates a heartbeat data block validated by the server when asked    |
|   => Performs actual AC stuff (detour checks, ..., you name it)             |
|_____________________________________________________________________________|

Originally Posted by Slicktor

btw: crossfire has serverside-hackchecks?

They have. Some of them however depend on data sent by the client and are therefore bypassable (no recoil, no spread, speedhack, aimbot detection and possibly more I forgot about).