Sicheats (h4x0r) trainers now contain DRM but why?

[Joe Forster/STA]

Originally Posted by Maxgrilo

REAL ISSUE HERE -- the DRM. Apparently by the lack of any comment from GCW admins, this is perfectly fine behavior for files being uploaded to GAME COPY WORLD.

Which word of "Empire has a real life" don't you understand?! (He hasn't replied even to my posts in the private moderator forum!)

The DRM has everything to do with Cheathappens as it's supposed to be some kind of protection, although we still don't know for sure whether h4x0r's or his users' protection.

TippeX, how the hell do I "goto" in OllyDbg? I can't find anything other than code at offset 0006A462 in xpsupport.dll. Perhaps, a plain file offset would be preferred. I found "lsass" in ANSI at file offset 0000686A and in Unicode at 00007854 and 00007868, nothing else...

[Traziz]

Use W32Dasm if it makes it easier for you. Since it seems you can't fully use Olly correctly to show Data/String references.

And no I didn't use any amended xpsupport files, I used files from 3 seperate sources, one from sicheats (alice trainer), one from a link here given by cocodrila (fear 3) and one on GCW (fable 3).

I opened up in W32Dasm (xpsupport.dll) and was looking through the strings since people have been talking about the new DRM, just to check and I came across the 2 llsass instances (not lsass which is a legit Windows Logon binary). Then I also checked more into the trainers themselves, I had to unwrap them first, but then noticed the string references to vcltest3.dll, the uploading.com link. As provided by the screenshots.

Are you telling me you can't use Olly to find a simple string reference at all? Did you even try to look? From what I have seen from your responses is that you are more prepared to defend someone than be neutral and look.

Bad enough to be called a liar by Mr no understand the English, and then by you by saying I used modified files...

As far as I am concerned you are more an agent for Sicheats to try to veil the truth or something and keep things hidden or obscured.

I came here to ask why these things were in the trainer and the xpsupport.dll and to get some piece of mind so I can use them if they proved to be nothing, and all I have met is hostility and accusations, fine I will set up a virtual environment and run it there and perhaps I will post the results to show what files are created, what processes are accessed and created also.

[Joe Forster/STA]

Read my lips: WHERE ARE THE FILES YOU ANALYZED? ATTACH THEM AND GIVE US THEIR ORIGINAL DOWNLOAD URL'S!

(I never used OllyDbg but can use W32Dasm and Hacker's View fine, thank you, no need for taunting.)

[Traziz]

Originally Posted by Joe Forster/STA

Read my lips: WHERE ARE THE FILES YOU ANALYZED? ATTACH THEM AND GIVE US THEIR ORIGINAL DOWNLOAD URL'S!

Perhaps you should have read what I said, I downloaded the fear 3 trainer from this thread, which cocodrila posted a link to a "Clean" trainer.

And Fable 3 trainer from GCW, doesn't matter what server I use there as they all contain the same archive.

As for the trainer, I shall include the unwrapped trainer, since it seems to be minor worries from it from the vcltest3.dll and the uploading.com url use.

The xpsupport.dll is the main worry with the llsass reference and coding to produce it locally.

http://www.megaupload.com/?d=DQ9AGV1Z - alice trainer with unwrapped binary, incase you are not sure how to unwrap binaries.

That was originally got from sicheats themselves.

[cocodrilo]

Traziz please download IDA and look. is this your evil L?



in your file offset. in ida jump -> jump to file offset and COMPARE .

[Traziz]

That is close to what it is, but its not referenced as L"lsass" but llsass without quotes.

Besides I cannot "Download" IDA as it is expensive software and I don't steal software.

EDIT: I see a v5 for freeware on their site I shall check it out.

[cocodrilo]

can you understand that W32Dasm is outdated and can misinterpret the chains. As can display strings that are not. win32dasm Windows98 I used it at puberty. please download the version that indicated dbghelp.dll joe microsoft servers and compare them.

or simply tell me that part of code that does that harms you, you're doing because they do not understand.

this screen is from pseudocode interpreter from ida, please read this:

http://msdn.microsoft.com/en-us/libr...(v=vs.80).aspx

and search for wchar_t PLEASE, LEARN.

Besides I cannot "Download" IDA as it is expensive software and I don't steal software.

Ok, but download ollydbg and learn how to use it.

[Joe Forster/STA]

1. Perhaps, you should have read what I said: ATTACH THE FILES YOU ANALYZED! Did you attach them? No. Screenshots and lots of blabla and you think anyone will believe you? You're out of your mind!

2. Perhaps, you should have read what cocodrilo said: the download at hxxp://www.multiupload.com/ID3HMZBEXK is of unknown origin and may contain malware. It is a .NET executable with the vast majority of it encoded in a base64-encoded stream. It can be determined at a glance that it has nothing to do with Sicheats whose executables are not even similar to it. So, even if you're (allegedly) good at using OllyDbg, you cannot make even the simplest observations.

3. The Alice: Madness Returns trainer you uploaded to hxxp://www.megaupload.com/?d=DQ9AGV1Z is exactly the same package as the one on GCW, only reRAR'ed without compression (wtf!). You didn't uncompress any binary at all. (Or you mix up executables with compressed archives?!)

4. Both versions of F.E.A.R. 3 trainers on GCW use the original v6.12 dbghelp.dll renamed as xpsupport.dll. So do the two Alice: Madness Returns trainers (the one on GCW and the one you linked to). Actually, even the suspicious third F.E.A.R. 3 trainer (see 2.) does, too. This dbghelp.dll obviously never contained the string "llsass".

(If anyone doesn't believe something above, please, download the files and see it for yourselves.)

Traziz, I'm fucking mad but I give you yet another chance. In case you reply, do it very, very wisely!

[Traziz]

Originally Posted by Joe Forster/STA

1. Perhaps, you should have read what I said: ATTACH THE FILES YOU ANALYZED! Did you attach them? No. Screenshots and lots of blabla and you think anyone will believe you? You're out of your mind!

2. Perhaps, you should have read what cocodrilo said: the download at hxxp://www.multiupload.com/ID3HMZBEXK is of unknown origin and may contain malware. It is a .NET executable with the vast majority of it encoded in a base64-encoded stream. It can be determined at a glance that it has nothing to do with Sicheats whose executables are not even similar to it. So, even if you're (allegedly) good at using OllyDbg, you cannot make even the simplest observations.

3. The Alice: Madness Returns trainer you uploaded to hxxp://www.megaupload.com/?d=DQ9AGV1Z is exactly the same package as the one on GCW, only reRAR'ed without compression (wtf!). You didn't uncompress any binary at all. (Or you mix up executables with compressed archives?!)

4. Both versions of F.E.A.R. 3 trainers on GCW use the original v6.12 dbghelp.dll renamed as xpsupport.dll. So do the two Alice: Madness Returns trainers (the one on GCW and the one you linked to). Actually, even the suspicious third F.E.A.R. 3 trainer (see 2.) does, too.

(If anyone doesn't believe something above, please, download the files and see it for yourselves.)

Traziz, I'm fucking mad but I give you yet another chance. In case you reply, do it very, very wisely!

1. I did in the megaupload link.

2. "sicheats publish a clean trainers, with people reupload to other hosts binded..... PLEASE DOWNLOAD TRAINERS FROM SECURE SITES, LIKE SICHEATS OR GCW.

the link of this file is: http://www.multiupload.com/ID3HMZBEXK at te bottom in webpage post."

Are you telling me that says it is infected? He linked to the forum which was supplying the infected file then he said that (which I put in quotes above), looks like he was giving a clean file to me.

3. The alice trainer I got from SICHEATS was wrapped, never said I got from GCW. I got the fable 3 trainer from GCW.

4. That is what I was trying to say all along that it was not an amended xpsupport.dll at all and was trying to show from 3 sources that the files all contained the same coding.

Angry at me for trying to ask questions to ease myself and perhaps other peoples' minds on the trainers? Please remember Joe_Forster you attacked me and called me a liar just like cocodrila did, is this what sort of staff man these forums here? Moderators that attack users for trying to find peace of mind..

Damn sorry I came here, what a disgrace. Pffff Some help you give.

Come here and if you post anything negative about h4x0r's trainers you must be a cheathappens consort and a liar. Amazing. No wonder for the couple of days I have been here there has been little happening on the forum, just a couple of posts. Perhaps Joe_Forster has banned them all for asking wrong questions.

Go ahead ban me, I'd rather be somewhere with people who know how to treat people fairly and offer help.

[Joe Forster/STA]

Traziz, you are an idiot, so away with you!

1. The Megaupload link is a package that contains, to the byte level, the same files as the GCW download of the same trainer. You didn't attach anything, although I asked you many times. We're still yet to see an "infected" xpsupport.dll with the (alleged) "llsass" string.

2. Epic fail. You think it's cocodrilo's bad English that you don't understand him. Actually, you cannot read plain English either. Had you gone to the linked webpage (http://www.softsclub.com/games/97811...0-trainer.html, in case you cannot find it in the original post), which is in pretty simple English, you would've found out that the hxxp://www.multiupload.com/ID3HMZBEXK link, the one to the suspicious F.E.A.R. 3 trainer, is at its bottom. cocodrilo's reference to the Multipload link was not that this link is a genuine Sicheats trainer, it was some help with finding out the Multiupload download link at the bottom of the Softsclub webpage.

3. Again, no files attached. Yeah, this file is compressed, that file isn't; this file is encrypted, that file isn't; this file is .NET, that file is Delphi; this file is infected, that file isn't; this file contains suspicious strings, that file doesn't. But no actual files that would prove your points just plain bullshit.

4. [...] Oh, fucking great Lord in the heavens above, I finally understood what you meant. In xpsupport.dll/dbghelp.dll, at file offset 0006A487, there's a PUSH 03008468 which points to "lsass" in Unicode; at 0006A49F, PUSH 03008454 which points to "lsass.exe" also in Unicode. There are no extra L's anywhere around these strings. (And, even if there were any, this is an original Windows DLL from Micro$oft, protected by a digital signature, so how could it be infected?!) Another epic fail: you're completely unable to read code either, not even with the help of a disassembler.

From this above, it should be obvious that Traziz has absolutely no idea what he's talking about, while trying to look like an expert in assembly programming. Expert my ass! Permbanned.

[Maxgrilo]

Tippex: According to Joe, "The DRM has everything to do with Cheathappens" along with the current state of the global economy and the problems in the middle-east no doubt. This site's lack of caring by the admins and absense of any objectivity is truly amazing.

Go ahead and ban me too. I'll get my DRM-free files elsewhere. I'm done here. I invite others to do the same.

[Joe Forster/STA]

You know, the days when I reacted to name-calling have been over for years. Yes, the thread went astray but, if you take the time to read what I wrote then you'd know that, unlike people with opposite opinion, I make arguments and can show actual counterproofs to their assumptions and anyone else can check the truthfulness of what I wrote, by downloading the same files (they're still there!) and having a look at what I saw.

So the "This site's lack of caring by the admins and absense of any objectivity is truly amazing" sentence is completely false. You're making a fool out of yourself with it which is worse than becoming a martyr by getting banned so you can stay for a while...

[...] Actually, it is exactly objectivity that makes me ban people who have no idea what they're shouting around and are unable to stop their bullshit, even after several warnings. It seems, some people come here with a preconception, and they cannot be convinced otherwise, that Sicheats is nothing else than a bunch of liars distributing malware. This is their own conscience problem... but until they start spreading such rumors, without any actual proofs, in the public. Now, that is not and will never be tolerated here and the same zero tolerance should be (read: should've been) introduced in other forums, too, long, long ago. Then unfounded rumors wouldn't get farther than a few people around those interested in spreading bullshit. (In case someone didn't understand, I'm referring to Cheathappens, with their usual sly propaganda campaigns.)

[tazzoun]

Actually Joe, what I have witnessed in this thread is the opposite. h4x0r and his team come here stating that cheathappens has been uploading malware versions of their trainers to sites including GCW and this is the reason for the DRM, yet no one has asked them for proof of this, their word is taken at face value. However, when someone states that h4x0r might have done something himself to attack cheathappens trainers then that it when proof is demanded, and lots of it.

That's just my observation. Again, I could care less about all of this malware bullshit and really just want to know about the DRM issue, which still is not being addressed, it's just being blamed on cheathappens and dismissed.

[cocodrilo]

the issue of charges is more than demonstrated that the user in question was lying for some unknown reason.

no one accused anyone of raising false trainers, only gave a link to a page where they do.

as already a fact, if anyone has any proof of anything illegal in some haxor trainer you upload files and together come to a conclusion.

on the subject of DRM, if it sucks ... but right now there is the solution. There is an easy solution, if you do not like please not download trainers of sicheats. easy solution to easy problem.

Note that you can not force to release the trainers as you want, if you do not like the measure does not download them. make your own trainers.

[Joe Forster/STA]

During the whole Cheathappens vs. h4x0r war, we kept requesting proofs. Cheathappens stated that h4x0r is ripping off their trainers but were unable to present actual proofs, just kept smearing the "facts". We requested files for inspection, none were given. We requested download URL's for files for inspection, none were given. After one year, we received from Cheathappens a trainer, supposedly by h4x0r, as "proof" that turned out to be fake - by whom could it have been other than Cheathappens themselves? That was the final point where we decided we're not going to help Cheathappens in any way, whether or not their initial claim was true.

Some months later a third party called our attention to a document that turned out to be Cheathappens' file on h4x0r, with listings of code fragments from trainers of both parties, showing more than similarities. (Please, note that we still had no actual files for our own inspection!) Cheathappens' claimed they sent this document to us at the beginning of the war, which is not true. Whether they simply forgot to share it with us or this was intentional, we have no idea but it was too late anyway because our decision to not support Cheathappens for any reason was already made.

At the end, we're still here with a document that we didn't receive in time, an intentionally faked "proof" and megatons of quasi-facts and assumptions, supported by nothing else than just a document. I can write a document about anything, I repeat, anything. As the document is quite comprehensive and well-written, we assume, I repeat, assume that Cheathappens was right: h4x0r did rip off several trainers of theirs. However, there are still no actual proofs because the trainers that were analyzed to create the document weren't attached. (And, even if they were attached, the question could arise: okay, but couldn't some of them have been modified or faked, just like the fake proof sent to us before?!) The same happens here. Rumors, assumptions, accusations, and all without any kind of substantial proof. What "proof" is there is bullshit - if you don't believe me, go download the files, read what I wrote and check it out yourself.

Several trainers in h4x0r's name were uploaded to GCW, some even published before we were told about them. This has never happenned before so who could it have been if not Cheathappens or their friends? It is my assumption that this DRM was also an answer to Cheathappens' constant attacks. I have no proofs for this but, had you read our detailed announcements, you'd know that Cheathappens is capable of doing anything, I repeat, anything. I don't quite understand how you make conclusions so easily and so fast, without as deep background knowledge as e.g. I have. (And, no, you don't have to be me, you "only" should read our announcements.)

As for the DRM in itself, I don't like it and I strongly suggested h4x0r to remove it as soon as possible. However, it's his life, I cannot force him to make up his mind. As for whether GCW will or won't host Sicheats trainers, beause of the DRM, is solely up to Empire, I repeat, solely up to Empire, who has a real life and doesn't visit this forum every minute but is away sometimes even for days. That you people are so impatient and keep demanding answers makes me impatient, too. I won't let injustice remain unpunished but if you want us to punish Sicheats in whatever way we can then, by this, you also accept that you'll be punished if your accusations turn out be false. (Does the word "perjury" ring a bell?) I think this is the only fair way: whoever lies will not get away with it - at least, not here.

Now, since this thread, within a few days and pages, still hasn't managed to show a single proof about (genuine!) Sicheats trainers spreading malware, I'm more and more certain that this whole shit is nothing else than yet another propaganda campaign, started by whom else than Cheathappens, and lots of people fall for it because they are either unable (newbies like Traziz) or unwilling (Cheathappens' friends and their friends and their friends and... etc.) to verify the "facts" the rumors are about. Therefore, from now on, people making assumptions without actual proofs that can be verified by anyone (attach files, include download URL's, describe a guide on how to find the malware), I repeat, anyone, will be banned on sight because I've had enough of unfounded accusations! (I now understand that my greatest mistake here was letting this thread to continue farther than the first few posts at which I was already suspicious.)

tazzoun, if you claim something and want me to accept it and act accordingly, it's fine, but then you should've already started your request with presenting the proofs. You want something from me? Good, tell me why I should do anything for you. Got that? Have you given me any proof that could be verified by us and, thus, supports your claims? No. You wrote that the F.E.A.R. 3 trainer of h4x0r:
1. Needs authentication. Verifiable and true. Consequently, noone questioned this statement.
2. Contains malware, scans memory and hard disk, searches for "cheathappens", infects/damages whatever it finds. Verifiable but all samples so far support false and we received neither (other) samples nor more detailed descriptions of the malicious behavior from you.
3. You cannot use h4x0r's newest trainers from GCW until you get a personalized key for it. Verifiable and true. However, let me add that, interestingly, you cannot use no-CD patches from GCW either without actually having the game that you're supposed to buy - preferably beforehands. Also, you cannot play games - or can only play in demo mode - you downloaded from Steam or whatever "digital download" service before registering and buying a license. Now, should GCW and Steam etc. remove all downloads because they can't be used as such?!

Not only I requested actual files for my own inspection from you, and several times at that, in vain, I answered all your claims, still you can't or don't want to accept them. Have you heeded my requests? Nope, none of them. Have you uploaded the (allegedly) infected trainer? No, just keep talking about it. Have you explained how and where the trainer is supposed to search for what and does what upon finding it? No, just "memory" and "hard disk" and "cheathappens" and "attaches viral signature" and "hidden process" and "does nice things", nothing concrete. Then what the fuck do you expect from me/us?! Have you made at all observations or haven't you? I have to say you haven't because you were unable to say anything other than just vague assumptions. If you can't make observations because you don't savvy this particular field then let me ask: how dare you question the inspection results of someone who does savvy?!

Traziz also kept pouring the general bullshit but was unable to show actual files. And this went on for like a dozen post. When he managed to present something, it was an obvious fake as its major difference from the usual outlook of Sicheats trainers was determined at a glance so either he tried to fool me or he was helping someone who tried to fool me. Either way, when I got fed up with his blabla, he got permbanned. Why was I trying to find out what he's trying to say when we wouldn't utter it? And the question remains: A) was he this dumb or B) was this just an orchestrated show, trying to fool us as well as the public? With most probably Cheathappens in the background, I'd vote for B).

During the whole Cheathappens vs. h4x0r war on our forum, 1) Cheathappens was unable to show proofs and 2) started a campaign against us because we wouldn't comply with their requests, sent us a fake proof and even (allegedly) hacked our site. (You can read about all this.) From this, you can conclude, that 1) h4x0r may or may not be a code thief (no proof) but 2) Cheathappens is definitely a bunch of arrogant, unscrupulous guys who won't hesitate to resort to immoral and, sometimes, even illegal measures to "persuade" others into believing what they say or to discredit their opponents and make the public turn away from them (lots of proofs).

Their "only" bad luck is that, in us, they finally met an opponent that is much harder to break (let's not use "persuade" as that would be a major euphemism) than others so far. I'm not surprised that people didn't understand if and how this is possible and thought that Cheathappens, "as always", was right this time, too, and the opponent, "as always", wasn't, even after 1) actually disproving some of what Cheathappens stated, 2) showing that some proofs do not prove the claims that they were supposed to prove (an overdone example: "Earth is round" does not prove that "today is a rainy day") and 3) listing all the rest as unverifiable, due to lack of more detailed information and/or actual, genuine, 100% original, unmodified files. But that's their problem, not ours. We still go to bed every night without conscience problems because did not let ourselves be fooled by ever bolder lies.

So, tazzoun, do you have anything concrete for me? (Don't you know what I'd like to get? Then go read back my previous replies to you: they are in plain, simple English.) If you do, now is the time to present them. If you don't, you're just blabbering around and questioning the findings of someone who did delve into the code. But let me remind you, the latter I won't tolerate because it's remarkably close to one of Cheathappens' weapons of mass destruction: discrediting the opponent. And, if you don't agree with something I said, fine, argue then, explain why (you think) I am wrong, and I'll answer but saying "you don't want to do anything about it" etc. is very far from enough, it only shows your ignorance, not mine.