0x1 - Purpose

When launching the game, the files hashes are sent to the server to verify if the files are modified / outdated.

Spoofing those hashes by the real ones allow us to modify the files as we want without getting disconnected.

https://s3-us-west-2.amazonaws.com/secure.notion-static.com/c86de954-3fed-4172-904f-4b2cb04b224c/tenor.gif

0x2 - Functions

using t_auth_crc_req = int32_t(__thiscall*)(void *, uint32_t *); //E8 ? ? ? ? 8B F0 A1 ? ? ? ? 8B 08

0x3 - Hook

Place a detour on the function and spoof the crc parameter.

using t_auth_crc_req = int32_t(__thiscall*)(void *, uint32_t *);
t_auth_crc_req original_auth_crc_req;

unsigned int crc_spoof[]
{
        0x0, 0x1
};

__forceinline int32_t __fastcall *hooked_auth_crc_req*(void *p_this, int ecx, uint32_t *crc)
{
		return **original_auth_crc_req**(p_this, crc_spoof);
}

<aside> 💡 Here's a really basic way that let you copy the hashes from the crc array and copy-past it directly as C code.

</aside>

std::printf("unsigned int crc_spoof[]\\n{\\n	");
	
	int32_t return_to_line = 0;
	// loop through the elements of the array
	for (auto i = 0; i < 200; i++) {
		
		if (crc[i] == 0xFFFFFFFF)
		{
			std::printf("0x%X", crc[i]);
			break;
		}
		else
			std::printf("0x%X, ", crc[i]);
		
		if (return_to_line != 5)
			return_to_line++;
		else
		{
			std::printf("\\n	");
			return_to_line = 0;
		}
	}
	std::printf("\\n};\\n");