This project is no longer in development and was originally a private project. It's been made public for educational purposes, no support will be provided.
Clone: git clone --recurse https://github.com/0xZ0F/gw2.git
If needed, resolve submodules:
git submodule update --init --recursive
GW2FishingBot:
- Deprecated
- Python3
CryptIntercept:
- Build with Visual Studio
- Depends on:
- Microsoft Detours (NuGet package)
Proxy:
- Depends on:
- Requires Visual Studio QT extension.
- DO NOT open QT
.pro
file as it will overwrite the solution. - Open the solution file.
MS Detours: https://github.com/microsoft/Detours/wiki/FAQ#where-can-i-find-detourslib-and-detoursh
Release builds are recommended for use.
Launch the proxy. Once the game loads, inject the DLL.
The following is a very brief summary as to how the cheat works.
- The GUI will start a named pipe server (
\\.\pipe\Z0F_Pipe
).- Common/PipeManager.hpp.
- The pipe server is used to transport data, currently only unencrypted network packets, from the hook created by the DLL to the GUI.
- Proxy will inject DLL.
- DLL will connect to the pipe server.
- DLL will create an RPC server. This server is local-only using ALPC with NTLM authentication and encryption.
- See
GW2Hack::StartRPCServer
in CryptIntercept/CryptIntercept/GW2Hack.cpp. - RPC is the mechanism used to communicate changes to the DLL, such as enabling or disabling a cheat or changing values for cheats.
- In theory, with RPC almost any degree of control and customization is possible.
- See
- The DLL will resolve various offsets, function pointers, etc.
- The DLL will hook any initial functions it needs to, such as the packet encryption routine.
- At this point the DLL is in it's normal operating state.
- It will be mirroring unencrypted network traffic to the proxy, with the proxy having the option to intercept and modify packets.
- RPC calls can now be made to the DLL such as to enable a specific cheat.