Author Topic: Using WPE With ArmA2 (updated BE)  (Read 5140 times)

0 Members and 1 Guest are viewing this topic.

[TKC]Wesker

  • ArmA's Most Wanted
  • The Central Committee
  • Master Heckler
  • *
  • Posts: 2209
  • The Illusive Man
    • View Profile
    • TKC Tube
Using WPE With ArmA2 (updated BE)
« on: December 24, 2010, 01:22:59 am »
Here is how to use the unmodified WPE without getting kicked after getting into the game.
This method will not get you into the game with WPE running.

All you need is Winject 1.7b

1) Open WPE Pro
2) Set your filters
3) Join the game lobby
4) Close WPE
5) Load WinJect
6) Target Process "ArmA2OA.exe"
7) Click the "..." just to the right
8) Select WPEspy.dll and eject it!
9) Close Winject and enjoy the game.

WPEspy was attaching itself to the ArmA2OA process. Even after you close WPE the dll is still attached to ArmA getting you kicked by BE!
This method removes the DLL from the games memory so you can get into the lobby with your packet filters.
« Last Edit: December 25, 2010, 04:54:34 pm by [TKC]Wesker »

The Illusive Man

MrMedic

  • MasstKer
  • ********
  • Posts: 8900
  • programmer/dev/software engineer
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #1 on: December 24, 2010, 01:52:32 am »
thanks for shareing man , good stuff.
EnCoded Message: i3iy9yl8kr2xf3g2Txs3pr6ye3ya7jg5ty2z

https://www.youtube.com/watch?v=62_7-AYfdkQ
you need a paypal account for the private versions.

Website:
http://bit.ly/medic101

Teamspeak 3: 85.236.101.5:10157

Pride

  • Klass Klown
  • ***
  • Posts: 332
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #2 on: December 24, 2010, 04:23:42 am »
I think you mean ArmA2OA.exe

:P

karmalover

  • I canz carpet bomb joo?
  • Online Villain
  • ***
  • Posts: 201
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #3 on: December 24, 2010, 04:41:49 am »
nice contribution, :icon_thumbsup

still need to record packets...

Double Hack

  • Klass Klown
  • ***
  • Posts: 254
  • Do a barrel roll
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #4 on: December 24, 2010, 04:45:07 am »
great idea, tried it but i have "GetEprocessBase failed because No Process- Handles owned by CSRSS

and when I try to eject it says "Couldn't Eject! Remote FreeLibrary() fails"

anyone know why i get these messages and help?

-crashes game when i eject it


Double H-a-c-k, the Original Spoof clown XD

[TKC]Wesker

  • ArmA's Most Wanted
  • The Central Committee
  • Master Heckler
  • *
  • Posts: 2209
  • The Illusive Man
    • View Profile
    • TKC Tube
Re: Using WPE With ArmA2 (updated BE)
« Reply #5 on: December 25, 2010, 04:47:57 pm »
great idea, tried it but i have "GetEprocessBase failed because No Process- Handles owned by CSRSS

and when I try to eject it says "Couldn't Eject! Remote FreeLibrary() fails"

anyone know why i get these messages and help?

-crashes game when i eject it
What OS are you using?
Also is it possible an antivirus or firewall is blocking anything?

I'm doing this with Windows7 64.
Also I remember doing it in the past with XP 32

@Pride +1  :icon_thumbsup
« Last Edit: December 25, 2010, 05:11:48 pm by [TKC]Wesker »

The Illusive Man

Bellend

  • Klass Klown
  • ***
  • Posts: 297
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #6 on: December 26, 2010, 10:43:12 am »
nice contribution, :icon_thumbsup

still need to record packets...
You can log packets with Wireshark. Some admins use it to detect scripts being sent to the server. :icon_shifty

Double Hack

  • Klass Klown
  • ***
  • Posts: 254
  • Do a barrel roll
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #7 on: December 26, 2010, 01:52:39 pm »
nice contribution, :icon_thumbsup

still need to record packets...
You can log packets with Wireshark. Some admins use it to detect scripts being sent to the server. :icon_shifty

Is there a way to inject the WPE spy.dll into Wireshark and filter the same way as WPE?

BTW, I'm using Windows Vista 32 bit


Double H-a-c-k, the Original Spoof clown XD

s3v

  • First Post
  • *
  • Posts: 1
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #8 on: January 08, 2011, 01:39:37 pm »
Game crashes soon as I hit OK after ejecting the .dll.

Running Win7 64bit

Fury

  • Online Villain
  • ***
  • Posts: 124
  • i̺͇̯̟̗m̤̬p͈̠̖o̫̭̦̼ͅrt͈̝̞ antigravity
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #9 on: February 08, 2011, 04:31:56 pm »
Game crashes soon as I hit OK after ejecting the .dll.

Running Win7 64bit

This is correct, it crashes for me too. W7 64bit
My programming language is common sense and communication. ♥

i mss old ofp

  • Insane Joker
  • ****
  • Posts: 982
  • i love the fact that you hate me.
    • View Profile
    • TKC
Re: Using WPE With ArmA2 (updated BE)
« Reply #10 on: January 15, 2012, 04:56:50 am »
i know this is old sub, but i have a modified wpe dll and first time thru no detection iwas able to record a ton, but second time recording i was kicked#20 now i get kicked#21 any help?
thanks in advanced. i think the #21 is a flt but im new to recording and making filters.
692063616E206C6F616420612070626F6F6E2074686520666C79206C6D616F00

the joke is you!!!!

Pride

  • Klass Klown
  • ***
  • Posts: 332
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #11 on: January 15, 2012, 07:37:33 am »
The way that wpespy.dll hooks winsock is probably ye olde detours trampoline, which is pretty obvious.

Although, I do believe ArmA2 is still vulnerable to dll consoleing as the last time I placed a custom winsock dll in the same directory it worked fine. (The actual filtering code in it, not so much.)

Hooking the SSDT is also undetected AFAIK, but it pisses off some virus scanners and is a PITA in x64 windows because of patchguard. (But should be good until he writes a system driver)

i mss old ofp

  • Insane Joker
  • ****
  • Posts: 982
  • i love the fact that you hate me.
    • View Profile
    • TKC
Re: Using WPE With ArmA2 (updated BE)
« Reply #12 on: January 15, 2012, 10:41:22 pm »
@ pride thanks for info, i edited some stuff(dont want to say public).
and to medic. practice what you preach, you caused first blood. even though you deleted the thread.
i never did anything to you, but you desided to listen to gossip. so its all on you, you dont want to post help (dont). i loose nothing.besides the fact i dont realy care to read riddles.
and out of respect to M.O. and Z i wont be involed with flaming games with you or anyone eles anymore.
692063616E206C6F616420612070626F6F6E2074686520666C79206C6D616F00

the joke is you!!!!

MrMedic

  • MasstKer
  • ********
  • Posts: 8900
  • programmer/dev/software engineer
    • View Profile
Re: Using WPE With ArmA2 (updated BE)
« Reply #13 on: January 16, 2012, 12:16:44 am »
i loose nothing.

ok  ... cheatless ...  :smile.

youve been caught leaking mate , my stuff to gerk and gerks stuff to me.

gerk shown me some scripts i had only sent only to you , lieing to us all saying you know how to mod-app also and now you are asking how to make a filter on wpe ? explain.

i dont 'really dont' care about the scripts ofp , it's the lies.

your a liar simple as that. :wink2.. done , washing my hands of you.
« Last Edit: January 16, 2012, 12:49:34 am by MrMedic »
EnCoded Message: i3iy9yl8kr2xf3g2Txs3pr6ye3ya7jg5ty2z

https://www.youtube.com/watch?v=62_7-AYfdkQ
you need a paypal account for the private versions.

Website:
http://bit.ly/medic101

Teamspeak 3: 85.236.101.5:10157