Suspicious data in WinHack

curiosity · Post by **curiosity** » Fri Jul 16, 2004 1:27 pm

While pluggin for the latest offsets, I found this in WinHack:

Visited: Owner@http://macroquest2.com/downlaods/MQ2-Latest.zip

also

Visited: Owner@http://www.olywa.net/cool/nhack.htm

and

Visited: Owner@http://macroquest2.com/phpBB2/viewforum.php?f=29&sid=58f1b90f176aa6de268a7d6cacf32f39

and

Code: Select all

Visited: Owner@file:///C:/Documents%20and%20Settings/Owner/Desktop/MQ2-Latest/README.txt

the list goes on and on. Look around the address 030DDXXX. Is this saying the SoE has full access to our recent files/websites? This could be scary....it would mean I need to delete all my histories and logs before I ever play EQ!!

MacroFiend · Post by **MacroFiend** » Fri Jul 16, 2004 2:20 pm

I'm going to smack you before someone else does.

WinHack can see ALL of the memory in your computer. You probably went outside the eqgame.exe process space and landed in part of your IE memory space. If SOE wanted to (and didn't care about violating your privacy and potentially breaking a few laws), they could find out anything they wanted to on your computer. They don't do that (yet) though.

Also, the memory address you mentioned wouldn't apply to anything other than your particular computer at that particular time. Memory is allocated dynamically. If you restarted your computer, you would find something completely different at that location.

curiosity · Post by **curiosity** » Fri Jul 16, 2004 3:05 pm

I was in the EQ memory range bud.....it was located in my EQ ini files. Go look it up

MacroFiend · Post by **MacroFiend** » Fri Jul 16, 2004 3:39 pm

What was the starting address of your eqgame.exe? What was the end? (Both of these are located next to the Quite button in WinHack) Is the address you mentioned seeing this stuff somewhere inside that range?

I seriously doubt it.

WinHack doesn't tell you when you are at the end of a process' active memory space, it just keeps going. You may have run in to garbage left over in that memory.

I went to the memory you mentioned and all I saw was uninitialized memory.

curiosity · Post by **curiosity** » Fri Jul 16, 2004 3:59 pm

My EQ adress is $00400000 - $093BD000, and the address of the info I found was 030DDXXX. That is definately in the range of EQ's memory. And I guess you're right, your memory address would be different then mine for that hehe....so you may have to search for it.

Mimatas · Post by **Mimatas** » Fri Jul 16, 2004 4:22 pm

Just cuz you visit the site, doesn't mean you use the program... for starters. Second, most of us already assume the following:

IF YOU USE MQ, YOU WILL GET BANNED.

Most of us just accept that getting caught is eventually gonna happen.. and we're prepared to go to another MMORPG when that happens... or better yet, get out and get laid. I'm not one to complain, but I'm kinda getting tired of all these "SOE's gonna getcha" posts.

If, in fact, you made no mistake and SOE is looking at our IE cache, that'd be rather interesting.

aChallenged1 · Post by **aChallenged1** » Fri Jul 16, 2004 4:24 pm

It may have fallen within the "memory" allocated to EQ but that does not mean that EQ was using it, yet.
As I seem to recall, programs are known to not flush code from memory addresses it will be using until it needs it.

Mimatas · Post by **Mimatas** » Fri Jul 16, 2004 5:02 pm

That's more likely aChallenged1. I didn't even think of that, but you're right.. many programs don't clean up memory before releasing it (helll, many don't even release it) when closing. Restart the computer, run EQ, then run IE... see if you see the same thing.

curiosity · Post by **curiosity** » Fri Jul 16, 2004 5:10 pm

Mimatas....what an idiot

Now on to better business, I'll just quote this one again, for you Mimatas:

Visited: Owner@http://macroquest2.com/downlaods/MQ2-Latest.zip

Yes, notice the name? That means you have downloaded MQ2. This doesn't mean you've used it, but hell who'm I kidding. If you've downloaded it, you've used it, and probably still are.

And you're right aChallenged1, just because it is in there doesn't mean it's affiliated with SoE, but the fact that it is resting in EQs memory range could arise some suspicion.

And this isn't a "SoE's gonna getcha" post. It is a post about suspicious content in EQs memory address....for the love.

Mimates...you suck. Don't ever post again on these forums, your intelligence is too low to comprehend 9th grade English. Who knows, maybe you're still in 7th grade....if so, MQ is too high for your intellect and you should go hang yourself.

Pheph · Post by **Pheph** » Fri Jul 16, 2004 5:25 pm

Actually, there was a post on the exact same subject a couple of months ago or thereabouts. Live with it, etc.

zanomo · Post by **zanomo** » Sat Jul 17, 2004 12:16 am

IF YOU USE MQ, YOU WILL GET BANNED.

Most of us just accept that getting caught is eventually gonna happen.. and we're prepared to go to another MMORPG when that happens... or better yet, get out and get laid. I'm not one to complain, but I'm kinda getting tired of all these "SOE's gonna getcha" posts.

Well said Mimatas...

While discretely using MQ, deep inside I am actually looking forward to this day...

And in fact, MQ is beginning to be the motivation of playing this game...

Lax · Post by **Lax** » Sat Jul 17, 2004 1:56 am

My EQ adress is $00400000 - $093BD000, and the address of the info I found was 030DDXXX. That is definately in the range of EQ's memory. And I guess you're right, your memory address would be different then mine for that hehe....so you may have to search for it.

LOL

phew. Hey, do me a favor, attach MS Visual Studio .NET debugger to eqgame.exe. Now do Debug->Windows->Modules. Now read the module list, starting from the top, and look at the address ranges.

EQ goes from 00400000 to 008B9000, a mere 4B9000 total (about 4.9mb). Your total on the othr hand is 8FBD000, which is about 150mb.

93BD000 is well into the address space of DLLs.

You're an idiot.. have a nice day

guest_01 · Post by **guest_01** » Sat Jul 17, 2004 3:02 am

Truthfully, quite aside from whether this is true or not (not going there, but doubt it), why would SoE bother to store your web history to look for MQ and such, when they could just store the list of running processes ? if you're using MQ2, it will show up in the process list.... seems much more logical to me than scanning through tons of web pages that you may or may not have actually acted on.

Sparr · Post by **Sparr** » Sat Jul 17, 2004 5:02 pm

MacroFiend wrote:If SOE wanted to (and didn't care about violating your privacy and potentially breaking a few laws), they could find out anything they wanted to on your computer. They don't do that (yet) though.

anyone who has been paying attention long enough will remember that sony DID do this. they were sending your running process list back to the servers. some hackers caught them, then there was a login poll ~"how would you feel if sony checked you for cheats?", and it PASSED, but they stopped anyways.

Pheph · Post by **Pheph** » Sat Jul 17, 2004 6:19 pm

It wouldn't really matter what the result of that poll was, unless they only snooped on the ones that agreed to it. Snoop on a couple of thousand people that _don't_ agree to it, get sued, and lose a shitload of money/reputation.