ArmA 2 site hacked

[-Puma- 2]

the prog is gonna crash in the first day of year 2000 because of millennium bug, destroys all the data of host computer, and makes the users vein in the brain to bleed and cause a quick death :eek:

[klamacz 448]

it can be implemented that message pops up not when date is set but when it changes to date, so at the moment of change or even in more complicated way.

I assume that devs from BIS knows how to write a simple program that cannot be hacked like that. If they want us to wait, we will need to wait.

Another thing, this app should be tested before giving it to us, testers arent supposed to wait 2 days to check final results, there has to be some way to set time, maybe using params during execution. I tried some standard but no luck

[PeterBitt 10]

my guess is that we have to run the exe for the magical 42 hours and get the next hack directly displayed on our computers!

[Muahaha 10]

i bet they are anticipating that we will run it till sunday or monday, which also will be the time when Ivan present the project. Snippet for us a few hours before the actual announcement.

[maddogx 13]

I now have a simple AutoIt script monitoring the lower text part in the window for new messages. I'll leave this computer running over the next few days and see if anything pops up.

For anyone else who wants to try it, install AutoIt and run this script (copy code into an *.au3 file):

$oldtxt = ""

While True
$txt = ControlGetText("Searching.", "", "Static2")
If $txt <> $oldtxt Then
	$fh = FileOpen("D:\log.txt", 1)
	FileWrite($fh, $txt & @CRLF)
	FileClose($fh)
	TrayTip("New message!", $txt, 10)
	$oldtxt = $txt
EndIf
Sleep(1)
WEnd

Make sure to modify the "D:\log.txt" part to something that suits you. The script should find the running window (no need to restart the time seeker) and will note any changes, starting with the initial value, to the log file.

Can a few more people please run this.

I'm at work now and can't guarantee that my comp won't be restarted over night by a scheduled update. You can leave the Seeker exe running, just start the AutoIt script and it will monitor it for changes.

Edited May 11, 2011 by MadDogX

[Alwarren 2767]

"This file has a non-standard resource layout... it has probably been compressed with an "EXE compressor"."

That's the Res Hack error message when you try and view the dialog in the .exe.

Already said, the binary is compressed with upx

[DancZer 65]

http://www.virustotal.com/file-scan/report.html?id=c383be275f79c040fd4a1969bc551d1fa0e59326fbac037ec899f9c5899106c0-1305111394

PAK_Generic.001

[maddogx 13]

http://www.virustotal.com/file-scan/report.html?id=c383be275f79c040fd4a1969bc551d1fa0e59326fbac037ec899f9c5899106c0-1305111394

PAK_Generic.001

In other words: oh noes a compressed executable! Run for the hills!

[klamacz 448]

After decompressing I can functions like: __getmainargs, GetCommandLineA

I suppose there can be some params :)

[SwiftyBoy 0]

Already said, the binary is compressed with upx

Cheers mate, wondered what that meant... OK Smart Alec, I've just run Create Dump File inTask Manager on seeker.exe and it's saved it out a .dmp file. Gives the usual load of gibberish when opened in notepad but also lots and lots of readable text.

Is it likely there'll be any clues in that, do you think?

PS it's a huge file.

[le_culto 0]

you can change the date with the cheat engine:

Uploaded with ImageShack.us

but the displayed text is only changed when a specific date is reached, so the best solution is to wait for someone with reverse engineering knowledge.

Edited May 11, 2011 by Le_CuLtO

[Bulldogs 10]

GIBS3000 anyone find a way to change that into a time/date?

[darkiron 1]

I wait to pass in 2011 :) that long maybe the solution and the next hack ....

still runnning

[Daniel 0]

Hopefully it'll ping at some other historic dates that feed the plot. Maybe some important Persian/Iranian or Greek dates.

[maddogx 13]

Hopefully it'll ping at some other historic dates that feed the plot. Maybe some important Persian/Iranian or Greek dates.

You're thinking the year number could stand for that year in any century, not strictly 19xx? That is a good point.

[Daniel 0]

Actually no I was still thinking 19xx, but yeah, that is a good point! :p

[Bulldogs 10]

Looks like my crazy time travel theory is getting some more support!

---------- Post added at 09:34 PM ---------- Previous post was at 09:33 PM ----------

Btw, may try the year 21 (Greek independence) and the dates on the map (first hack)

---------- Post added at 09:35 PM ---------- Previous post was at 09:34 PM ----------

Remember, those dates were an estimate, so around then

[klamacz 448]

found start date in EXE file:

0F 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

0A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

73 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00

now looking for other dates

[Yegor 10]

You're thinking the year number could stand for that year in any century, not strictly 19xx? That is a good point.

it can be only 1907...google 1907 Hague Convention.

[maddogx 13]

it can be only 1907...google 1907 Hague Convention.

I'm aware of that. Read my post properly.

I said the number does not strictly need to stand for 19xx. In this case it does, of course, but any further years that come up could point to events in different centuries.

Edited May 11, 2011 by MadDogX

[Tomatosauce 10]

10 OCT 11: Effective end of the Chinese Empire

[derdoe 10]

Tomatosauce, is this an output directly from seeker.exe?

[maddogx 13]

I'll be able to confirm in about ten minutes.

This would point to all dates being in the 1900's.

[LkFp 10]

You can speed up seeker a little by hexediting uncompressed exe.

Look for C74424085A (instruction which is setting timer timeout to 5A (90ms) on offset 0000:0924.

Now you can change 5A at the end to something lower. Minimum value is 0A (10ms). :)

[SwiftyBoy 0]

10 OCT 11: Effective end of the Chinese Empire

Wuchang Uprising of October 10, 1911. End of the Qing Dynasty.