dsetup.dll is setting off malware alert

[Grimjaw]

Originally Posted by abacab-101 [You must be logged in to view images. Log in or Register.]

The file is obfuscated, and has two anti-cracking methods put into place; the first is the encryption and the block against .NET Reflector editing, it jumbles up the text and actively block compilers there are ways around that but I won't post that here.

The second is when it's edited a Project1999 pop-up comes up that says "this file has been corrupted, modified, and changed" as well as the DLL-2 error that pops up; the trick here is to maintain the file integrity and size; since most of the file has bullshit hex for filler (the lines upon lines of CC CC CC CC CC and 00 00 00 00 00) that must be maintained to keep the file from being rejected by the p99 client.

DLL has been cracked it's not hard at all.

so what does it do then lol? U can read pcode?

[abacab-101]

Originally Posted by Grimjaw [You must be logged in to view images. Log in or Register.]

so what does it do then lol? U can read pcode?

1. It's a callback
2. It causes an overflow on third-party programs, when you D/C it flags you because it sends out bad packets that the server then collects from your client; since MQ2 can't function well when the dsetup.dll is running at x100000 as opposed to the normal x0200 of eqgame.exe it disconnects the moment your character hits the world and reads the very first packet.

[abacab-101]

P99's handle:
eqgame.exe (5556), DLL, C:\p99\dsetup.dll, 0x10000000

Normal handle:
eqgame.exe (5556), DLL, C:\everquest\dsetup.dll, 0x02000