m0d_sa FenixZone AC Bypass

Hello UGBASE,
Iam releasing my analysis knowledges about FenixZone Anticheat and solution to prevent being detected.

Basically everything is here
github.com

GitHub - WaterinoS/FenixZoneACBypass: Mehehehehe

Mehehehehe. Contribute to WaterinoS/FenixZoneACBypass development by creating an account on GitHub.
github.com github.com

I would start how they managed to load the anticheat into process memory:
Its Basic RCE (Remote Code Execution) via RPC_ShowDialog
Its ilegall to use RCE

How you can detect incoming malicious rpc like this one?
  • Make IncomingRPC Hook
  • Check for RPC_ShowDialog
  • Check packet size .. MaxSize of every normal dialog is 33000, but they oversized it (injected assembly via that so its around 382032 b (unpacked its ~ 220kb))
  • All you need to do is to get bitstream data and check every byte until you found byte[0] = 'M' && byte[1] = 'Z' (dont need to explain to experienced people) then just extract assembly from start to end of the bitstream..
  • Well now you have assembly whats next?
Use snippets here and you have complete bypass, cuz I did all the work for ya...
github.com

FenixZoneACBypass/snippets.cpp at main · WaterinoS/FenixZoneACBypass

Mehehehehe. Contribute to WaterinoS/FenixZoneACBypass development by creating an account on GitHub.
github.com github.com

Their modules explained:
nz.dll - Basic dll being injected by RCE too (33kb) it basically contains export to load PE into memory from path.. if iam not mistaken
anti-key.asi - be careful, they also extracting random named .asi file (in this case anti-key) into ur gta sa directory, but its basically just dll downloader and loader..
nzeE831D.tmp - Obfuscated assembly (easy to deobfuscate, but iam not gonna share the src to keep something for myself), which contains crypted/packed (via MPRESS) assembly which is our anticheat file. => its basically self unpacker (thats the file we are focusing in IncomingRPC hook primary)
discord-rpc.dll - dont need to explain.. not dangerous
etc

How they communicate (client-server)?
Well I didnt spent lof of time analyzing this.. but I would say they making shadow copy of sendto and also sending ingame commands like /buto, /cuco etc.. and these commands are important !

/cuco [message] => i dont really know what it does, but I guess its also verified on the serverside.. lets say [message] is number somehow generated and stored in variable - if you call original you are basically fine.
/buto [message] - well this one is improtant cuz every 15th call of one callback its sending /buto <hex> which i reversed and this one is primary checked on the server - if it does not match with their side => KICK
and with every command comes also sendto on their server, you can find their server ip by urself. (ports are randomly generated - its opening socket, sendto and then just instant close)

What this anticheat do?
  • Memory scans
  • Module scans
  • Window handles scans
  • .ASi/.SF/.CS Scans
  • SAMPFUNCS Console Detections
Just fokin everything

If you want to know more - do research by urself. :)
Also I will release #TE Project 1.0.2.5fz (spec. edition) with FZ bypass soon on our discord server.
If you have any questions then my discord is watersmoke

Thanks to CikaUIF (CikaDjokica) for help with analysis, crack.

Enjoy

​
 

Attachments

  • bypassed.png
    bypassed.png
    2.2 MB · Views: 231
Click to expand...
Expl01T3R

Expl01T3R

Active member
Joined
Nov 20, 2022
Messages
181
Solutions
1
Reaction score
38
Location
Czech Republic
youngDro said:
Patched in S1 again!
Click to expand...
Yea actually iam lazy to update it again, cuz these monkeys from FZ are somehow more active than before.
As I mentioned earlier, the only solution is to take them down forever by filling criminal report of RCE abuse and I did that already but OVH is not responding.
Gonna remind myself.
 
Expl01T3R

Expl01T3R

Active member
Joined
Nov 20, 2022
Messages
181
Solutions
1
Reaction score
38
Location
Czech Republic
Working on update since I have time now.
But they blocked me somehow on all RP servers, i am not sure what they're detecting .. its not gpci, its not ip, its not nickname, maybe they have vpn&country check or iam not sure at all.
Iam getting kicked after being spawned, so iam searching for testers, iam developing universal bypass against these FZ staff rats but I cant test it anymore so ..

my discord is watersmoke
 
Expl01T3R

Expl01T3R

Active member
Joined
Nov 20, 2022
Messages
181
Solutions
1
Reaction score
38
Location
Czech Republic
Thanks these people that came with their accounts which I used for testing.
Anyways heres the update:
There are mem checks which I failed to patch cuz they are reading value internally which is really hard to hook.. maybe when I will have more time.. we will see
So basically for now u can't:
  1. You can't use #TE Project <= 1.0.2.6 or any sobeit, since it is hooking cped constructor on wrong address, so they gonna detect is as "s0beit".,
  2. You can't use infinite run,
  3. You can't use godmode,
  4. You can't use sampfuncs,
  5. Not sure about moonloader or modloader.
Otherwise bring hell there.
DL: https://github.com/WaterinoS/rce_protection/blob/main/output/rce_protection.asi
Preview:
 
SobFoX

SobFoX

Expert
Joined
Jul 14, 2015
Messages
1,539
Solutions
7
Reaction score
945
Location
Israel
Expl01T3R said:
Thanks these people that came with their accounts which I used for testing.
Anyways heres the update:
There are mem checks which I failed to patch cuz they are reading value internally which is really hard to hook.. maybe when I will have more time.. we will see
So basically for now u can't:
  1. You can't use #TE Project <= 1.0.2.6 or any sobeit, since it is hooking cped constructor on wrong address, so they gonna detect is as "s0beit".,
  2. You can't use infinite run,
  3. You can't use godmode,
  4. You can't use sampfuncs,
  5. Not sure about moonloader or modloader.
Otherwise bring hell there.
DL: https://github.com/WaterinoS/rce_protection/blob/main/output/rce_protection.asi
Preview:
Click to expand...
Good job.
 
F

francis7777

Member
Joined
Jan 11, 2024
Messages
7
Reaction score
6
You're really confused. You need to understand one thing: the server is clean and no one wants to use cheats anymore. When they do, their accounts get blocked and they can't play again. No one uses cheats — you're working for nothing, just wasting your time. Your trash is detected, no one uses that garbage anymore. Go do something else, lammer. Hahaha.
 
Expl01T3R

Expl01T3R

Active member
Joined
Nov 20, 2022
Messages
181
Solutions
1
Reaction score
38
Location
Czech Republic
francis7777 said:
You're really confused. You need to understand one thing: the server is clean and no one wants to use cheats anymore. When they do, their accounts get blocked and they can't play again. No one uses cheats — you're working for nothing, just wasting your time. Your trash is detected, no one uses that garbage anymore. Go do something else, lammer. Hahaha.
Click to expand...
Why are you mad?
Server is clean in your dreams.
Hopefully your FZ shitty server abusing RCE will get pwned soon, the "abuse requests" on multiple services that you are using are under review.
Remember that your server is avoiding the laws, meaning if I take your server down u can't do anything against me otherwise you would bring down your server aswell. And trust me, I will soon, OVH wouldn't be able to do anything for you.
Good luck.
 
F

francis7777

Member
Joined
Jan 11, 2024
Messages
7
Reaction score
6
It's completely clean — no one uses cheats. If someone did, they'd be reported, I would review it, and they'd be banned. But there are no reports. Nobody wants cheats anymore. You don’t know that because you're not part of the community. All that's left for you is to cry. I'm not angry, I'm just giving you some advice: you're wasting your time.
 
Expl01T3R

Expl01T3R

Active member
Joined
Nov 20, 2022
Messages
181
Solutions
1
Reaction score
38
Location
Czech Republic
francis7777 said:
It's completely clean — no one uses cheats. If someone did, they'd be reported, I would review it, and they'd be banned. But there are no reports. Nobody wants cheats anymore. You don’t know that because you're not part of the community. All that's left for you is to cry. I'm not angry, I'm just giving you some advice: you're wasting your time.
Click to expand...
I do not care if anyone wants to cheat on your server, i just gave people a way to be able to.
If you think iam crying cuz of some fz server abusing RCE, then you are completelly lost XD
I have better things to do than crying about ur poor server.
 
F

francis7777

Member
Joined
Jan 11, 2024
Messages
7
Reaction score
6
You gave them a way to lose their accounts — your trash is detected. You wasted your time for nothing. No one used it, and no one ever will, because they'd just lose their accounts. All you can do now is cry. The server will keep running like always, whether you like it or not. Loser.
 
You must log in or register to reply here.
Top