Announcement and final word on the CheatHappens vs. h4x0r trainer war

Joe Forster/STA · #1 15-03-2010, 06:18

(Typos and small missing details are being fixed in the posts constantly as they're noticed but no relevant information is changed or removed...)

It started with people simply complaining on our forum (why?!) that CheatHappens are selling their trainers and that this is not nice, trainers should be free and fully functional blabla. Our answer was that it's not their right to tell trainer authors under what conditions they should distribute their creations. That was no help for CheatHappens, only trying make sense among "freebie bastards". Then these complaints got more and more frequent and a forum sticky was created, telling people to stop these complaints as they will result in a punishment. Of course, the complaints still went on - some people just cannot shut up and some cannot even read - but their posts were only deleted and more serious punishments were rarely given, if ever.

(2009-03-27) Then came a new situation. CheatHappens accused the trainer makers called KelSat and h4x0r of having ripped code from their trainers. Their claim was that this thief gets access to their forum, downloads their trainers, dissects them and copied the most important, definitely non-trivial code fragments into his own; see http://fileforums.com/showthread.php?t=86218. There you can see that immediately proofs were requested so that we can inspect the claimed code theft ourselves. None arrived. Then we requested a list of the affected trainers. None arrived. Read the thread through: we were offering support to CheatHappens as soon as a proof arrives that we can check ourselves. Several days later, even Empire posted into the thread, again requesting a proof. Empire is already seen here stating his principle that GCW is willing to host any kind of trainer, whether promo or fully functional, but respecting the authors. We also recommended CheatHappens to put "fingerprints" (code that doesn't do anything useful but is added inside useful code) into their trainers and watch whether or not they appear in the code of stolen trainers.

In the meantime, the bitching about promo/fully functional and free/paid trainers and abuses against either side went on in this thread, too... We felt the situation was getting out of hand but the decision of what to do was pretty hard because we had to stay impartial as possible - let me repeat: still no proofs! - but try to keep the discussion in a non-abusive manner. See my posts, trying to calm down the CheatHappens side while telling them that, yes, I agree that code theft is not acceptable - like trying to navigate between Scylla and Charybdis. The thread was closed a week and a half later and look at the last post: still no proof arrived from CheatHappens.

(2009-04-09) Then h4x0r appeared, too, on the forum. He started announcing his trainers, one by one, on the forum. See http://fileforums.com/showthread.php?t=86315, http://fileforums.com/showthread.php?t=86331, http://fileforums.com/showthread.php?t=86301, http://fileforums.com/showthread.php?t=86271, http://fileforums.com/showthread.php?t=86333. Although this per se was not against the then current forum rules, the threads were later closed as we understood that the reason for these was to annoy CheatHappens rather than to help people. Also, most of these threads turned into a flame war already in the first few posts or some tricky questions arrived from the experts, trying to make h4x0r make a mistake that would prove that A) he did steal code from other's trainers and/or B) he doesn't know what he's doing so his code must be from somewhere else.

(2009-04-06) In the meantime, h4x0r received a PM from Empire (our administrator) which said GCW will not host trainers that contain stolen code. See http://fileforums.com/showthread.php?t=86277. This was the first thread in which h4x0r first showed his awfully broken English (actually machine-translated Spanish, as we learned later) which... khm... didn't do much good to the communication between him and everyone else, to put it mildly. He kept defending himself, saying that he ripped nothing at all. However, the tricky questions about his abilities were completely in vain because he didn't understand the questions or, when he did, we didn't understand his answers.

(2009-03-29) In the background, we (Empire, TippeX and I) were discussing things and agreed that trainers with stolen code should be removed but only if a proof is shown. (By the way, PWizard requested information about h4x0r in PM so that his CheatHappens account can be determined and banned but he was given none as that would've been giving out personal data to a third party without an obvious reason.) In that thread, I already mentioned the possibility - if I remember correctly, by suggestions from the threads so far as well as PM's from some forum members - that we might be experiencing a tricky advertising campaign from CheatHappens. With my paranoia reaching the heavens, I even suspected that it is exactly the opposite that is true: it is CheatHappens stealing code from others, then accusing them of theft and the two codes are obviously the same - but never mind me.

Also, my acting of "I'm a programmer but I don't know too much about hacking so, please, bare with me and explain things thoroughly" started here - and it definitely paid out, as you will see. In the meantime, h4x0r has been sending taunting PM's to CheatHappens people in our forum but he has been threatened with a ban if he doesn't stop as, even if we did not accuse him of anything, this behavior should not be tolerated. CheatHappens people also have been asking us in PM's about why nothing is done against h4x0r's messages (probably not only PM's but also ones in the public forum). PWizard also told us that he probably found h4x0r's account on CheatHappens and the fact the he has an account and he is able to download their trainers kind of suggests that he rips code from them (excuse me?!). And h4x0r requested his account to be deleted so that there will be no more problems; my answer was that this is not necessary because our investigation about the code theft has not been closed yet. All the people who took part in the war were threatened in a PM with instant ban for posts expicitly advertising trainers, linking to promo trainers or harrassing other forum members. h4x0r was also asked to upload his trainers to GCW which he agreed with but did not wish to return to the forum. This was also when his trainer announcements were all closed in one go.

(around 2009-04-10) TippeX finally got a message from CheatHappens, pointing to the World in Conflict: Soviet Assault v1.010 trainers. Please, note that no actual trainers were sent, only telling us which ones to check. TippeX downloaded the CheatHappens trainer from GCW and compared it to a trainer from KelSat for the same game, also downloaded from GCW. The spectrum of options was at most similar so TippeX chose one option that was supposed to work mostly the same way (Freeze Clock in CheatHappens' against Increase/Decrease 1 hour in KelSat's); the code for them turned out to be implemented in completely different ways. I wasn't suprised in the slightest at the results; what I was surprised at was that TippeX was not told what specific part of which specific trainer to check. There you have it again: no actual verifiable proofs, just general ideas. Our suspicion was rising more and more and we found ourselves all moving away from CheatHappens' side, sympathizing more and more with h4x0r instead.

(2009-04-17) A week later, TippeX received a link from PWizard to the full version of CheatHappens' trainer and was specifically told to check the Free Camera Mode option. In the meantime, all of us was getting very impatient because time was working against us: h4x0r was complaining, CheatHappens were complaining, forum users were complaining and we were still without clear results. Caliber showed something like a proof in another thread - unfortunately, I seem to have permdeleted it in my anger so I cannot quote anything about it anymore - but 1) I couldn't understand much from it and, 2) yeah, I can also write two similar code fragments myself and then be as damn smart as being able to show the similarities between the two. TippeX, an expert, however checked the explanation and reckoned that 1) h4x0r seems to have stolen the method in this case but implemented it differently and 2) it is suspicious how h4x0r found the right method that Caliber could explain and h4x0r couldn't. However, this was still not what we wanted: CheatHappens seemed to still have not understood that we want two genuine, untouched, (freely?) downloadable, working actual trainers whose code we can check ourselves - and our suspicion was ever growing that this is intentional. (Personal note: If a serious programmer says to have never lifted, at least, small code fragments or little non-trivial ideas from other programs then he or she is simply lying: noone can resist the temptation of sparing time by not reinventing the whell by himself or herself. By the way, open source software solves this problem automatically: lifting source is not only not forbidden but actually recommended. Also, it is not possible to "patent" outlook so, please, don't make yourself ridiculous by claiming theft by showing two screenshots: I wrote a fully-featured - and some more - Norton Commander clone in Borland Pascal that, of course, has nothing to do with the original in terms of implementation, still it looks, moves, smells and feels like the original.) At this point, we recommended CheatHappens again to place a "fingerprint" in one of their upcoming trainers. (Some time later they reported to have found their fingerprint in h4x0r's code but, of course, no proofs this time either.) In the meantime, h4x0r reported to us to have finished his Need for Speed: Undercover 1.0.0.1 +11 trainer, with options that don't exist in other trainers. This also applied to his previous trainers which suggests that, even if he does steal ideas from other trainers, he is also able to add ones of his own. We then discussed the possibility to ban all trainer announcements on the forum because we couldn't find the proper set of rules that would benefit everyone. A few threads, with some direct or indirect bashing, came and got deleted soon.

(2009-07-13) Then arrived another accusation from CheatHappens: that h4x0r has stolen the code of Cheat Engine and based his own engine on it, without giving credits to the original author. See http://fileforums.com/showthread.php?t=87262; thread undeleted for your viewing. TippeX raised the question of why this came to light this late, with the suspicion that this is yet another fake accusation, but no answer came. Then the accusation changed to h4x0r having used freely available source code without giving credit to the author, which was not required and so this means h4x0r is at most a jerk but definitely not a thief. CheatHappens (and fans) again seemed to be doing their best to find a reason, whatever it is, to discredit h4x0r. Flames were getting high as several forum members joined, some defending h4x0r, therefore the thread was closed (and later, deleted, too). A few threads were opened, bashing CheatHappens for their business strategy as well as h4x0r putting a too high number of options into his trainer releases, otherwise things seemed to become quiet. During the next few months, even some long threads were created, with useful discussion and (almost) everyone was happy.

(2010-02-06) On a side note, a link to CheatHappens was posted where "h4x0r" admits that the accusations were true. See http://www.cheathappens.com/show_boa...4&titleID=8463. If from nothing else, it should be obvious from the too good English that it couldn't have been written by h4x0r himself, it is a fake. (In case CheatHappens deletes the thread, you can view "h4xor"'s post below in this thread.)

(2010-02-11) But the war was still not over. It was reported that h4x0r's trainers drop suspicious DLL's all over the system. See http://fileforums.com/showthread.php?t=89027; all posts undeleted for your viewing. Empire was faster than I and asked for specific trainers. None were given and the smearing of quasi-facts started again, not only from CheatHappens but also from their fans: this wasn't just a general report, here's a screenshot for a proof (are you kidding?!). I mentioned that cracktros also drop a few DLL's, e.g. often bassmod.dll for playing music, but these are harmless and asked Caliber to send me some material: one of his trainers and one of h4x0r's, too. Caliber refused, saying that there's no point in it because we would not consider his proofs this time either. In the meantime, it was also reported that something in h4x0r's trainers, namely the DLL dropped to C:\h4x0r.dll, seems to interfere with CheatHappens trainers. Unfortunately, this thread turned into a flame war, too, so it was closed.

(around 2010-02-17) I sent a PM to Caliber, literally begging him to send me some material because if there really was substantial proof that h4x0r is messing with CheatHappens trainers then the war could be finally over. (After all, this was our goal, too, from the beginning.)

(2010-02-20) I had the feeling my request would be refused again but, no, I received a PM from Caliber with instructions on proper testing as well as a package of trainers to my E-mail address. Completely unbelievable but true: after almost a year, a real inspection could be made. I was so excited that I finished my inspection within half a day but I didn't publish my findings for weeks as I was waiting for TippeX to do his own investigation, too. Unfortunately, because of lack of spare time, he couldn't even start it so you'll have to do with mine. ([...] Not true. We waited for him to finish it. See below.) Although I told Caliber that I wouldn't distribute the CheatHappens trainer, after what happened recently, I can break my promise without any conscience problems for the benefit of the public. You can find the packages and the E-mail, exactly as I received them, below so you can check our findings yourself. (Note that Caliber talks about h4x0r's Bioshock 2 trainer but it is actually h4x0r's Bioshock trainer that is used for the inspection.) Feel free to run h4x0r's "malicious" trainer, too, as it isn't malicious at all (see below). (If you're afraid, run it in a sandbox. If you're really afraid then copy any DLL into C:\h4x0r.dll manually instead. If you want to have a look at it without running the trainer itself, you can find it attached, too.)

Let's take Bioshock v1.1 + 10 Trainer.exe (the trainer - supposedly - by h4x0r) apart. At offsets 0x00000000-0x00001E7F, there is a prefix that creates C:\h4x0r.dll and decrypts and executes the real Bioshock v1.1 + 10 Trainer.exe. You can think of this prefix as a wrapper around the real trainer. It containts some other funny strings but see it for yourself. For a comparison, I downloaded about two dozens of trainers from http://www.sicheats.com/forum/forumd...eats-All-Games that day (from the same thread list page as this trainer, EXE timestamps = release dates between 2009-09-22 and 2010-02-01) and all of them were plain uncompressed, unencrypted Delphi code so this trainer already sticks out of them. (Note that you cannot download attachments from www.sicheats.com unless you're a registered user.)

It doesn't take a genius to find out that the encryption is actually XOR'ing the part at offsets 0x00001E80-0x0021292D with 0x86 and you'll get the real trainer. Now, if you download the same trainer from http://www.sicheats.com/forum/showth...r-STEAM-RETAIL (in case you can't download it, it's attached, too, named "REAL"), you will find out that they are exactly the same. (Well, the one that was encrypted is a byte longer, probably for padding to an even number of bytes.) This extremely lame way of encryption is weird as it wouldn't stop even a novice hacker.

It was reported that h4x0r's malicious trainer drops the h4x0r.dll, scs.dll, scx.dll, game.jpeg files and the skins subdirectory into C:\, the sicheats.dll file onto the current user's desktop and the chip.dll and pvt.tmp files into the Windows SYSTEM32 directory. If you run a HIPS (e.g. one integrated into some capable virus scanner or firewall software), you will see that, of these, only C:\h4x0r.dll is true, none of the other files are created even if there's reference to them in the code. (Probably common code/data for all trainers: some use it, some don't, but the data is compiled into all of them.) If you instruct your HIPS to not allow anything other than direct screen and keyboard access, the trainer will still run perfectly, even if it couldn't create C:\h4x0r.dll.

Now let's see C:\h4x0r.dll. If you compare it with the end of the "malicious" trainer, from offset 0x0021292E, you will see that this suffix starts exactly with the contents of C:\h4x0r.dll. However, there is no possible way that the dropped DLL can function at all as is because it only has a relocation table and an import table but both point into junk (probably, encrypted and/or compressed code/data) so neither are valid and there's no code or data segment. Also, a recursive scan in your complete Windows directory structure as well as the registry will show that this DLL is not registered anywhere but Sysinternals' Process Monitor will prove the same by not showing anything related to this DLL when you run other programs.

And have you looked at the icons inside the "malicious" trainer? One of them is a PNG file, at offsets 0x0021AB08-00227110. Why would h4x0r put such icons into his own trainer? Or where could they really have come from? Quite obviously, the suffix is actually an executable from CheatHappens that was damaged here and there on purpose.

By the way, see h4x0r's reply to all these claims at http://www.sicheats.com/forum/showth...d-hidden-files.

Now, with C:\h4x0r.dll finally in place, let's have a look at bio2-Joe_FileForums.exe (the trainer by CheatHappens). (Please, note that it seems to do some kind of online authentication. In case it refuses to work, because the CheatHappens account it is tied to has been banned, we will surely find a way - and publish it here - to make it possible to run the trainer for testing purposes.) Yup, it doesn't work but that was expected. Delete C:\h4x0r.dll and run CheatHappens' trainer again. Now it works. Wow! Launch Process Monitor and have it monitor everything that the trainer does. You will see that hundreds and hundreds of file and registry entries are accessed before there's a reference to C:\h4x0r.dll so it cannot be the operating system fetching the DLL because it is registered somewhere to be launched along with some programs. (Not that it could've been run as it is not a valid executable image anyway.) No, it is CheatHappens' trainer actively searching for this file.

Hack h4x0r's trainer, changing the file name of the DLL to be dropped to C:\h4x0r2.dll. CheatHappens' trainer will run although the "malicious" content has supposedly been delivered and the system "infected" with it. Simply by changing the file name, CheatHappens' trainer works again. This isn't surprising if we accept the fact that the operating system has nothing to do with all this but it is the trainer itself that checks for the presence of this dropped DLL. Actually, you can copy anything into C:\h4x0r.dll (say, C:\boot.ini, your favorite wallpaper, a HTML page, whatever you like) or create an empty file and the CheatHappens trainer will cease to function. Remove the "malicious" file and the trainer will work again. If you create such an unusable C:\h4x0r.dll file on a "virgin" machine, that has never been touched by h4x0r's "malicious" trainer, then CheatHappens' trainer will not work. Remove the "malicious" file and the trainer will work there, too. Isn't that cute...? BUT IT'S WROOONG!

As I wrote above, my acting of looking innocent paid off. CheatHappens took me for a fool which I'm not. While I may not be able to code seriously in assembly under Windows, I hacked many Windows programs so far.

Also see the results of TippeX's investigation in another post of this thread as well as my quite conclusive list of the so-called "malicious" DLL's dropped by varios h4x0r DLL's in http://fileforums.com/showthread.php?p=383796. The conclusion from all sets of results is obvious. h4x0r has been accused on three accounts:

Theft of code from CheatHappens trainers. TippeX and others agree that probably ideas were stolen, maybe, code fragments, too, but this is impossible to prove with 100% certainty.
Theft of code from Cheat Engine. By definition, you cannot steal from an open source software. Period.
Dropping DLL's with malicious intent, including making CheatHappens trainers non-functional. The malicious trainer was fake, created by CheatHappens, and the CheatHappens trainer was also intentionally modified to complain about the mere presence of a file.

Even if h4x0r may not be a "lamb born today" (a hungaricism, means "as clean as possible"), CheatHappens has been trying to discredit him in all kinds of immoral ways, multiple times, on multiple forums. They are completely unscrupulous about their ways of trying to kill their competitors off the market. We also have the strong suspicion and it has also been suggested by others that this was neither the first nor the last time CheatHappens ran such a false propaganda campaign against someone so be wary as now you know that you can never know when they're telling the truth and when they're lying. And, people at CheatHappens, please, forward my good wishes to your fucking lawyers, too! (See the bottom of http://fileforums.com/showthread.php?p=383485.)

(2010-03-06) The forum has been hacked, exploiting a security hole in the vBulletin software, and unsolicited advertising of trainers, most along with filthy messages, have been posted in the names of random users. vBulletin has been upgraded since and probably the security hole closed, too. ([...] h4x0r reported that his vBulletin 4.0.2 PL1 still contains the exploit. I asked Empire to contact the authors as, if I understood correctly, this forum is running on a licensed, paid copy of vBulletin.) Also, the contents of the forum are backed up daily so if there's an attempt that really brings the whole forum down, it will only be temporary. However, this doesn't matter much. By hacking the forum, the "unknown" hacker - who stated to not be be a member of CheatHappens - proved that he's not only immoral, like CheatHappens is, but goes even further and has no problems with entering cyber criminalism which is already a legal term. If you come back again and we're able to trace you back, you may have to face legal action. Also, we're not going to be afraid of you and we won't give in to your threats because we don't accept what you suggest: that, if nothing else works, violence is the ultimate answer. That kind of "solution" is for neanderthalians and terrorists, not homo sapienses. For this reason, you may have won a battle but you already lost the war when you fired your weapon for the first time.

(2010-03-07) Several fake trainers were uploaded, for different games, by different (fake) authors but with similar contents. We found out that such fake trainers have been uploaded for the last month and they were even published on GCW as noone knew about the possibility back then. As far as we can tell, CheatHappens was probably not (directly) behind this but you can never know for sure. This was most probably also the reason for people complaining on the forum about h4x0r's trainers, downloaded from GCW, crashing. The fake trainers have been replaced with their real counterparts by now and we asked h4x0r to upload his trainers himself - no trainer submissions will be accepted in his name from anyone else so, please, don't bother.

From all this above, it may not be obvious whom to side with but it is very obvious whom to not side with. Please, spread the word on all forums and feel free to link to this post for explanation.

Also, note that, as our first priority is the benefit of our visitors and we're still trying to be as impartial as possible, GCW will continue to host CheatHappens' (promo) trainers although they (CheatHappens, that is) don't deserve any kind of support anymore.

This is the last time we deal with this war with which we already wasted way, way too much of our resources. Further discussion of it is prohibited all over the forum: anyone breaking this rule will be banned on sight for a few months, without any prior warning; subsequent attempts will raise the length of the ban until we get bored and change the ban to permanent. We're trying to forget that all this shit ever happened and so should you. Thank you for your attention.

Joe Forster/STA · #2 15-03-2010, 06:19

Bioshock_v1.1_+_10_Trainer_REAL.rar

Compiled using delphi - cheatengine usage is obvious
check file offset 0x50 (80 decimal) - this is where cheatengine stores the pointer to its 'data'
in this trainer, its located at 00 F8 20 00 = 0x0020f800 as the file offset, this is easily verified

0020F800: 22 23 02 00-07 00 00 00-0E 00 00 00-01 00 00 00 "#☻ • ♫ ☺
0020F810: 31 06 00 00-00 49 6E 73-65 72 74 2D-00 00 00 00 1♠ Insert-
0020F820: 00 00 00 00-00 00 00 00-00 06 00 00-00 37 13 AD ♠ 7‼¡
0020F830: DE 00 00 00-00 00 00 00-00 00 00 FF-00 00 00 01 Ì * ☺
0020F840: 00 00 00 00-00 00 00 88-02 00 00 5A-47 4D 45 47 ê☻ ZGMEG

022322 = cheatengine 'tag' for memory trainer, 'protected' (ie: can't be opened in cheat engine to view its 'work')
and yes, its easily bypassed (changing to 022222 works partially, 111111 is the value used to do a file patcher)..

now, look at the import table, there are multiple entries for dll's of the same name - this is a typical characteristic
of delphi..

Linker version is 2.25 in the PE header- again.. typical of delphi..

manifest information is..

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<assemblyIdentity
type="win32"
name="DelphiApplication"
version="1.0.0.0"
processorArchitecture="*"/>
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="requireAdministrator"/>
</requestedPrivileges>
</security>
</trustInfo>

<dependency>
<dependentAssembly>
<assemblyIdentity
type="win32"
name="Microsoft.Windows.Common-Controls"
version="6.0.0.0"
publicKeyToken="6595b64144ccf1df"
language="*"
processorArchitecture="*"/>
</dependentAssembly>
</dependency>
</assembly>

------------------

Bioshock_v1.1_+_10_Trainer.rar

Well, for a start, we can see this exe is NOT delphi compiled - its coded in c..

the cheatengine pointer is also NOT present
cheatengine data is also NOT present (did a search for it)..

Linker version is 2.50 - i've never seen this before in a delphi exe

Import table does NOT have multiple entries for the same dll's of the same name
msvcrt.dll is also imported - this is DEFINATELY NOT a delphi executable

Rich information is also removed in the pe header - probably to reduce any possible method of fingerprinting the origin
typically the c compiler does NOT remove this information...

manifest information is.. (note - only 0xA is used here, NOT 0xD 0xA for cr/lf... bit strange)

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>◙<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">◙ <assemblyIdentity◙ versi
on="1.0.0.0"◙ processorArchitecture="X86"◙ name="CompanyName.ProductName.YourApp"◙ type="win32" />◙ <description></description>◙ <dependency>◙ <d
ependentAssembly>◙ <assemblyIdentity◙ type="win32"◙ name="Microsoft.Windows.Common-Controls"◙ version="6.0.0.0"◙ processorArch
itecture="X86"◙ publicKeyToken="6595b64144ccf1df"◙ language="*" />◙ </dependentAssembly>◙ </dependency>◙◙</assembly>

icon is also for CH.....

------------------

initial overview

from this initial analysis we can see that both exe's were coded in ENTIRELY different languages,
the fake trainer is NOT even using cheatengine code...

entrypoint of fake trainer code is..

.00401000: 6838000000 push 000000038 ;' 8'
.00401005: 6800000000 push 0
.0040100A: 68D0BD6100 push 00061BDD0 --↓1
.0040100F: E80C100000 call memset --↓2
.00401014: 83C40C add esp,00C

using memset.. delphi wouldn't do that...

the program then tries to launch a file from the temp folder..

0017FD8C 02950598 ASCII "C:\Users\Admin\AppData\Local\Temp\Bioshock v1.1 + 10 Trainer.exe"

(which did not exist on first run)..

00402482 |. FF15 5CBB6100 call dword ptr [<&KERNEL32.CreateProcessA>] ; \CreateProcessA

is where its done..

it then tries to do a ShellExecuteExA...

004025DE |. FF15 90BB6100 call dword ptr [<&SHELL32.ShellExecuteExA>] ; SHELL32.ShellExecuteExA

0017FF50 00402A46 /CALL to CreateFileA from Bioshock.00402A44
0017FF54 00405057 |FileName = "C:\h4x0r.dll"
0017FF58 C0000000 |Access = GENERIC_READ|GENERIC_WRITE
0017FF5C 00000001 |ShareMode = FILE_SHARE_READ
0017FF60 00000000 |pSecurity = NULL
0017FF64 00000002 |Mode = CREATE_ALWAYS
0017FF68 00000080 |Attributes = NORMAL
0017FF6C 00000000 \hTemplateFile = NULL

this fails if uac is enabled (drive protected)... so i had to force the code to dump the dll to another location
the code also tries to make the file hidden, and has a bug later on where it does a SetFileAttributesA (hidden) with
a null pointer for the filename (which obviously fails)..

the h4x0r.dll is definately packed and not a 'normal' executable..
the import table is BAD.. and on my machine at least, the dll would NOT load..

Joe Forster/STA · #3 15-03-2010, 06:20

Date: Sat, 20 Feb 2010 00:36:11 -0500
From: Mike Yurgalavage <mike(at)cheathappens(dot)com>
To: sta(at)c64(dot)org
Subject: trainers (i resent this again)
Parts/Attachments:
1.1 Shown ~33 lines Text (charset: ISO-8859-1)
1.2 OK ~41 lines Text (charset: ISO-8859-1)
2 1 MB Application
3 579 KB Application
----------------------------------------

instructions again
============

WHAT YOU NEED
============

1) CH bioshock trainer (included, and encrypted, i d/l this right off of our site TODAY and renamed it. i don't have to tell
you this but plz do not share this, it is encrypted)

2) hax0r's bioshock 2 trainer (included in original rar)- we either downloaded this back in january from your site or from
his site. didn't know at the time what it was doing. we like to examine his trainers for copying, etc.

3) you need a running version of bioshock 2 (our trainer is for 1.1), OR you can copy notepad.exe and rename it to
Bioshock2.exe and run that instead, since both trainers look for that .exe.

HOW TO TEST
===========

1) run game (or fake game notepad)
2) run CH trainer FIRST, press F1 to activate, press numpad keys to hear them working
3) stop CH trainer
4) run hax0r trainer
5) stop hax0r trainer
6) run CH trainer keys, F1 to activate, keys then don't work, trainer is no longer functional
7) you can delete hax0r's trainer, restart the game, reboot, etc. it don't matter, our trainer is broken
8) remove hidden .dll in c: drive, reboot, THEN the CH trainer seems to work again.

Joe Forster/STA · #4 15-03-2010, 06:20

From my personal bio:

Hi,

My name is h4x0r, AKA Xblade, AKA <insert countless other aliases here>. I like in Spain, and don't speak very good english. Therefore half the time I find myself using free online translators and winding people up unintentionally with garbled gibberish. I've woken up this morning though with the gift of speech so I though i'd post in here.

A bit of background on me. I started off doing the odd lame trainer in cheat engine, both training and creating the release within the software. I didn't feel this was enough however, so I later decided to try and get into a team. One such team was eXtalia and later RADiANCE. However, I was quickly rejected due to not being able to tackle certain trivial objectives, such as code-shifting, one-sided options or doing my own self-coded release in some language. Actually, i'll rephrase that. I wasn't even willing to try and learn more advanced concepts (we'll come on to that later) and I couldn't be bothered to do a release even in plain old VB.

As a result of this bumpy start, I decided to take another, more lame approach. I took the cheat engine source, hacked it about a bit and basically used all of it's pre-done engine to do my work. So these days all I do is create up the cheat tables and injections in it, and use it's trainer builder to output my customized CE releases. I, of course credit Dark Byte for the contribution, although I didn't do this at first. It took a few people to complain before I decided to add a measly credits line in there. Dark Byte being a nice guy deson't really mind what is done with his software and I admittedly took advantage of this.

So anyway, I now use this to do my release, but even with all this powerful engine behind me, I still only manage to produce sub-standard releases, with pointless options, or hardly any options, and probably most importantly non-working options. I usually grab a game as fast as I can and rush to be the first one to release (not like anyone cares about this mind) and in my haste I tend to have to produce a fix pretty quickly. I would think at a guess that my last 10 or so trainers have needed such fixes for fatal flaws.

Other than trying desperately to gain some popularity, another reason why I strive to get a release out as fast as my spanish fingers can work, is so that I can attempt to cover up the fact that I have ripped/and continue to rip other hard working individuals work. My latest Cursed Mountain release was put out before most other releasers even had the title on their hard drive. One of these people being CH. I figured if I could put out my release first, then I had some weight behind me for when they released theirs. And sure enough when they brough theirs out I could accuse them of ripping, which I went on to do. That made me feel very tough and superior. I proceeded to quitely amuse myself in the corner of my bedroom after that.

Don't worry though people, because it will be very obvious when I rip, and most of you are all already aware of this. For example I have stated on my board many times that I cannot beat certain titles with tricky game engines, and I tend to leave enticing notes such as "I'll work on this soon" or "I'm working on something now" in an attempt to lure people back to what is just a pure fail release. A notable engine being Unreal Engine by the way. I had to apologise to people for not having a good release out for that; at least not for over a week of having the game installed, much luck and overall invaluable help from the cheat engine forums (particularly Dark Byte). After all, I did end up using his pointer paths and code injections which he freely posted over there. Again, because he's a nice guy I take advantage of the fact that I can use his work without any sort of extra credit there. Oh, and that's another thing I do a lot of, and is poribably why half my hacks don't work most of the time; pointer paths. This is another testament to the fact that I rely so heavily on built-in tools. A lot of the time I can't split out options, even the most simple ones, and so in these cases I resort to using Cheat Engines pointer-scanner feature. It really is quite handy; a bit like a get out of jail free card, but in a gamehacking form.

So, that just about covers all the key areas of my trainer-life, which just so happens to also be my real-life too. I don't do much else. I don't really have any friends, though I pretend to (but even they are just virtual creations in my dark void of a brain; no pun intended, I'm aware that was a recent game). All of this rejection and feeling sorry for myself eventually led me to found my own website and start posting my SP releases on there. You can find that over at: www.sicheats.com. Be aware though that I only offer SP releases by the dozen, in order to attract paying members for my lame MP hacks. Again, because i'm such a drop-out and no-hoper, I feel compelled to cheat against real people online. After all this I really don't understand why people can hate me.

A final point would be that I am quite the hypocrit sometimes. I mean, I give groups like cheathappens and people like [apache] and [sheep] constant grief for paying members and premium releases, yet at the end of the day i'm trying to sell my own. I thought I might as well lay it all on the table and show you who I really am. Another reason why I currently run my own site is because I love the amazing power-trip. Admin on my own site, with masses of pre-teens posting and bigging me up, what could be better. This is surely all I need to drown out my guilty conscience and failures as a human and get though life right?!

Live long and prosper (I couldn't even think of a decent outtro, so I had to borrow one from Star Trek),

H4x0r

Joe Forster/STA · #5 15-03-2010, 08:21

And now some correspondence with CheatHappens... (Will be updated continuously, if needed.)

2010-03-15 ~04-05 PM UTC

Quote:

Originally Posted by Joe Forster/STA

Hi Caliber,

I think you had ample time and definitely have the intelligence to have read our announcement thoroughly and understood it completely. It case you didn't, let me sum it up for you: after almost one year, you finally came up with actual proof that you let someone other than yourself (= us) check but this proof was fake in many details. (I still can't belive how much of a fool you took me for, with so bold and transparent modifications. Or I'm such a good actor, wow...!

) I understand that you may have been right about some other accusations but this foolish step turned the tide completely against you - at least, in our eyes.

As we believe in the power of publicity, no, your trainer will not be removed from our forum so that everyone can follow our investigations and understand all the lies you were trying to spread around and also to base your (false) accusations about our forum on.

By the way, in case you want to threaten us with your fucking lawyers (which may only be a bluff, after all!), first make sure that all of you understand the legal consequences of intentionally falsifying evidence.

Our discussion is finished. For us, you have zero credibility, therefore, there's no point in a response from you. However, if you do want to continue the discussion, that's fine with me but 1) expect all of your messages to be published immediately but 2) don't expect us to reply to all or any of them (even in public).

On the other hand, as we're trying to still be as impartial as possible, you and your colleagues at CheatHappens should feel free to continue to help people with your trainers on our forum but no accusations, no abuse, no advertisement, and no discussion of this war as any of those will results in a ban - and, unfortunately, in your case, a permanent one at that.

Joe

Quote:

Originally Posted by Caliber

please remove the Cheathappens trainer I sent to you via PM that was code injected specifically for you. it wasn't intended to be posted for FREE on any site. ALL of our trainers have the same code in it, including the promos from that time. they don't need a compiled trainer that has our protections in it and we don't need it floating around FREE on the net.

let me know if you want my response to your posting.

2010-03-15 ~09 PM UTC Short answers to the one below:

1. There's no need to decompress or decrypt the CheatHappens trainer, only look at what it does with e.g. Process Monitor and/or look at its behavior. (Caliber hasn't read our announcement fully?!)

[...] Ahhh, found it... Launch bio2-Joe_FileForums.exe. When it comes to the online authentication - which will now fail; what a surprise! -, run WinHex, open the entire memory of the process and search for the ASCII string "h4x0r". Wow, what's there at memory address 0x00A24818? Let's try to find a reference to it, by searching for "18 48 a2 00" in hex; there's one at address 0x004927F0. Now exit WinHex and the trainer, open bio2-Joe_FileForums.exe in Hacker's View, search for "f0 27 49 00" in hex and you'll find the first reference at .00407372. Look two instructions above and you'll see a reference to a string "fC*a:a\ahfa*4afxa0ara.adfa*lfal" at .004250E1. Can you see "C:\h4x0r.dll" hidden inside that string? (I haven't tried it but feel free to play around by changing the file name in parallel in both trainers and see what happens...) Caliber, next question, please! (Damn, I'm getting resentful that you're still taking me for such a fool...!

)

2. Some of h4x0r's trainers do drop h4x0r.dll, even into C:\ and even use it but not the fake one you "supplied" in the fake "h4x0r" trainer you sent to me.

3. Blablabla. With your lies, you were putting (the reputation of) our site at risk. Now you're surprised that, as we say in Hungarian, "the ice cream licked back"?

4. All of your messages are done with you representing CheatHappens. As such, they are no personal communication and should not be expected to stay private.

Again, no need to respond, we've already explained everything that needed to.

Quote:

Originally Posted by Caliber

i am asking again that you remove the CH trainer, joe. i didn't send those files to you or ask you to look at them, YOU ASKED FOR THEM FROM ME and they were sent to you in good faith. I could care less if you leave anything else up there, but the CH trainer link should be taken down. also,

1. you might want to point to the code in our CH trainer that is 'searching for the hax0r.dll' and then 'killing' our trainer.

2. you admit in another thread that hax0r's trainers drop .dll's, specifically this hax0r.dll. is this true or not?

3. those files were not 'falsified', they were sent as-is. if you are contacted about lawyers it will be for posting work that is ripped or placing libelous statements on your site, specifically upon the outcome of hax0r (and his ISP's) upcoming legal proceedings. however, your leaving that CH trainer there is putting our site at risk.

4. placing our PM's online is childish. grow up-

again, do you want me to respond to your posting or not?

2010-03-15 ~09 PM UTC h4x0r just reported that www.sicheats.com is currently under a DDoS attack. I can't log in either; it says the server is busy. (And he's been accused of preparing a botnet attack against CheatHappens, right?) [...] Correction: I can log in but not even the list of forums appears because "the server is too busy".

2010-03-16 ~01 PM UTC Another PM... CheatHappens is sinking more and more into their spiral of lies - not understanding that the only way is down - and are obviously trying to hold onto the only detail they can possibly hold into: that a copyrighted work of theirs has been published on our site. (Sure, it was: it's part of the "backfired" proof for everyone to see.)

They do not give an acceptable answer for our results because they cannot: our results clearly show that they intentionally falsified the first and last and one and only evidence, that was asked from them for almost a year, in multiple places and tried to hide the falsifications but in completely ridiculous ways if a non-überhacker could easily find them. The rest is plain bullshit.

The most ridiculous part is that "they sent proofs to us because we requested them". What the fuck else did they expect? They made accusations on our forum. We didn't accept the accusations blindly and requested proofs. They supplied the proofs, after an incredible amount of time (preparations?!). The proofs were fake. End of the story.

I'm not completely against removing that piece of copyrighted work but 1) only if Empire instructs me to (or he does it himself) and, 2) preferably, not within a month or two so that enough people can check it out and understand what you've been trying to do. (The word "ethic" sounds like a swear word from your mouth...)

[...] Oh, and I don't sell my own software, create in my free time, and make its source free so people cannot steal from me. (Open source software, cannot steal by definition, remember?) At work, I code (parts of) software that is given away for free as it's not our clients who pay for it but the state is. Tough luck for you, eh?

[...] Two more explanations to CheatHappens as they seem to have not grasped them yet.

I have explicitly requested (multiple times?) that download URL's be sent to us, not actual trainer packages. Why? Because a trainer package can be modifed (= falsified) between downloading the genuine one and sending the modified one to me. Four possibilities exist, concerning h4x0r's trainer in question:
1. The one on h4x0r's site ("real") is genuine as well as the one sent to us by CheatHappens ("received"). Out of question, as the two are different.
2. "Real" is genuine and "received" is fake (= falsified by CheatHappens) (our opinion). Better luck next time to CheatHappens!
3. "Real" is fake (= modified retroactively by h4x0r) and "received" is genuine. CheatHappens should've checked their source right before sending the trainer to me, searched for another trainer on h4x0r's site that is (still) malicious and sent that one to me or, if found none, accepted with pleasure that h4x0r "ceased and desisted".
4. "Real" as well as "received" are both fake. What do you really except from us then?!

I think CheatHappens mixes up intelligence (that you're either born with or not) with skills (that can be learned; of course, faster if you're intelligent) and, therefore, thought that if I cannot understand complicated disassembly lists and explanations then I'm definitely dumb and won't be able to make simple tests with simple tools and do simple deductions for simple results. i had no idea what you would find or if you knew your a$$ from a mem-searcher; yup, this is exactly what I'm talking about... Again, tough luck for them!

Quote:

Originally Posted by Caliber

since you won't tell me if you want me to respond to your big post (and you are being childish with the PM's, bragging about your 'findings, etc.), then i will make the decision for you.

after ZERO help from GCW over the last year and actual INCREASED action against us, we decided to try and thwart the ripping of our trainers by people such as hax0r and kelsat. kelsat, for the most part, cut back on his trainer releases and ripping of our work. hax0r, on the other hand, became more than just a ripper of our work, and opened up FUCK CHEATHAPPENS website, posting our trainers and the code areas that the trainers used, as well as ramping up his releases, often copying our trainer options exactly. as has been stated many times, there is NO WAY to prevent people from logging WHERE YOUR OPTIONS AFFECT THE .EXE of the game. you cannot 'hide' your redirects to code caves and etc. We had many suggestions on how to thwart hax0r, some even from FileForums members and mods. however, there is nothing to stop a person from using a debugger to log changes to the .exe and note the code areas and work back from there, tracing into the code caves or our CH .dll for exact information, etc. one of the suggestions was to try and determine if hax0r was the user of the trainer and make the trainer inoperable. after looking at his executables and several of his MP and SP trainers, we could see that 'for whatever reason' some of his trainers looked for certain .dll's and folders, likely upon creation of the trainers. so we made small function in the trainers to detect these files and then kill the trainer. this worked well for about a month or more, as his releases became mainly junk trainers for mostly sh*t titles. at some point, however, users of his trainers AND our trainers became a critical point. we were able to log the users who this was occurring with and ban certain accounts that matched patterns and etc. however, it became apparent 'what was going on' to hax0r after being banned and Hax0r began to drop these .dll's into the C: drive to purposely cause our trainers to stop functioning on machines where people had both our trainers and his. many of our paid members began to report problems after using his trainers for games, etc. when trying to use OUR trainers. If you d/l EVEN PROMOS that are still posted on GCW since probably last november or longer ago you will see that this same code is in effect. we removed this anti hax0r code most recently in our Assassin's Creed 2 trainer and trainers since then, because the aggravation to our members was outweighing the possible benefit of blocking hax0r or detecting him. at any rate, the outcome of this was that hax0r was creating .dll's into the C: drive wheras in the past his trainers did not do this. later he began to drop files into places that made absolutely NO SENSE, and after we began accusing him of dropping .dll's he began to name them other things and then ultimately he chose to use sicheats.dll and make it NOT HIDDEN and PART OF THE RELEASE, in some cases going back and re-updating his trainers to remove the other method of dropping the .dll's. so basically here was the progression:

hax0r rips trainers... we complain... we posted info.. many other trainer makers agree... gcw does nothing... postings regarding his comments at gamehacking irc channel where he admits stealing options are ignored....people send ideas on how to thwart him.. we decide to try and deactivate our trainer based on known files/dirs in hax0r's computer... this works for good while, bannings occur.. hax0r's releases drop.... hax0r begins to drop .dlls into C: drive after discovering what is going on, something he had NOT done in his trainers until that point... his releases pick back up, many mirroring our trainer options.... many of our members begin to report non-functioning trainers... we decide to use it against him and report that his .dll's are causing our trainers to not function (technically NOT a lie, and Hax0r KNEW this was going on).... some of his .dll's are placed in very suspicious places, and i have NO idea what they are doing there and what they are for...eventually the bad outweighs the good on this and we remove our hax0r checks from our trainers, starting with Assassin's Creed 2.

everything we have done up to this point (and will do in the future) has been to PROTECT OUR WORK and to FIGHT RIPPING OF OUR WORK. GCW has done nothing to help us, and in fact seems to relish in the fact that we are so angered by this. at any rate, kudos to your 'examination' of our trainers (and whomever else was 'used' to help with this). now you know the progression of this and why things were done and what for. last couple comments:

1) you and GCW are on the wrong side of this joe. when you lay your head down at night and really think about it, stealing is stealing. we have never stolen anything from hax0r, and all of our actions have been responses to HIS actions and the inaction of GCW to stop posting his work.

2) you post trainers from many people, some of whom i respect greatly. you don't see me/us bashing those people or accusing them of stealing our work, etc. think about it-

3) i didn't send a request to you regarding examining these files, you asked ME for them. you freely admit that hax0r's trainers drop these .dll's. it shouldn't matter if you use the trainers we provided or you download a promo we posted 2 months ago and use one of hax0r's trainers that drops the .dll into the c: drive, the same outcome will happen. i wasn't sitting around with files waiting to send them to you if you asked for them. we killed the trainer because you refuse to pull it down. it would have been nice to have seen you and tippex put 1.5 months of time and effort (to the point of needing recuperation!) into our complaints and the voices of others just as you did to 'uncover the truth' about .dll's being dropped (which they WERE being dropped) and them killing our trianers (which they WERE killing our trainers). i have NO IDEA what these .dll's do (and neither do you) nor any idea why he decided to start dropping them, and then not and then changing the names of them ,etc., and neither do you.

4) i have not 'hacked' accounts at file forums, DDoS attacked hax0r nor GCW, i have not posted broken trainers, nor any of the above. i don't even know how to do that stuff. i/we have, however, been the victims of alot of malfesience over the last 2-3 years. some of it has been helped along by GCW refusal to act fairly. being bashed by GCW and countless others is nothing new. quit insinuating that we are these maniac hacker kids, tampering with forum accounts and sending out DDoS attacks on websites.

5) regarding your 'skills' and your 'acting'... based on your previous inept efforts to look into things that WE brought to you, i had no idea what you would find or if you knew your a$$ from a mem-searcher. frankly i don't care. i am/was willing to try anything to get GCW to help us thwart this guy. we just killed another CH account yesterday after one of our trainers was posted on his website 'cracked'. you asked for the trainer(s) (via PM) so i sent them (trusting YOU the same). now you have a little 'history' to go along with your 'uber reversing skills'. if our effort 'backfired' then we are back to hax0r still getting his trainers released on GCW, no help from GCW to do anything about it, and alot of the members of FileForums already hate CH because our trainers aren't 'free' for 2-3 weeks. if you sided with us, then it was a win for us and all others who were getting their work ripped. our trainers and work ethic (and our tireless fight against people who steal from the site or try to harm it) is appreciated by our members and they deserve it, since they paid for it.

6) we won't stop going after him and trying to protect our work and our site. think about the whole history and progression of this, joe. you are on the wrong side of this. as you said before, people can make up their own minds who they think is the 'bad guy' here. i don't know what you do for a 'real' job but people stealing your work or claiming something theirs that is yours would not be tolerated (take it into your own occupation).

2010-03-17 Abusive posts are again appearing here and there, in the names of random users; the "unknown hacker" returned. Please, don't mind him as he's obviously having major mental, moral and sexual problems; his posts will be removed continuously. Hopefully, we won't have to deal with them for long, in case authors of vBulletin find a solution for closing the security hole still being exploited.

Joe Forster/STA · #6 22-05-2010, 16:26

And the CheatHappens bulldozer is still rolling in the background. We have received the following E-mail:

Quote:

From chris(at)cheathappens(dot)com Sat May 22 04:13:26 2010
Date: Fri, 21 May 2010 21:11:54 -0500
From: Chris ORorke <chris(at)cheathappens(dot)com>
To: submit(at)gamecopyworld(dot)com, empire(at)gamecopyworld(dot)com, sta(at)c64(dot)org
Subject: h4x0r

Dear Empire/Joe,

I'm writing to inform you of pending litigation we have against Jose [...] (aka 'h4x0r'). This litigation will include GCW and FF as they are both primary hosts for Jose's infringing work and he has told us that GCW is to become his new homepage should sicheats.com be shutdown.

Over the past few months we have hired a private investigator to ascertain the personal information of 'h4x0r' so that legal measures could be taken after other forms of communication have failed. Going on nothing more than an online hacker name of 'h4x0r', our investigator was able to obtain his full name, DOB, address, personal ID#, place of employment, bank account information, income history and a complete list of all immediate family members. We compiled a 40 page document outlining all of the various infringements that Jose has made over the years against CH and have submitted this report to our lawyers in Spain and also to Spanish authorities. Our lawyers have issued a Cease and Desist order and dispatched it to Jose at his home and work and also to his sicheats.com web host. You will find a copy of this letter attached. In order to comply with the cease and desist, Jose would need to have his infringing trainers removed from third party sites such as GCW and FF. If he does not comply, our lawyers have been instructed to file a full lawsuit and press formal criminal charges against him as early as this coming week. Should it come to that, and GCW/FF is still voluntarily hosting his infringing files, it will be necessary to have our private investigator ascertain the private information of both 'Empire' and 'Joe Forster' so that you can be subpoenaed as witnesses to both the continued infringement and our multiple attempts to bring this issue to an amicable conclusion. Alternatively, should you decide to continue hosting Jose's work (and especially if you become his new 'homepage') then we will have no further recourse than to name GCW/FF as a co-defendant in our lawsuit as you are currently the primary distributor of his infringing files. We sincerely hope that it doesn't come to that.

This email is not meant to be a threat to you or your website in any way. I'm merely informing you of the circumstances so that you are not blind-sided should subpoenas show up at your home somewhere down the line. I'm also hoping you will take this opportunity to help Jose comply with the Cease and Desist and take GCW/FF out of the equation so that this is merely between us and him. We are not trying to attack or rid the world of free (or competing) trainers as some have speculated, we are merely trying to protect the hard work of our staff and others that might find themselves a victim of Jose's ongoing infringement. Someone has to take a stand at some point or it merely opens the door for this type of unlawful infringement to continue for years to come, not only against us, but against other talented programmers that are simply trying to make a little money from their work.

I appreciate you taking the time to read this and hope that this matter can be brought to a civil conclusion without having to drag it out into a courtroom battle.

----------------------
Chris O'Rorke ( <mailto:chris(at)cheathappens(dot)com>)
Co-Founder, Business Operations Manager
Cheat Happens.com - <http://www.cheathappens.com>

The attached PDF contains the following:

Quote:

JOSE <...>
<address...>

POR BUROFAX / ACUSE DE RECIBO

Barcelona, May 12, 2010

N / Ref.: <...>

Dear Mr. <...>

We are writing you on behalf of Dingo WebWorks, LLC (U.S.). Our client is the owner of all the copyrights of the contents of the website www.cheathappens.com. Our client also owns the copyrights of the software and all the work contained on the website.

According to the documentation and materials provided by our client, on the website www.sicheats.com, -site of which you are owner, responsible and user- are taking place infringements of the intellectual property rights, which are an exclusive property of our client.

In this sense, our client has detected that many of the works that have been posted on the website www.sicheats.com and which have been created by you, acting under the nickname "H4X0R”, are identical and substantially similar to the software owned by our client, which is protected by the copyright law. This material has been unlawfully reproduced, processed, communicated, and made available to the public by yourself in the website www.sicheats.com and distributed online through torrents and different advertisements on different websites, including several sites of a pirate software; as an example we mention www.gamecopyworld.com. In particular, we are aware that you -either through your nickname, either through the website www.sicheats.com- have committed the following infringing acts:

1. The software of www.cheathappens.com, owned by Dingo WebWorks, LLC, was downloaded by you and was made available on the websites to be downloaded by others, violating the conditions and term services of www.cheathappens.com.

2. The software of www.cheathappens.com, owned by Dingo WebWorks, LLC, was downloaded and modified to hide the user identity, and then was made available for others on different websites by you, violating conditions and terms services of www.cheathappens.com.

3. As a result, the software of www.cheathappens.com, owned by Dingo WebWorks, LLC, was downloaded with your modifications by other users and then was altered to hide the identities of these users and it was linked to other websites to be downloaded by others in a violation of the conditions and terms services of www.cheathappens.com.

4. The software created by you is an illegal copy and alteration to the www.cheathappens.com software, property of our client, and illegally distributed by you.

5. The software created by you, is a copy of important functions, of the www.cheathappens.com software, property of Dingo WebWorks, LLC, and has been illegally distributed by you.

6. The software of www.cheathappens.com, property of Dingo WebWorks, LLC, was modified by you, in order to remove the copy protections and then was unlawfully made available to the public on your website www.sicheats.com, to be downloaded by by other.

7. The software created by you, copying the www.cheathappens.com software, property of Dingo WebWorks, LLC, was made available to the public on the web www.sicheats.com, to be downloaded by other.

8. The illegal posting links to get illegal copies or cracked copies of the www.cheathappens.com software, property of Dingo WebWorks, LLC, were made available to the public on your website www.sicheats.com.

9. The posting links to other websites, which are published different methods to try to crack
or remove the copy protection of www.cheathappens.com software, property of Dingo WebWorks, LLC, was made available to the public in your website www.sicheats.com. Note that on this site are many links and software for hack others software, remove and modify their protections, in a violation of the terms services.

Consequently, the described acts constitute a violation of the copyrights of my client, recognized in the current copyright law, which gives to the author or legal holder, the exclusive rights of his work, in particular, the reproduction, distribution, public communication rights, which can not be used without an authorization. These actions may also constitute criminal conduct punishable by the criminal law as an intellectual property crime. Moreover, www.sicheats.com breaks the Law 34/2002,of the services of information society, in relation to the obligation to provide the person or corporate name, domicile orpermanent establishment in Spain of the webpage owner.

For this reason, it is clear that this acts produce serious damages to our client. Given the considerable damage suffered by our client because of the illegal exploitation of his rights, and in accordance with the applicable law, we formally require you that, in the limit time of 24 hours from the date of receipt this request, proceed to::

- Cease immediately and definitively the copy, distribution, public communication, diffusion, emission and all the exploitation acts of the software property of Dingo WebWorks, LLC, and the diffusion of any infringing content of the page www. sicheats.com and any illegal copies of the software in any form or medium that reproduce, transmit or make available to the public or pose a illegal software exploitation and notify us in the compliance as they have done. This includes both software created by you, which is only mere copy of www.cheathappens.com software, property of Dingo WebWorks, LLC, whose code was in whole or in part opened and manipulated: and any other software uploaded at www.sicheats.com that can constitute an infringement to our client’s rights.

- Refrain in the future to do any illegal exploitation of the software property of Dingo WebWorks, LLC, protected by copyrights law, in www.sicheats.com or in any other website.

- Refrain to unlock or crack or remove shielding software devices, or any infringing act related with software property of Dingo WebWorks, LLC.

- Sign a statement to refrain in the future to publish or make available the links to illegal copies and distribution versions of the software property of Dingo WebWorks, LLC, protected by copyrights, without a written permission of Dingo WebWorks, LLC.

The expiration of the allowed time without having complying such a requirements will be understood by our client as a renounce of a friendly settlement, in which case our client reserves the right to take any action necessary to defend his legitimate interests, including the damages compensation. Our client also reserves the right to spread the commission of the alleged infringements committed by you according to all legal means and to all those persons and/or bodies that may have interest or may be affected by the infringement. We look forward to hear from you shortly and wait the acceptance of this requirement.

Yours sincerely

Sönke Lund

And a PNG... Is this supposed to prove that this guy is a real lawyer? Dunno...

And another E-mail.

Please, note that CheatHappens still doesn't understand that all of this correspondence is official from their side and, as such, should not be considered private. Also, they cannot possible expect us to keep it private after all what happened so far: the public needs to know every detail about their tactics and, even if we may not boast with millions of visitors, interesting rumors get very far very fast today.

We can't do anything about CheatHappens publishing h4x0r's personal details. We didn't do it as we were never allowed to. (And we didn't know anyway.) Not allowed to publish CheatHappens' messages either? See above. Also, have we published any personal information? Nope, only information that was sent to us. We never investigated where CheatHappens is located, who are working in it, along with all kinds of personal details. Actually, we don't give a fuck, that's why: what is important is what they're doing and how they're doing it. Hopefully, if this shit fires back to CheatHappens, this publishing of personal details will also be taken into account in a possible libel case against them. So, good luck!

If you drag game publishers into this then keep in mind that you're publishing trainers which are the results of reverse-engineering that is explicitly prohibited in most EULA's. You can be sure that we'll make notice about this in case we're interrogated. Let the fun begin!

Quote:

From chris(at)cheathappens(dot)com Sun May 23 04:25:13 2010
Date: Sat, 22 May 2010 21:24:14 -0500
From: Chris ORorke <chris(at)cheathappens(dot)com>
To: submit(at)gamecopyworld(dot)com, empire(at)gamecopyworld(dot)com, sta(at)c64(dot)org
Subject: FYI

As expected, I see that you posted our private letter on the Fileforums
website. Since you removed some interesting pieces (ie: Jose's address), I
will be posting the complete version on our website, including Jose's
address and personal information. When he asks why his private information
was made public, I will send him in your direction.

Also, we will now ask our private investigator to obtain a full personal
profile on both Empire and Joe Forster. You can bet that we will grant you
the same courtesy that you have shown us in regard to the sharing of private
information with the public. The only difference is that I can put it on our
homepage and put it in front of over 10 million eyes per month.

It will be our pleasure to add GCW/FF (including you personally Joe) as
co-defendants in our pending lawsuit. Thank you for making it such an easy
decision.

BTW, once we obtain the private information of Empire, we will be sharing it
with the likes of Valve (and other game developers) which have expressed an
interest in becoming co-plaintiffs in our case seeing as how h4x0r has
damaged their multiplayer servers with his MP hacks. Perhaps they will find
other ways to use the information as well.

This will be my last attempt to communicate with you. You can monitor our
homepage and forums for more information about this case. You will also
receive your official subpoenas in the coming weeks.

----------------------

Chris O'Rorke ( <mailto:chris(at)cheathappens(dot)com>)
Co-Founder, Business Operations Manager
Cheat Happens.com - <http://www.cheathappens.com>

Joe Forster/STA · #7 25-05-2010, 11:01

Further E-mails arrived. We still believe that the public needs to know all this information. We have no idea why CheatHappens sends us E-mails when they know that we will publish all of them, as stated many weeks ago (see above). It's good to know what's happening in the background, though...

Quote:

Date: Sat, 22 May 2010 22:05:33 -0500
From: Chris ORorke <chris(at)cheathappens(dot)com>
To: sta(at)c64(dot)org
Cc: empire(at)hush(dot)ai
Subject: BTW

We have some archived forum posts by Empire on our message boards which he asked us to remove from public view. Of course we obliged at the time. However, since you seem to be keen on making everything public that should be private, I'll be unarchiving these posts and making them sticky across the entire website. We'll see how you like the shoe on the other foot.

----------------------
Chris O'Rorke (chris(at)cheathappens(dot)com)
Co-Founder, Business Operations Manager
Cheat Happens.com - www.cheathappens.com

Please, note that we are publishing information that was sent by a CheatHappens member, representing CheatHappens, to us, representing GCW/FF. As we have been accused of supporting illegal activities, we're not going to sit idle and get buried under more and more incoming threats. These messages are considered (as) official (as possible) communication between CheatHappens and GCW/FF and are published as such. Considering them as private correspondence in the current situation is plain ridiculous.

On the other hand, CheatHappens is threatening us with obtaining and disclosing personal details of us although we never told them any of that information, they harvest(ed) it themselves - perhaps, not entirely by legal means. We hope you understand the difference between the two kinds of publishing information.

Also, Empire does not have a hush.ai E-mail address and has never posted anything on CheatHappens' forum. If you find any message supposedly posted by Empire, it is definitely fake.

Quote:

Date: Tue, 25 May 2010 10:49:07 -0500
From: Chris ORorke <chris(at)cheathappens(dot)com>
To: sta(at)c64(dot)org, empire(at)gamecopyworld(dot)com, empire(at)hush(dot)ai, submit(at)gamecopyworld(dot)com
Subject: Misuse of Personal Information

I've been notified by our attorney that your publishing of the cease and desist order is a clear violation of our rights as that information is the private and confidential communication between two parties (us and Jose) and you have not been granted permission to post it by both parties involved. Unless this information is removed, we will file formal charges in this matter. Our private investigator is in the process of obtaining full personal profiles on both Empire and Joe Forster as previously stated. Once we have that information, it will be turned over to the proper authorities.

----------------------
Chris O'Rorke (chris(at)cheathappens(dot)com)
Co-Founder, Business Operations Manager
Cheat Happens.com - www.cheathappens.com

Official letters are expected to be sent via snail mail to a street address of the addressee, via recorded delivery, with signatures of the sender as well as his lawyer's. We don't give a shit about "personal" E-mails.
Laws vary from country to country. The laws in the sender's country don't necessary apply in that of the addressee or the country where the server, containing the object in question, resides.
Such official letters are not (= cannot be) copyrighted and, therefore, can be published (without personal details, of course).

We recommend that CheatHappens attend a basic legal course before continuing... or shouldn't have sent that information to us at all. Hopefully, revealing their disgusting scare tactics will make everyone understand what kind of people they are, whether or not otherwise great coders.

Joe Forster/STA · #8 12-07-2010, 08:31

Recently it has come to our attention that online is available a PDF document that contains the results of the investigation of CheatHappens concerning h4x0r's activities. Upon downloading, it turned out to be a quite full "criminal profile", with tons of h4x0r's personal data. The link to the document was posted by an individual presumably close to CheatHappens, in the form of an attachment to a long rant, quoted from Mike/CheatHappens, against the behavior of one of the administrators of that forum. After my reply to that thread, soon a PM arrived on this forum from Caliber:

Quote:

Originally Posted by Caliber

Quote:

Ah, actual examples n that PDF. Happy, happy, joy, joy, more than a year of waiting for proofs has finally ended!

someone told me, and so i see you couldn't stay out of it over there at deviated. this is the same information we sent to you guys as well as a few other trainer bits, plus the myriad number of other non-CH trainer makers who reported ripping. don't act like you haven't seen this information before. the reversal of 'opinion' by you is comical. you didn't 'examine' anything 'fully' that was sent to you by us (and posted in the fucking forums here) until it was anti-CH worthy and then you posted this myopic diatribe and stickied it. congratulations! you won't admit it, but it's clear that h4x0r was ripping (as well as many other things that were needing to be handled) and this was well over a year ago. it doesn't take a genius to look at two trainers and come to the same conclusion. at least admit what you are and quit trying to sound 'impartial'. the backpeddling and weak retaliations don't become you. i doubt deviated will leave that posting and link to the pdf up for long since it makes you both look like the stupid and wrongheaded barking dogs that you are. you can't 'explain it away' no matter how many postings you make, but i am sure you will try. no need to respond to me here about that topic since i could care less since we have accomplished what you apparently could not do yourselves. the proof and the entire history is right there in the pdf and i KNOW what happened and who did what. again quit trying to call the tar on your hands something other than black....

it's a year late but i guess someone at GCW admitting that there appears to be proof of h4x0r ripping our trainers is a positive step. until you post that fact somewhere, well then thanks for nothing (still)-

by the way, there appears to be an individual named

ROTOR

that we have seen several postings of trainers:

http://trainercheats.net/tag/rotor

at any rate, we are looking at him closely. if you have any contact with this person you can let him know that we've seen some similarities in his work, although we don't have enough to publicly start saying anything. we'd rather not have to play this game again, chasing down people in their own country/towns, etc. he apparently can do his own trainers so i'd like him to continue doing so without reversing the work of others, if he catches our drift.

good day-

Poor Caliber, he thinks we would hide this document as it proves our guilt and bias but the truth is just the opposite: exactly publishing this document proves our innocence and neutrality! You see, we never had anything to hide and we also want ourselves as well as the public to see as clearly as possible in this matter.

You can find the document attached to this post. However, please, note that this is not the original PDF we downloaded: misuse of personal data, such as publishing a great amount of h4x0r's personal data without his prior permission, would be a criminal offence. Whether or not you believe us that we only removed those particular parts but modified nothing else is, again, up to you: we wouldn't be able to persuade you so we won't bother to try. Feel free to search for the original document but don't expect help from us.

However, when we asked when exactly we were supposed to have received this document, the following PM arrived:

Quote:

Originally Posted by Caliber

Quote:

Originally Posted by Joe Forster/STA

Hi Caliber,

Can you, please, tell me:
- when this document was created,
- when you (you as in anyone at CheatHappens) sent it
- to which one(s) of us (us as in anyone at GCW/FF),
- in what form (PM, E-mail, attachment, download URL)?

Thanks,

Joe

that 'document' was created for the spanish legal team we have circa April 2010, and comprimises all the information we had on h4x0r for a couple years, just put into legal form and a concise document with a historical timeline. it was necessary to push forth with the legal action so we had everything in order. i wouldn't take the time to write a 20 page document for you hacks at FF when looking at the two trainers should be sufficient enough for you supposed elite reversers. however, to throttle your 'suddenly vacated' memory, we sent you code snippets for these two games JUST LIKE IN THAT DOCUMENT in the file forums postings. and supposedly you 'impartial' GCW leet reversers examined the information and came to the conclusion that it's impossible to know, etc., etc.

the reason you idiots don't see anything or have anything anymore on your site(s) is because you edit postings or erase postings or remove things from postings (like you did at deviated and removed your admission of proof of h4x0r ripping) to fit your own agenda. i am sure that STN will remove the rest soon. now suddenly 'history' has changed since you have removed all 'evidence' of our postings from FF or the like. sims 3 has been out over a year ago and napoleon total war was in january of this year, well before you guys finally went totally anti-CH. i don't have the time nor do i care to 'persuade' you any longer. we've taken care of the problem and moved on. you look like idiots, and now you are lying idiots manipulating the 'truth' and 'evidence' and 'postings'.... just the sort of thing you accuse CH of.

'we've never seen this information before'.. 'when did you actually e-mail us any proof'.. 'i've never seen postings about this sort of thing'...

really comical joe... christ man, i think even YOU believe this shit yourself....i would have more respect for you if you would just admit it and quit trying to pretend you are impartial.

encourage theft, persuade others it didn't happen, erase history, deny ever hearing about it... it was bush's fault and evil america and cheathappens..

you would be the perfect OBAMA voter here in the US.

good day-

After the second PM, we finally understood where the turning point of all that happened was. When we considered CheatHappens' first proof as inconclusive (see the "2009-04-17" entry in the first post of this thread), they probably at once took us for idiots, incompetent hackers or whatever and unworthy of further proofs. From then on, we were waiting for (more) acceptable proofs in vain as none arrived, until the fake trainer package, a year (!) later.

We're sure that CheatHappens still has the false assumption that they made us a favor by sending proofs, that they gave us several chances to accept their opinion but we failed to do so. However, the truth is just the opposite: we gave CheatHappens several chances - for a whole year! - to send proofs that we can accept but they failed to do so. Let us remind you: it was CheatHappens who requested help from us, not the other way around. The document lists multiple examples, some of them showing not only similar but downright identical pieces of code, including the duplication of bugs and bugfixes. If we didn't accept CheatHappens' first proof - which was only similar code and, therefore, an inconclusive proof - then why didn't they later send us another sample, with such identical code? We have no idea other than the "these people at GCW are idiots" reason.

Yes, we had our conditions about helping CheatHappens. Caliber states that code snippets - parts from this document that were already compiled very early - were distributed to multiple trainer/cheat-related sites and individuals and, if we understand it properly, they accepted CheatHappens' proofs without hesitation, although whatever this document - or a quote from it - states, that is only a description of the proof, not the proof itself. (Do you understand the difference? CheatHappens, apparently, doesn't.) We have the strong suspicion that, on the PC trainer scene, CheatHappens has such a great influence, not all of which can be attributed to the unquestionably high quality of their releases, that it makes people blindly believe in whatever CheatHappens tells them. That would be quite sad as, on a side note, accepting statements without any doubt is also the best way to become a puppet under the constant reticences, half-truths and blatant lies of today's capitalistic-consumeristic society.

Fortunately, we never suffered from such a mental state and we wanted to really make sure that CheatHappens is telling the truth. Why? Because, with legal terminology, we wanted to give h4x0r a "fair trial", with us being the "impartial court" and we wanted to make absolutely sure that we make no mistake by condemning him when he's actually innocent. In case you don't understand the difference between "direct evidence" and "circumstantial evidence" then you're probably living in a dictatorship which is what CheatHappens is trying to establish via their great influence - however, unlike most others, we're not going to become their accomplices. (See a very similar example of this at the New anti-warez forum rules? thread. The poll ended with the result that suspiciously looking CD's/DVD's may simply be the user's own compilation - e.g. while making a backup of the original CD/DVD, he or she adds the no-CD/DVD patch into a directory logically called "Crack" -, therefore the authors of posts showing such directory lists, screenshots shouldn't be banned on sight for warezing.) Also, we had the strong suspicion that CheatHappens wants to use us as a tool, weapon, sidekick or whatever in killing off h4x0r and we were reluctant to be manipulated that easily. If our condition was that CheatHappens runs around the park naked, farting the national anthem, that would've been unreasonable. But we hope you agree that requesting actual trainers with (allegedly) identical code inside them is not unreasonable and neither is rejecting a not completely believable proof and asking for another, better one.

Let us repeat: out of the four possibilities - 1) similar code fragments quoted, 2) similar code fragments inside actual trainer executables, 3) identical code fragments quoted and 4) identical code fragments inside actual trainer executables -, we would've only accepted the last one, and h4x0r's trainer executable preferably not sent to us by CheatHappens - as it could've been previously modifed, like the fake package was - rather a download URL from his site - which surely is the original. (Had CheatHappens acted fast and communicated with us via PM's, E-mails or similar non-public way, h4x0r couldn't have been suspicious of either of us and would've left his trainers in question on his site.) And they cannot tell us that they had no such proofs as there are such examples in their own document. Yeah, they would've had to wait for another couple of weeks or months until such proof is found and then send that to us. However, CheatHappens sent us no such proofs so we didn't help them, what's the surprise?

By the way, Caliber's accusations of us retroactively modifying history is false. That particular thread with their first (inconclusive) proof was permdeleted but you could read that already above; yes, I did that, yes, I was mad and, yes, it was a mistake. However, as you can read above, several threads were restored (from their invisible state) so that then public can follow the events. As for my particular post at the DeviatedHacking forum, I previously wrote STN in a PM to not hesitate to delete any of my postings on his forum if he finds them inappropriate - well, he deleted the whole thread which is his damn right. Also, if CheatHappens accuses us of editing posts/threads to our own liking then that obviously means that they never censor anything on their own forum, right? Yeah, completely believable...

Both sides made mistakes but, please, note the differences in the magnitudes. CheatHappens asked us to help, we answered okay. We requested proofs, CheatHappens sent us one. We found it inconclusive. That's the first mistake although it can be debated whose mistake it is: CheatHappens' as they should've sent us a better proof or ours as we should've accepted it right away? However, we didn't tell CheatHappens to fuck off, we requested better proofs but CheatHappens provided us with none. That's the second mistake: as written above, they had proofs, showing obvious blatant copying of code fragments, but they chose to not send them to us. We kept waiting and stood against the tide. If doing nothing and waiting for the other side to make its step is a mistake then this is the third mistake; we should've probably told them to fuck off right away and continue with our life. However, in the meantime, CheatHappens started their propaganda against us, spread that we don't want to accept their proofs - which is false because we wanted to, had they sent us one that we could. That was the fourth mistake and, as you can see, the mistakes are ever more escalating. After a whole year, for some unknown reason, CheatHappens sent us a complete package that could've been a lovely proof. However, it turned out to be fake. That was the fifth mistake, again, on CheatHappens' side, which made us really mad and made us think that, perhaps, all the proofs previously sent to us were also fakes, trying to fool us. And, to top all of this, "someone not related to CheatHappens" hacked our site multiple times. That was the sixth mistake and the timing and the contents of the abusive posts, sent to the forum by random users, make it obvious that the hacking was directly related to our stance towards CheatHappens. To sum it all up: we were reluctant and hesitant about helping CheatHappens - we didn't accept not completely obvious proofs - which may or may not have been a mistake; on the other hand, CheatHappens tried to discredit us with their propaganda all around the scene, sent us false evidence - which is, by the way, a criminal act - and had someone hack our forum.

It is obvious who the bad guy is and whom you shouldn't trust in the future. Stay away from CheatHappens and don't get entangled into their suspicious actions and manipulations because you can very easily become their enemies, in which case you can consider yourself finished. You see, we did nothing against them - until this announcement thread when we've had enough of their bullshit -, our only "sin" was that we did nothing for them either, and even after a year, they're battling against us. That's what they truly are.

In the light of all this above, we have to sadly but firmly announce that this document has no effect whatsoever anymore on our stance towards CheatHappens. We now accept that they were/are most probably right about their claims but their disgusting ways of trying to "persuade" us cancels this, to put it mildly. As a result, we don't give a fuck anymore about what h4x0r did and we're happy to hear that CheatHappens also gave up trying to prosecute him, with his new site reportedly carrying no trainers with stolen code fragments. However, similarly to us, you should give a fuck about CheatHappens' tactics as this document could've been (could be? is?) also fake, like the trainer package was: it seems that whether they're right or wrong doesn't matter, the CheatHappens war machine would roll on anyway, trying to ram anyone not agreeing with them into the ground. Mirroring the conclusion of Caliber's PM: CheatHappens owe us a public apology, although we're sure they won't try, but we couldn't care less. I personally would prefer banning their trainers altogether from GCW but Empire insists that it is in the visitors' interest to be able to find as many trainers here as possible so my wish won't be granted. However, their and their accomplices' (you know who you are) accounts have been permbanned and now they are persona non grata on this forum.

We are also amused by Caliber's boasting, announcement, warning, request, or whatever it is meant to be, concerning this trainer maker called Rotor because we can assure CheatHappens that we won't lift a finger to help them in any way for any reason. With their constant paranoia and vigilance towards other trainer makers, the great amount of time they spend with analyzing the code of their competitors and investigating about and prosecuting competitors whose actions they find endangering to their own business makes them just as pathetic as game publishers that also spend a great amount of their resources to develop (or have developed by others) copy protections, instead of improving the quality of the game they publish, and their pointless crusade against pirates that they're bound to lose most of the time. (Good luck to both, though.) And all this exclusively for what? Little colorful pieces of paper known to most as "money" and "profit" - the times of striving primarily for pride, fame and grateful users are long gone. And especially when cracks, whose development entails efforts more by an order of magnitude or more, are given away for free - at least, to us, mortal end users -, selling relatively (!) small and easy-to-make pieces of code called "trainers" is laughable but, hey, everyone is entitled to their own opinion. However, if you choose to sell stuff of this small scale then also get prepared for the price (pun intended): becoming a target of criticism, ridicule and distaste...

This is the very last time that we communicate, directly or indirectly, with CheatHappens about this topic - or, most probably, at all. Whatever further announcements we would make, they would consider it again and again as an attack against them and the battle would never end. We don't have time for this as we have a lot of other, much more constructive goals to spend our time with. If they have any problems with us, we don't care and don't bother to contact us with anything related to it. For us, CheatHappens reached the very bottom of their grave of immorality, that they have been digging for themselves, so let them rest there in peace.

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

The Following 3 Users Say Thank You to Joe Forster/STA For This Useful Post:
preg75904 (13-09-2013), ProSevenOne (25-11-2012), remcodevries (26-08-2013)

The Following 2 Users Say Thank You to Joe Forster/STA For This Useful Post:
preg75904 (13-09-2013), ProSevenOne (25-11-2012)