How to force proper results from lockdown lib 13's checkrevision function

[warz]

I've been running out of time lately with school, fraternity stuff and WoW, to really continue working on CheckRevision. I have about 75 to 80% of the function converted to C++, but haven't looked at the actual function in a debugger in well over a month. I'm beginning to forget what actually goes on within checkrevision, and am losing interest in the project entirely. I am not releasing my C++ rendition of cr, but will release my code that forces lockdown 13 into returning proper results from checkrevision. The source code I am providing here includes code to a dll I was making, before I began converting the entire thing to C++, as well as the test calling application. This is the same application I posted screenshots of, in my debugger, a few months back. I will explain and answer questions if anyone has any. Remember, this is not a universal fix, and really is not very practical at all, but might give you an idea as to where important parts of checkrevision are if you're attacking it from the perspective where you'd want to download and run their code. I also include an api hooking class. It's not very robust, but gets the job done.

http://rafm.ldforum.net/pages/cr/checkrevision.zip

Note: this code is a hack, remember that, so it's not very clean and has no comments. Also, if i remember correctly, the app itself does not print the proper results, you have to view them in the debugger after the function call. There was a problem i think while unloading the files, or something, that caused the app to either crash or print weird values. Alas, that has nothing to do with my checkrevision call, though. Also, this was the last thing I did before moving onto converting it to C++. I realized this was impractical. What you'd really want to do with this method is hack one lockdown dll so that it never hashes itself, and so that it can be made to "work with all other lockdown dlls", if you will.

[Ringo]

Good job
Some educational material on lockdown at last!
Very nice!

[l)ragon]

Thanks for shareing

[Sorc.Polgara]

Ummm anyone happen to have a working link to the lockdown mpqs?

[Hdx]

http://www.valhallalegends.com/arta/#BnFTP

Code Select Expand

bnftp useast.battle.net lockdown-IX86-00.mpq lockdown-IX86-01.mpq
lockdown-IX86-02.mpq lockdown-IX86-03.mpq lockdown-IX86-04.mpq
lockdown-IX86-05.mpq lockdown-IX86-06.mpq lockdown-IX86-07.mpq
lockdown-IX86-08.mpq lockdown-IX86-09.mpq lockdown-IX86-10.mpq
lockdown-IX86-11.mpq lockdown-IX86-12.mpq lockdown-IX86-13.mpq
lockdown-IX86-14.mpq lockdown-IX86-15.mpq lockdown-IX86-16.mpq
lockdown-IX86-17.mpq lockdown-IX86-18.mpq lockdown-IX86-19.mpq
Get them yourself.
~-~(HDX)~-~

[Sorc.Polgara]

Is anyone able to get the CheckRevision Caller program and CheckRevision DLL to work?  The program just crashes for me every single time.

http://images.lwuanime.com/crcaller.jpg

Looking at when it's crashing and the CheckRevision DLL source:

Code Select Expand


lpMemdump = new char[50000];
FILE *fpDumpfile = fopen("ttusux.txt", "rb");
fread(lpMemdump, sizeof(BYTE), 49999, fpDumpfile); // intialize our video image
fclose(fpDumpfile);


I'm guessing that hte problem is the file "ttusux.txt" doesn't exist...   warz, perhaps u still have this file with the memory dump that's being loaded?  If so could you upload it somewhere please?

[warz]

oops, my bad. http://rafm.ldforum.net/pages/cr/ttusux.txt - and we don't suck! biggest come back in bowl game history!

[Hdx]

You noted that the DLLs accept blank Value strings.
And this is confermed that the live servers DO send blank value strings:

Code Select Expand

3  63.241.83.12  67.150.168.114  48  Recv 
0000  FF 25 08 00 1D F4 4E C6 FF 50 28 00 00 00 00 00    .%....N..P(.....
0010  5C 4B 21 F6 B7 CD 03 00 00 20 58 7D 99 CB C6 01    \K!...... X}....
0020  76 65 72 2D 49 58 38 36 2D 30 2E 6D 70 71 00 00    ver-IX86-0.mpq..
That was on west.
And we need to yell at Skywing cuz BNLS returns invalid results when the valuestring is null.
~-~(HDX)~-~

[warz]

ver-ix86-0.mpq is still in effect?

[Hdx]

Code Select Expand

2  67.150.168.114  63.241.83.12  66  Send 
0000  FF 50 3A 00 00 00 00 00 36 38 58 49 52 41 54 53    .P:.....68XIRATS
0010  CF 00 00 00 53 55 6E 65 01 01 01 64 E0 01 00 00    ....SUne...d....
0020  09 04 00 00 09 04 81 7C 55 53 41 00 55 6E 69 74    .......|USA.Unit
0030  65 64 20 53 74 61 74 65 73 00 FF 25 08 00 00 00    ed States..%....
0040  00 00                                              ..

3  63.241.83.12  67.150.168.114  48  Recv 
0000  FF 25 08 00 1D F4 4E C6 FF 50 28 00 00 00 00 00    .%....N..P(.....
0010  5C 4B 21 F6 B7 CD 03 00 00 20 58 7D 99 CB C6 01    \K!...... X}....
0020  76 65 72 2D 49 58 38 36 2D 30 2E 6D 70 71 00 00    ver-IX86-0.mpq..
Gah I'm an idiot I didnt even read the effing filename.
But yes, every now and again Bnet still sends ver-PROD-0.mpq
all those files are still on the server, but 1-7 are gone.
~-~(HDX)~-~

63.241.83.9
63.241.83.12
Those servers are constantly sending ver-IX86-0.mpq with null value string....
~-~(HDX)~-~

[l)ragon]

63.241.83.9
63.241.83.12
Those servers are constantly sending ver-IX86-0.mpq with null value string....
~-~(HDX)~-~

Seen that a few times too but it was on 131 and 134.

[Ante]

is this only for lockdown 13? do you have it for any other libraries?

[l)ragon]

is this only for lockdown 13? do you have it for any other libraries?

He's been bussy and you'll have to either wait for somone to add to it or use another verified source.