[Information] Bypass StargateZ AC topic

This is a quick example of how to bypass StargateZ AC, and the process of how I did it... Patch it in 2min flat.. Good luck, full bypass + write up done in 15min, lots of spelling error and basic steps missing.

What you will need

• IDA


• Hex editor


• And the game SG.exe

1)
1st run the launcher to get any updates... All up to date...

2)
Then I look to see if the main exe was packed or not... We are in luck its not!

3)
Then I did a quick look at the main dir, looks like they have added 2 new dll

Code:

---

AC.dll
avutil.dll

---

4)
We don't want them to run... So lets open SG.exe with a hex editor and remove the names

Do a quick string search and you will find them...

Code:

---

AC.dll -> XX.dll
avutil.dll -> XXXXXX.dll

---

save it, and lets run it...

5)
We get a Fate error, that message looks a lot like the one from the CRC code posted on some other forum...

Search it up in IDA

Code:

---

Fatal error

---

fount it,

Code:

---

push    offset aFatalError ; "Fatal error"

---

and just above that we see.

Code:

---

jz      short loc_5A824F

---

Lets jump back into the hex editor and patch it.

Search for this in your hex editor,

Code:

---

74 1F 68 F0 62 B9 00 68  74 04 BA 00 FF 15 60 85
or
74 14 68 ? ? ? ? E8 ? ? ? ? 83 C4 04 C6 05

---

And change it to

Code:

---

74 -> EB

---

5)
Lets see what we just patched, who knows what we just removed... Thinking is was an anti CE thing...

Lets set a bp, b/c we know that any memory modification will close the game...

Code:

---

SG.exe+0x1000

---

Look what we found, this code is scanning the game,

Code:

---

mov dl,[ecx]

---

Looks like some type of 'if' just below it... Guessing that's the if something changed...

Jump back into IDA, create a sig and change it in the hex editor

Code:

---

74 28 68 BC 61 B9 00 68  F0 4B B7 00 FF 15 A8 81
or
74 28 68 ? ? ? ? 68 ? ? ? ? FF 15

74 -> EB

---

6)
lets set a bp on EndScene, hmm nothing, lets jump in game...
hmm the game closes... But we are in luck, they log error messages....

Code:

---

WARNING : ERROR 102

---

Jump in IDA and we see

Code:

---

jz      short loc_4DCE32
push    offset aWarningError_3 ; "WARNING : ERROR 102"
...
call    __exit

---

lets patch that

Code:

---

74 14 68 EC AB B8 00 E8  E8 6C 08 00 83 C4 04 6A
or
74 14 68 ? ? ? ? E8 ? ? ? ? 83 C4 04 6A 19

74 -> EB

---

Lets try it again, bp in game.. new error...

Code:

---

WARNING : ERROR 104

---

Lets look it up in IDA, we see 3 places its used, lets patch them all...

Code:

---

74 1C 68 40 4C B7 00 E8  81 63 12 00 83 C4 04 39
or
74 1C 68 ? ? ? ? E8 ? ? ? ? 83 C4 04 39 1D ? ? ? ? 75 07 C6 05 ? ? ? ? ? 38 5C 24 13

74 1C 68 40 4C B7 00 E8  83 60 12 00 83 C4 04 39
or
74 1C 68 ? ? ? ? E8 ? ? ? ? 83 C4 04 39 1D ? ? ? ? 75 07 C6 05 ? ? ? ? ? 38 9D

74 14 68 40 4C B7 00 E8  55 1C 12 00 83 C4 04 C6
or
74 14 68 ? ? ? ? E8 ? ? ? ? 83 C4 04 C6 05

all 74 -> EB

---

After patching that lets set a bp.... Hmmm no crash and nothing is accessing D3D, could have already patched it who knows...

8)
Profit???