RMTers discuss P1999 dsetup.dll "includes some NSA-level intrusive scans on your PC"

[SyanideGas]

Originally Posted by simp403 [You must be logged in to view images. Log in or Register.]

So how could the EQClient executable access information outside of the access privelages it is granted when it's installed on the system? Swapping out a .dll file won't change these, meaning that P1999 can only access data within the process's allotted memory, in the locations on secondary storage specified by said access privelages, and data that is shared with the process by other processes it interacts with.

So how would the addition of a .dll file allow the EQClient to grab data from the web browser, which is an entirely separate process that does not interact with it whatsoever? How does this executable suddenly get full access to the file management system simply through the addition of a dll? Can someone please let me know if this is possible? I knly just graduated from Comp Sci, but all of these claims seem to be full of shit to me. Am I missing something here?

This sounds pretty legit

[Man0warr]

It doesn't, which is what Rogean and Secrets are saying. Unless the browser somehow interacted with the EQ executable.

[dafier]

So. If you try to read what's in your local mem space, it will start a logging process? Or is it modify only?

[Oleris]

the best part of the thread was secrets arguing with clayton (last name here) on the FB page.

[Secrets]

Originally Posted by Oleris [You must be logged in to view images. Log in or Register.]

the best part of the thread was secrets arguing with clayton (last name here) on the FB page.

[You must be logged in to view images. Log in or Register.]

[Stormfists]

Originally Posted by arsenalpow [You must be logged in to view images. Log in or Register.]

You're

You're.

[Ostros]

Fucking lol. I was hoping this would end up on RnF.

"YOU WON'T BELIEVE WHAT ROGAIN IS UP TO NOW. PLAYERBASES HATE HIM. FIND OUT WHAT HE CAN DO WITH A SINGLE DYNAMIC LINK LIBRARY."

You ultra-libertarian tinfoils make me confident in life.

[booter]

Originally Posted by Braknar [You must be logged in to view images. Log in or Register.]

Hahah touche.

Though this isn't new, this comes up often, the answer is the same every time.

Isn't that what Bush did?

[simp403]

Originally Posted by dafier [You must be logged in to view images. Log in or Register.]

So. If you try to read what's in your local mem space, it will start a logging process? Or is it modify only?

Every process is allotted a portion of memory it can use at runtime. This process cannot access the memory space of any other process by virtue of the process control board unless specifically allowed to do so. When you ask can "you" read, do you mean you as a user accessing the memory? It's definitely possible to grab the data in memory, but from what I've seen, a number of games, usually MMOs, have code built in that detects if you access its process memory and will kick you. This is implemented to help combat botting and I know ArcheAge had something like this in place.

[simp403]

Sorry for the double post. To clarify, I'm pretty sure you can still write a program that accesses the process memory of another process. This is what MQ does from what I gather. However, the process whose memory is being access can see what other processes are interacting with it, which is how I think anti-cheat measures are created to combat things like client-side hacking and grabbing or altering the game's memory.

This is what I believe Rogean's code does: it detects whether or not another program is accessing EverQuest's memory space and sends information on that program to his server. This is how he can see the filepath that MQ was installed in. When a program runs, it does not run as "program.exe". It runs as "C:/Program Files/fuckyou/program.exe". Being able to see the filepath and the machine's name does not mean the program has access to other information in your system.

Furthermore, the Everquest client code is not altered whatsoever by Rogean. I believe this means that it will only be able to access primary and secondary memory that the actual EverQuest game could access. In other words, Rogean cannot somehow change the client such that it can grab web browser information or other system information outside of the information it normally has access to just by adding in a dll file.