ArmA 2 site hacked

[PuFu 4591]

Wow, that's not a bad idea. Not FRAPS - that won't work - but some free desktop recording tool.

Make it take a screeny of the program every minute or so.

Fraps can take a ScreenShot every nth second as long as you have free space. one each 5 mins would do i guess

[Kaelas 10]

I through it into resource hacker and see only one dialogue, and its not very big, I think that's the only message.

[PuFu 4591]

I note my prog :

where XXXX are numbers ...

strange ?

edit

Sion have more sense ! :D

ddHHmmZMMMYY

*dd -day

*HH -hour

*mm -minute

*MMM -month

*YY -year

[purepassion 22]

well then we should try to work with the result we already have

^^ i also think there wont come much in the future

but sb should still let it run for security

[ceeeb 147]

string "cord found" exists within the executable.

[Yegor 10]

im in SEptember october december January 2010 1911

:(

Edited May 11, 2011 by Yegor

[SwiftyBoy 0]

"This file has a non-standard resource layout... it has probably been compressed with an "EXE compressor"."

That's the Res Hack error message when you try and view the dialog in the .exe.

[tonygrunt 10]

So I managed to find the memory values with cheat engine that change DD/MM/YYYY in seeker.exe.

No idea what countermeasures BIS used for changing values.

Any idea what kind of date I should search for?

Edited May 11, 2011 by TonyGrunt

[darkiron 1]

So I managed to find the memory values with cheat engine that change DD/MM/YYYY in seeker.exe.

No idea what countermeasures BIS used for changing values.

Any idea what kind of date I should search for?

exactly what kinf of file search ...

[SwiftyBoy 0]

So I managed to find the memory values with cheat engine that change DD/MM/YYYY in seeker.exe.

No idea what countermeasures BIS used for changing values.

Any idea what kind of date I should search for?

June 8th 2011.

[maddogx 13]

I now have a simple AutoIt script monitoring the lower text part in the window for new messages. I'll leave this computer running over the next few days and see if anything pops up.

For anyone else who wants to try it, install AutoIt and run this script:

$oldtxt = ""

While True
$txt = ControlGetText("Searching.", "", "Static2")
If $txt <> $oldtxt Then
	$fh = FileOpen("D:\log.txt", 1)
	FileWrite($fh, $txt & @CRLF)
	FileClose($fh)
	TrayTip("New message!", $txt, 10)
	$oldtxt = $txt
EndIf
Sleep(1)
WEnd

Make sure to modify the "D:\log.txt" part to something that suits you. The script should find the running window (no need to restart the time seeker) and will note any changes, starting with the initial value, to the log file.

Edited May 11, 2011 by MadDogX
added sleep

[klamacz 447]

@TonyGrunt

change it to 1st May 2011 if possible and see if it drops new messages when continuing

[Muahaha 10]

So I managed to find the memory values with cheat engine that change DD/MM/YYYY in seeker.exe.

No idea what countermeasures BIS used for changing values.

Any idea what kind of date I should search for?

try june 16, after Ivan's presentation.

[Darkhorse 1-6 16]

im in SEptember october 2010

No you aren't, not unless you hacked it. XX/XX/10 means the year 1910

[Yegor 10]

No you aren't, not unless you hacked it. XX/XX/10 means the year 1910

ah....Thanks) I've left it today in the morning and went to work...I missed couple of thread pages..

=(

[tonygrunt 10]

Not sure if it's working but I searched all of jun 2011 and nothing.

Maybe BIS used some anticheating :).

Now I am opening many instances of seeker.exe and searching simultaneously different years.

[maddogx 13]

Something tells me any further messages will be in the next 40-50 years, if at all. Getting to 2011 normally would require leaving the exe running until Sunday.

[-Puma- 2]

the prog is gonna crash in the first day of year 2000 because of millennium bug, destroys all the data of host computer, and makes the users vein in the brain to bleed and cause a quick death :eek:

[klamacz 447]

it can be implemented that message pops up not when date is set but when it changes to date, so at the moment of change or even in more complicated way.

I assume that devs from BIS knows how to write a simple program that cannot be hacked like that. If they want us to wait, we will need to wait.

Another thing, this app should be tested before giving it to us, testers arent supposed to wait 2 days to check final results, there has to be some way to set time, maybe using params during execution. I tried some standard but no luck

[PeterBitt 10]

my guess is that we have to run the exe for the magical 42 hours and get the next hack directly displayed on our computers!

[Muahaha 10]

i bet they are anticipating that we will run it till sunday or monday, which also will be the time when Ivan present the project. Snippet for us a few hours before the actual announcement.

[maddogx 13]

I now have a simple AutoIt script monitoring the lower text part in the window for new messages. I'll leave this computer running over the next few days and see if anything pops up.

For anyone else who wants to try it, install AutoIt and run this script (copy code into an *.au3 file):

$oldtxt = ""

While True
$txt = ControlGetText("Searching.", "", "Static2")
If $txt <> $oldtxt Then
	$fh = FileOpen("D:\log.txt", 1)
	FileWrite($fh, $txt & @CRLF)
	FileClose($fh)
	TrayTip("New message!", $txt, 10)
	$oldtxt = $txt
EndIf
Sleep(1)
WEnd

Make sure to modify the "D:\log.txt" part to something that suits you. The script should find the running window (no need to restart the time seeker) and will note any changes, starting with the initial value, to the log file.

Can a few more people please run this.

I'm at work now and can't guarantee that my comp won't be restarted over night by a scheduled update. You can leave the Seeker exe running, just start the AutoIt script and it will monitor it for changes.

Edited May 11, 2011 by MadDogX

[Alwarren 2766]

"This file has a non-standard resource layout... it has probably been compressed with an "EXE compressor"."

That's the Res Hack error message when you try and view the dialog in the .exe.

Already said, the binary is compressed with upx

[DancZer 65]

http://www.virustotal.com/file-scan/report.html?id=c383be275f79c040fd4a1969bc551d1fa0e59326fbac037ec899f9c5899106c0-1305111394

PAK_Generic.001

[maddogx 13]

http://www.virustotal.com/file-scan/report.html?id=c383be275f79c040fd4a1969bc551d1fa0e59326fbac037ec899f9c5899106c0-1305111394

PAK_Generic.001

In other words: oh noes a compressed executable! Run for the hills!