# Forum > MMO > Blade and Soul Exploits|Hacks >  GameGuard is no longer running.

## Parog

That's right, nProtect's GameGuard is no longer running as of last patch. It did nothing good and is nothing more than a poor man's rootkit. Now that it's disabled, time to get to reversing.  :Smile:

----------


## Jackie Chan

Hmm so i can run, the Speedhack without any Problems... need to try  :Smile: 

Best Regards Jackie Chan

Edit: The Speedhack works, and no need Update (06.02.2015) and i hope i dont get detected!

----------


## Mr. Putin

Yeah it works thanks for the information, but i think its not a big mistake to dont use anything to protect from Cheaters or Botters? Ofcourse for us its great but i think the have some crazy guys who make the decisions wrong... or they want a better "GameGuard" anyone now more Information?

----------


## Parog

> Yeah it works thanks for the information, but i think its not a big mistake to dont use anything to protect from Cheaters or Botters? Ofcourse for us its great but i think the have some crazy guys who make the decisions wrong... or they want a better "GameGuard" anyone now more Information?


They did the same thing with AION, and I think it's still disabled. 

Of course, the game probably still has GameGuard's code inside, but it should not be active, or at the very least not intrusive and the only way to get banned would be to be unlucky and change something related to GameGuard and then deliberately send the crash information over to NCSoft when the application crashes. That is my experience with Devilian, a game which has GameGuard code, but gamemon.des isn't starting. 

It doesn't mean everything is safe, but it means gameguard doesn't need to be bypassed to do simple things like attaching Cheat Engine.

----------


## Jackie Chan

Hmm okay, so i need to hope what not to crash but that can i do with Cheat Engine? Sharps have done really good work with the Speedhack, but i think its not possible to get tons of money because thise files are on the Servers and not on my own Game data.... Or Clones Items like old Pokemon time...

----------


## Flubleah

doing this shit while it was active... GG is a joke. Also this game is boring as ****.

1.) Noob speed hax: Search float 248 for non-sprint, 434 sprinting
Note, non-sprinting can only go as high as 415 without rubberbanding

2.) Noob teleport hax not working, only thing you can do is freeze z-values. Teleporting will rubberband you.
Can teleport short distances, not really useful. If you want to find it, it'll be same memory region as speed, float values between 1000-100 000, XY are -4 bytes from Z, so just find Z and minus 4 bytes from it.
Ex.) 480CA05C (zvalue) - 4bytes = 480CA058 (yvalue) - 4bytes = 480CA054 (xvalue)

----------


## Jackie Chan

> doing this shit while it was active... GG is a joke. Also this game is boring as ****.
> 
> 1.) Noob speed hax: Search float 248 for non-sprint, 434 sprinting
> Note, non-sprinting can only go as high as 415 without rubberbanding
> 
> 2.) Noob teleport hax not working, only thing you can do is freeze z-values. Teleporting will rubberband you.
> Can teleport short distances, not really useful. If you want to find it, it'll be same memory region as speed, float values between 1000-100 000, XY are -4 bytes from Z, so just find Z and minus 4 bytes from it.
> Ex.) 480CA05C (zvalue) - 4bytes = 480CA058 (yvalue) - 4bytes = 480CA054 (xvalue)


Hmm we dont can duplicate items or somthing like else? Only faster Run, and yeah the game is boring but i help a Friend faster Leveling so its nice Game but not better than WoW for me  :Smile: 

Best Regards 
Jackie Chan

----------


## Parog

> doing this shit while it was active... GG is a joke. Also this game is boring as ****.
> 
> 1.) Noob speed hax: Search float 248 for non-sprint, 434 sprinting
> Note, non-sprinting can only go as high as 415 without rubberbanding
> 
> 2.) Noob teleport hax not working, only thing you can do is freeze z-values. Teleporting will rubberband you.
> Can teleport short distances, not really useful. If you want to find it, it'll be same memory region as speed, float values between 1000-100 000, XY are -4 bytes from Z, so just find Z and minus 4 bytes from it.
> Ex.) 480CA05C (zvalue) - 4bytes = 480CA058 (yvalue) - 4bytes = 480CA054 (xvalue)



Word of warning to anyone else attempting; Don't attach a debugger to the game. At least for me that crashed it. 

Guess I'll have to unpack it and run it through IDA if I want to find out more.

----------


## olaxwth

hey Parog, if you're working on reversing this game, i'm interested to work on this too, I pm you

----------


## mayainverse

how can I find the address for noclip?

----------


## Parog

Just had to poke around a bit. 

http://puu.sh/mYBSE/079a9e94aa.png

There's a lot of good information in that area of the memory when you start moving, you can see the relation between things easily. I'm not going to spoon feed; For those of you who want to learn, find the speed address from the post above, open memory view, right click the bottom part of the screen, go to address (The address with 248 that YOU found) and do the same for the top part. On the bottom part, press CTRL+9 to view the memory interpreted as Floats. Once you're done that, Now start moving and look at it. Some numbers you'll recognize. 


I just realized this is what Flubleah was talking about. GG Flub. 


EDIT: Just wanted to give you guys a tip so you don't make the same mistake I did. The game CAN be debugged with Cheat Engine. Just have to use a VEH debugger so you don't hit the trap. 


Use cheat engine with the VEH debugger:


In CE
Edit > Settings > Debugger options > Debugger method > Use VEH debugger

----------


## Skyechang

Maybe this will help everyone  :Smile: 

BNS Tools - Browse /bnsdat at SourceForge.net

----------


## Sharps

The nearby values next to the movespeed address. By the way theres a CE table with a pointer to that address in my thread.

Also thanks for the debugger tip.

----------


## Parog

> The nearby values next to the movespeed address. By the way theres a CE table with a pointer to that address in my thread.



What a god.

----------


## Yoyolo

> The nearby values next to the movespeed address. By the way theres a CE table with a pointer to that address in my thread.
> 
> Also thanks for the debugger tip.


Are you going to share that ?

----------


## Parog

> Are you going to share that ?


Technically, all the information you need is already shared in this thread, or even just in his last post. 

All you need is the pointer to the GroundSpeed, and go from there.

----------


## Yoyolo

> Technically, all the information you need is already shared in this thread, or even just in his last post. 
> 
> All you need is the pointer to the GroundSpeed, and go from there.


Technically i have no clue how to use the memory shit.
since nobody ever tried to explain me how that works or what i need to learn , so yeah i kinda gave up on that.

----------


## Parog

> Technically i have no clue how to use the memory shit.
> since nobody ever tried to explain me how that works or what i need to learn , so yeah i kinda gave up on that.


It's too broad of a subject to sit down with someone and teach. Have a look in the flash hacking section, there's some tutorials and there will be more to come to cover the basics. 

If you're learning from scratch, picking up a game where people haven't worked on yet might not be your best bet. Go pick a game like maplestory, or a flash game to learn the basics of it. Even though it's not the same language for flash (AS2 or AS3) as EXE/Binary files (C++ for the most part) the concept of how it's seen in the memory, registers, ASM and bytecode equivalent to ASM is the same process. That's what tremendously helps to understand before trying this.

----------


## igrim

> It's too broad of a subject to sit down with someone and teach. Have a look in the flash hacking section, there's some tutorials and there will be more to come to cover the basics. 
> 
> If you're learning from scratch, picking up a game where people haven't worked on yet might not be your best bet. Go pick a game like maplestory, or a flash game to learn the basics of it. Even though it's not the same language for flash (AS2 or AS3) as EXE/Binary files (C++ for the most part) the concept of how it's seen in the memory, registers, ASM and bytecode equivalent to ASM is the same process. That's what tremendously helps to understand before trying this.



It'd be cool to just hook us up , Or even just tell us how to do it.

----------


## mayainverse

so question. how did you guys even find this move speed thing to begin with? if the value is always the same. also how even know what actual number was?

----------


## mayainverse

I have used CE alot in the past. never have and still don't understand how to make/use pointers.

----------


## mayainverse

I found ones for X and Y but if i try to change the value even a very small amount. I do teleport but any movement will RB me back to my original spot even if I only moved it a few pixels forward.

----------


## Sharps

Movement speed increase when you sprint.

----------


## Yoyolo

> It's too broad of a subject to sit down with someone and teach. Have a look in the flash hacking section, there's some tutorials and there will be more to come to cover the basics. 
> 
> If you're learning from scratch, picking up a game where people haven't worked on yet might not be your best bet. Go pick a game like maplestory, or a flash game to learn the basics of it. Even though it's not the same language for flash (AS2 or AS3) as EXE/Binary files (C++ for the most part) the concept of how it's seen in the memory, registers, ASM and bytecode equivalent to ASM is the same process. That's what tremendously helps to understand before trying this.


Any tips where to start. ?

----------


## darkfuryex

> It's too broad of a subject to sit down with someone and teach. Have a look in the flash hacking section, there's some tutorials and there will be more to come to cover the basics. 
> 
> If you're learning from scratch, picking up a game where people haven't worked on yet might not be your best bet. Go pick a game like maplestory, or a flash game to learn the basics of it. Even though it's not the same language for flash (AS2 or AS3) as EXE/Binary files (C++ for the most part) the concept of how it's seen in the memory, registers, ASM and bytecode equivalent to ASM is the same process. That's what tremendously helps to understand before trying this.


hey bro a question to you, how long have you learn to hack since you got to where you are now? thanks for sharing the tips..im really interested in learning but dont know where to start from  :Frown: 

EDIT: also, since gg is down in this game, is it better to start learning how to edit memory with this game? thanks!

----------


## altf4thc

> The nearby values next to the movespeed address. By the way theres a CE table with a pointer to that address in my thread.
> 
> Also thanks for the debugger tip.


How do you know what some of these are? I dont understand how 310 is HP or how you know what these are when changing them does nothing. Please explain.

Also, for anyone looking. Coords are 054, 058, 05C.

----------


## KuRIoS

thanks sharp

----------


## mayainverse

> The nearby values next to the movespeed address. By the way theres a CE table with a pointer to that address in my thread.
> 
> Also thanks for the debugger tip.


how did you get names for all these addresses? someof them are straight forward and easy to recognize. but I dont get how you know something like lastpaintime. or alertness, now idea what that even is.

----------


## chaosrain34

Just letting you guys know, I've been banned twice in the past 4 days. The first time I was not sure what the reason was, because I was using both the Speedhack and the bypass. After the first unban I've only used the bypass and now I got banned again. I'm in the process of being unbanned right now and won't be using the bypass anymore and will report back after a week if I didn't get a ban again.

Edit: With bypass I mean Launcher/GameGuard bypass.

----------


## Parog

> Just letting you guys know, I've been banned twice in the past 4 days. The first time I was not sure what the reason was, because I was using both the Speedhack and the bypass. After the first unban I've only used the bypass and now I got banned again. I'm in the process of being unbanned right now and won't be using the bypass anymore and will report back after a week if I didn't get a ban again.
> 
> Edit: With bypass I mean Launcher/GameGuard bypass.


Why would you use the bypass if there's nothing to bypass anymore? That's bound to raise some flags. 

I've been speed hacking with no bans so far. With private software. 

Keep us updated!  :Smile:

----------


## chaosrain34

I was using a .bat file to skip the launcher log in BS because it's annoying and not needed imo. I'll probably have to reinstall BNS as well since I think I also swapped some .dll files

----------


## porkie

Game guard is back, not that it really matters.

----------


## Kane49

> Game guard is back, not that it really matters.


not for me

----------


## Parog

> Game guard is back, not that it really matters.


What signs do you have that game guard is back exactly?

----------


## porkie

> What signs do you have that game guard is back exactly?


Because it updated and was in my system tray?

----------


## mykki

I dont have it

----------


## Parog

> Because it updated and was in my system tray?



Don't take my question the wrong way. A lot of people love to say things to try to help but don't really know what they really are. I just wanted to validate the information.

What server are you on? EU, US? I'm updating right now and would love to confirm.

I just don't see why you would have it run and everyone else says they don't. I'm not saying it's impossible though. Could be region based etc.


Edit: Finally had time to update and test myself. GameGuard is still not up for me on the US servers. Nothing in tray, no process. Ran public cheat engine, hooked it to the process and even speed hacked around without any gameguard messages.

----------


## porkie

> Don't take my question the wrong way. A lot of people love to say things to try to help but don't really know what they really are. I just wanted to validate the information.
> 
> What server are you on? EU, US? I'm updating right now and would love to confirm.
> 
> I just don't see why you would have it run and everyone else says they don't. I'm not saying it's impossible though. Could be region based etc.
> 
> 
> Edit: Finally had time to update and test myself. GameGuard is still not up for me on the US servers. Nothing in tray, no process. Ran public cheat engine, hooked it to the process and even speed hacked around without any gameguard messages.


When I updated my game yesterday, it told me to restart my pc for whatever reason and continue update, after that I had gamegaurd running. I actually watched it update itself then was running. Today though it doesn't seem to be running so sorry If I was kind of incorrect maybe it bugged out or something, but it did start yesterday. Im on EU server btw.

----------


## reksunami

so is there an unlimited health hack for this game ? need it for solo content only

----------


## mayainverse

there is no damage or god mode hack cause those values are server side. you can force your char to have 100% life but you will just end up dying randomly.


I also have game guard running. it does work if i delete files then start it because only 1 file is downloaded at a time basically each client start. so I have to constantly delete files all the time.

question. is ahk blocked/banned with GG? cause it gets old deleting files every time and it's all I really use. no real use for speed hack and I tried for like 20 hours to figure out a noclip and gained no ground. i only use a couple simple macros in pve for my FM since spamming mouse buttons gets old after a while.

----------


## Parog

I know it was on GG's shit list at some point. I also don't think it would work unless you can call keystrokes at kernel level. (If GG is running for you that is) So, hardware level. 

GG monitors virtual keystrokes (So keystrokes from windows and programs) and discards them if I remember correctly. So even if it didn't ban it, it wouldn't go through. I could be wrong, but that is how it used to be.

----------


## Parog

Well, it looks like GG is back. I wonder what those clowns at NCSoft are thinking.

----------


## mykki

> Well, it looks like GG is back. I wonder what those clowns at NCSoft are thinking.


Yeah it seems so. I killed it instantly thought i had no clue that GG was back and i was using bat to start my game and got notice GG is no more or what ever it said. Rofl. 

"hey lets deal with bots and put GG back" rofl  :Big Grin:

----------


## U_dont_kno_me?

ive had some pseudo GG running the past week, autoit macro i made stopped working but using the dll bypass did nothing.

----------


## Parog

You don't even need a DLL bypass. Just use the launcher shortcut. 

Credit: Skyechang

----------


## kjarlot

Definitely back now, not even hidden, you see it load when you launch the game.

----------


## Parog

I had it just like Pinkie, for a day, restarted my computer and it no longer launches. No gameguard anymore here.

----------


## adam66

I have been using the version dll and macro together now for a while have been picked up atleast 5 times and been locked, i'm wondering what is being picked up, i had the client.exe attached to the profile so it autoswitch while in game and active the profile, i have the mouse attached to it aswell and use repeat while button is being pressed down and release macro while releasing the key ofcourse. What is your guys suggestion, they said "third party program" before unlocking the account a few times so my guess is they dont see anything wrong but i'm still being picked up somehow? I use steel series engine 3.

----------


## DoichinMitrev

Hey guys. I didn't see where to ask this so thought maybe some of you in this thread already did it.

How can you unpack the BNS client and remove themida? 

I've been trying to do this for a few days now. I tried this guide in Windows 10/7/xp/7 32 bit, but it never worked ( How Unpack Themida 2.x.x (WXP) - ZenHAX ) 

I'm trying to do this so I can run more than 1 instance of BNS on the same PC. Can anyone that has unpacked themida help me out please?  :Smile:  

Thanks!

----------


## Kane49

> Hey guys. I didn't see where to ask this so thought maybe some of you in this thread already did it.
> 
> How can you unpack the BNS client and remove themida? 
> 
> I've been trying to do this for a few days now. I tried this guide in Windows 10/7/xp/7 32 bit, but it never worked ( How Unpack Themida 2.x.x (WXP) - ZenHAX ) 
> 
> I'm trying to do this so I can run more than 1 instance of BNS on the same PC. Can anyone that has unpacked themida help me out please?  
> 
> Thanks!


Initial Unpacking is easy, use the unpack script 1.4 like the guy in the first post says.
After that you need to fix the imports and rebase the program, i dont know how to do that though :P

----------


## Parog

> Hey guys. I didn't see where to ask this so thought maybe some of you in this thread already did it.
> 
> How can you unpack the BNS client and remove themida? 
> 
> I've been trying to do this for a few days now. I tried this guide in Windows 10/7/xp/7 32 bit, but it never worked ( How Unpack Themida 2.x.x (WXP) - ZenHAX ) 
> 
> I'm trying to do this so I can run more than 1 instance of BNS on the same PC. Can anyone that has unpacked themida help me out please?  
> 
> Thanks!


You'd be better off making your own thread for that one.  :Smile:

----------

