TKC-Community

Hacking and Art => Armed Assault 3 => Armed Assault 2 => Topic started by: [TKC]Wesker on December 24, 2010, 01:22:59 am

Title: Using WPE With ArmA2 (updated BE)
Post by: [TKC]Wesker on December 24, 2010, 01:22:59 am
Here is how to use the unmodified WPE without getting kicked after getting into the game.
This method will not get you into the game with WPE running.

All you need is Winject 1.7b

1) Open WPE Pro
2) Set your filters
3) Join the game lobby
4) Close WPE
5) Load WinJect
6) Target Process "ArmA2OA.exe"
7) Click the "..." just to the right
8) Select WPEspy.dll and eject it!
9) Close Winject and enjoy the game.

WPEspy was attaching itself to the ArmA2OA process. Even after you close WPE the dll is still attached to ArmA getting you kicked by BE!
This method removes the DLL from the games memory so you can get into the lobby with your packet filters.
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: MrMedic on December 24, 2010, 01:52:32 am
thanks for shareing man , good stuff.
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: Pride on December 24, 2010, 04:23:42 am
I think you mean ArmA2OA.exe

:P
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: karmalover on December 24, 2010, 04:41:49 am
nice contribution, :icon_thumbsup

still need to record packets...
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: Double Hack on December 24, 2010, 04:45:07 am
great idea, tried it but i have "GetEprocessBase failed because No Process- Handles owned by CSRSS

and when I try to eject it says "Couldn't Eject! Remote FreeLibrary() fails"

anyone know why i get these messages and help?

-crashes game when i eject it
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: [TKC]Wesker on December 25, 2010, 04:47:57 pm
great idea, tried it but i have "GetEprocessBase failed because No Process- Handles owned by CSRSS

and when I try to eject it says "Couldn't Eject! Remote FreeLibrary() fails"

anyone know why i get these messages and help?

-crashes game when i eject it
What OS are you using?
Also is it possible an antivirus or firewall is blocking anything?

I'm doing this with Windows7 64.
Also I remember doing it in the past with XP 32

@Pride +1  :icon_thumbsup
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: Bellend on December 26, 2010, 10:43:12 am
nice contribution, :icon_thumbsup

still need to record packets...
You can log packets with Wireshark. Some admins use it to detect scripts being sent to the server. :icon_shifty
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: Double Hack on December 26, 2010, 01:52:39 pm
nice contribution, :icon_thumbsup

still need to record packets...
You can log packets with Wireshark. Some admins use it to detect scripts being sent to the server. :icon_shifty

Is there a way to inject the WPE spy.dll into Wireshark and filter the same way as WPE?

BTW, I'm using Windows Vista 32 bit
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: s3v on January 08, 2011, 01:39:37 pm
Game crashes soon as I hit OK after ejecting the .dll.

Running Win7 64bit
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: Fury on February 08, 2011, 04:31:56 pm
Game crashes soon as I hit OK after ejecting the .dll.

Running Win7 64bit

This is correct, it crashes for me too. W7 64bit
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: i mss old ofp on January 15, 2012, 04:56:50 am
i know this is old sub, but i have a modified wpe dll and first time thru no detection iwas able to record a ton, but second time recording i was kicked#20 now i get kicked#21 any help?
thanks in advanced. i think the #21 is a flt but im new to recording and making filters.
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: Pride on January 15, 2012, 07:37:33 am
The way that wpespy.dll hooks winsock is probably ye olde detours trampoline, which is pretty obvious.

Although, I do believe ArmA2 is still vulnerable to dll consoleing as the last time I placed a custom winsock dll in the same directory it worked fine. (The actual filtering code in it, not so much.)

Hooking the SSDT is also undetected AFAIK, but it pisses off some virus scanners and is a PITA in x64 windows because of patchguard. (But should be good until he writes a system driver)
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: i mss old ofp on January 15, 2012, 10:41:22 pm
@ pride thanks for info, i edited some stuff(dont want to say public).
and to medic. practice what you preach, you caused first blood. even though you deleted the thread.
i never did anything to you, but you desided to listen to gossip. so its all on you, you dont want to post help (dont). i loose nothing.besides the fact i dont realy care to read riddles.
and out of respect to M.O. and Z i wont be involed with flaming games with you or anyone eles anymore.
Title: Re: Using WPE With ArmA2 (updated BE)
Post by: MrMedic on January 16, 2012, 12:16:44 am
i loose nothing.

ok  ... cheatless ...  :smile.

youve been caught leaking mate , my stuff to gerk and gerks stuff to me.

gerk shown me some scripts i had only sent only to you , lieing to us all saying you know how to mod-app also and now you are asking how to make a filter on wpe ? explain.

i dont 'really dont' care about the scripts ofp , it's the lies.

your a liar simple as that. :wink2.. done , washing my hands of you.