Here's what happened, I play MTA-SA(Multiplayer San Andreas Game) and got banned of an online server. I still want to play on the same server however, so I tried changing my IP - didn't work, I tried re-installing MTA - didn't work, I tried re-installing with my hardware serials spoofed using an app called PB Downforce 0.2 - didn't work yet. Since all that MTA when banning is to store the hardware serial/IP/username - I tried changing all but so far it hasn't work. And I suspect that the hardware-spoof tool that I'm using maybe it fault for if it is indeed working as it should(and properly), then I should be able to bypass the ban on the server, no? Or is it that MTA stores some other info too to identify the banned person?
Mta San Andreas Serial Number. How to change hard disk serial number. Mta san andreas bypss cheat engine 6.3 - Duration.
Is there any other way or tool that you guys know that does hardware-spoofing or can get me around solving this problem? Here's the tool that I used for hardware-spoofing - PB Downforce 0.2
Mta San Andreas Dowload
Mod Edit: Link removed, failure to resolve - Hamluis. Please help and thanks in advance to anyone who does.
Edited by hamluis, 26 May 2012 - 02:16 PM.
Mta San Andreas How To Car Install
UnKnoWnCheaTs - Multiplayer Game Hacks and Cheats> Anti-Cheat Software & Programming> General Programming and Reversing
[Coding] MTA serial generation
sponsored advertisement
Thread Tools
MTA serial generation
1st August 2017, 12:07 AM
#1
Member
Posts: 65
Level up: 88%, 140 Points needed
https://wiki.multitheftauto.com/wiki/Serial Since few days I'm trying to generate/spoof new MTA serial. What I've already tried: - Hooking WMI(it uses it for retrieving bios serial etc., but hooking doesn't change serial) - Hooking DeviceIoControl (it uses it as well, for retrieving hard drive serial, seems to be called on each connect with the server) didn't work - Hooking GetAdaptersInfo for MAC spoof - didn't work - Hooking internal API function GetSerial (netc.dll) worked, the serial looked changed but when joining the server original serial was used(probably there's one more ) - Reinstalling GTA+MTA and hooking again in the hope it will change. Additional info: the serial is also stored in the registry but it doesn't mean anything as the serial used in hand shakes is in memory. Other possibilities: - SID (generated uniquely on each new windows installation), there's a changer available http://www.stratesave.com/html/sidchg.html but I'm afraid to use it and prefer to do it without modifying my system. Some people tell their serial changed after upgrading/reinstalling their windows. - The serial is stored somewhere on the hard-drive, or just a binary with hardware data. Did you manage to reverse what is used to generate the serial/or where the serial is stored? Netc.dll is injected in both Multi theft auto.exe and gta_sa.exe but 90% it's generated in gta_sa.exe I'm doing it for purely educational purpose and not intend to hack on servers, as I'm just curious of the method but it's kept as a 'secret' and knowledge only available to MTA staff. They also have the driver FairplayKD.sys but I doubt it's generated there. It is a 'sandbox'. The serial is an MD5 hash most probably (or not 128bits = 16 bytes) but I doubt advapi32.dll functions are used for that.
Address Size Label ------- ---- ----- .text:100192DB 0010 RIPEMD-128 InitState [32.le.16&] .text:10021B19 0004 TEA1_DS [32.le.4] .text:1003581D 0014 SHA1 / SHA0 / RIPEMD-160 initialization [32.le.20&] .text:10106F61 0015 anti-debug: anti-VMWare [..21] .text:1013B6BA 000C function where is handled the ZipCrypto password [32.le.12&] .text:10151203 0008 classical random incrementer 0x343FD 0x269EC3 [32.le.8&] .rdata:10271400 0040 padding used in hashing algorithms (0x80 0 ... 0) [..64] .rdata:103737C8 003E rfc3548 Base 64 Encoding with URL and Filename Safe Alphabet [..62] .rdata:103737C8 0040 B64EncodeTable [..64] .rdata:1037E0C8 0400 Adler CRC32 (0x191b3141) [32.le.1024] .rdata:1037E4C8 0400 Adler CRC32 (0x01c26a37) [32.le.1024] .rdata:1037E8C8 0400 Adler CRC32 (0xb8bc6765) [32.le.1024] .rdata:1037FF60 0100 Zlib length_code [..256] .rdata:10380060 0200 Zlib dist_code [..512] .rdata:10380260 0074 zinflate_lengthExtraBits [32.le.116] .rdata:103802D8 0078 zinflate_distanceExtraBits [32.le.120] .rdata:103808B0 0074 Zlib base_length [32.le.116] .rdata:10380928 0078 Zlib base_dist [32.le.120] .rdata:103AA518 0011 anti-debug: IsDebuggerPresent [..17] .rdata:103AAA5C 0015 Windows CryptAcquireContext [..21] .rdata:103AAAB0 0010 Windows CryptCreateHash [..16] .rdata:103AAAC2 000E Windows CryptHashData [..14] .data:103AB058 0120 SHA224 [32.le.288&] .data:103AB058 0020 SHA224_DS [32.le.32] .data:103AB078 0020 SHA256 Initial hash value H (0x6a09e667UL) [32.le.32&] .data:103AB078 0120 SHA256 [32.le.288&] .data:103AB07C 0010 Crypton kp [32.le.16] .data:103AB098 0040 Initial hash value H for SHA-384 and SHA-512 [64.le.64&] .data:103AB098 02C0 SHA384 [64.le.704&] .data:103AB0D8 0040 Initial hash value H for SHA-512 [64.le.64&] .data:103AB0D8 02C0 SHA512 [64.le.704&] .data:103AB118 0100 SHA256 Hash constant words K (0x428a2f98) [32.le.256] .data:103AB218 0280 Hash constant words K for SHA-384 and SHA-512 [64.le.640] .data:103ABC70 0040 padding used in hashing algorithms (0x80 0 ... 0) [..64] .tls:103E0007 0040 padding used in hashing algorithms (0x80 0 ... 0) [..64]
Help appreciated in my research as I'm really curious what is behind it... but trying to do it by myself makes me cry.
Last edited by BackDoorMan; 1st August 2017 at 01:14 AM.
BackDoorMan is offline
2nd August 2017, 03:42 PM
#2
Member
Join Date: Jul 2013
Reputation: 572 Rep Power: 144
Level up: 88%, 140 Points needed
Update: the serial is generated from 'checksum' stored in the registry, it's not even md5(HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMulti Theft Auto: San Andreas All1.5Settingsgeneral) value is named 'cachechecksum'. Checksum looks like: 12CC2B5B:4B4552GGCCGGDF5FF:F4213 It is hashed with MD5: 540D6A2D8D207A67FF77D91D29EBB448 Part of the hash is prepended to the checksum and 2nd part of it is appended, the final value stored in registry looks like: 540D6A2D8D207A6712CC2B5B:4B4552GGCCGGDF5FF:F4213FF77D91D29EBB448 The real serial shown in the console is simply this: 12CC2B5B:4B4552GGCCGGDF5FF:F4213 But 'obfuscated' a little bit(all characters are decreased by 1, : is replaced by 9) 01BB1A4A93A3441FFBBFFCE4EE9E3102 As you should've been noticed it's not even hexadecimal Spoofing the checksum works and the serial is changed. But still, it's not used in the connection phase. After removing the checksum the new checksum is added with RegSetValueExW. So we have to somehow trace the calls and find the origin... but it still ain't easy. The question still remains the same: how the checksum is generated and from where does it come from.
Last edited by BackDoorMan; 2nd August 2017 at 03:56 PM.
BackDoorMan is offline
14th August 2017, 05:01 AM
#3
n00bie
Posts: 1
u did it?
I apreciate your try, but, Did you finally get it?
vitorssi is offline
14th August 2017, 10:17 AM
#4
n00bie
Posts: 1
y on connection it changes back
peppapig12 is offline
18th August 2017, 03:05 PM
#5
n00bie
Posts: 1
Originally Posted by BackDoorMan
Update: the serial is generated from 'checksum' stored in the registry, it's not even md5(HKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMulti Theft Auto: San Andreas All1.5Settingsgeneral) value is named 'cachechecksum'. Checksum looks like: 12CC2B5B:4B4552GGCCGGDF5FF:F4213 It is hashed with MD5: 540D6A2D8D207A67FF77D91D29EBB448 Part of the hash is prepended to the checksum and 2nd part of it is appended, the final value stored in registry looks like: 540D6A2D8D207A6712CC2B5B:4B4552GGCCGGDF5FF:F4213FF77D91D29EBB448 The real serial shown in the console is simply this: 12CC2B5B:4B4552GGCCGGDF5FF:F4213 But 'obfuscated' a little bit(all characters are decreased by 1, : is replaced by 9) 01BB1A4A93A3441FFBBFFCE4EE9E3102 As you should've been noticed it's not even hexadecimal Spoofing the checksum works and the serial is changed. But still, it's not used in the connection phase. After removing the checksum the new checksum is added with RegSetValueExW. So we have to somehow trace the calls and find the origin... but it still ain't easy. The question still remains the same: how the checksum is generated and from where does it come from.
Which file's has is the cachechecksum?
HTCLevii is offline
14th March 2018, 03:48 PM
#6
Registered User
Posts: 4,733
Level up: 0%, 1 Points needed
Cachechecksum is a registry value, other serial values are used, peek around in different places, server sends back new cachechecksum with packet id 2, blablabla, serial generation is in other place + there are multiple instances of it, so serial faking is hard but still possible
GDPR_Anonymous is offline
2nd June 2018, 12:56 AM
#7
n00bie
Posts: 1
First of all, sorry for my English (google). Allow me to congratulate you for your knowledge and the desire to learn that you have. Yes, apparently it is not an easy task, I spent only a few hours to see what it was about. And yes, most likely it takes binary data from hardware and there the serial is generated, I think the easiest thing would be to try to change all the serial or 'ids' of the hardware, system and then reinstall everything. If you find the solution please share it privately, so MTA does not look for another solution haha. Greetings.
mrpijerman is offline
Similar Threads
Thread
Thread Starter
Forum
Replies
Last Post
MTA Serial Bypass
Harsh320
Anti-Cheat Bypass
2
20th November 2016 06:59 PM
[Help] Change serial key MTA:SA 1.5.3
Potietjes
Other MMORPG and Strategy
0
1st November 2016 05:01 PM
[Help] MTA serial change
Unknownman1
Anti-Cheat Bypass
14
4th September 2016 04:33 PM
[Help] MTA:SA Serial ban Help please
Nour142
Other MMORPG and Strategy
0
3rd March 2016 01:37 PM
[Request] Multi Theft Auto 1.3 : Serial ban, How serial is counted