Page 1 of 2
Suspicious data in WinHack
Posted: Fri Jul 16, 2004 1:27 pm
by curiosity
While pluggin for the latest offsets, I found this in WinHack:
also
and
Code: Select all
Visited: Owner@http://macroquest2.com/phpBB2/viewforum.php?f=29&sid=58f1b90f176aa6de268a7d6cacf32f39
and
Code: Select all
Visited: Owner@file:///C:/Documents%20and%20Settings/Owner/Desktop/MQ2-Latest/README.txt
the list goes on and on. Look around the address 030DDXXX. Is this saying the SoE has full access to our recent files/websites? This could be scary....it would mean I need to delete all my histories and logs before I ever play EQ!!
Posted: Fri Jul 16, 2004 2:20 pm
by MacroFiend
I'm going to smack you before someone else does.
WinHack can see ALL of the memory in your computer. You probably went outside the eqgame.exe process space and landed in part of your IE memory space. If SOE wanted to (and didn't care about violating your privacy and potentially breaking a few laws), they could find out anything they wanted to on your computer. They don't do that (yet) though.
Also, the memory address you mentioned wouldn't apply to anything other than your particular computer at that particular time. Memory is allocated dynamically. If you restarted your computer, you would find something completely different at that location.
Posted: Fri Jul 16, 2004 3:05 pm
by curiosity
I was in the EQ memory range bud.....it was located in my EQ ini files. Go look it up
Posted: Fri Jul 16, 2004 3:39 pm
by MacroFiend
What was the starting address of your eqgame.exe? What was the end? (Both of these are located next to the Quite button in WinHack) Is the address you mentioned seeing this stuff somewhere inside that range?
I seriously doubt it.
WinHack doesn't tell you when you are at the end of a process' active memory space, it just keeps going. You may have run in to garbage left over in that memory.
I went to the memory you mentioned and all I saw was uninitialized memory.
Posted: Fri Jul 16, 2004 3:59 pm
by curiosity
My EQ adress is $00400000 - $093BD000, and the address of the info I found was 030DDXXX. That is definately in the range of EQ's memory. And I guess you're right, your memory address would be different then mine for that hehe....so you may have to search for it.
Posted: Fri Jul 16, 2004 4:22 pm
by Mimatas
Just cuz you visit the site, doesn't mean you use the program... for starters. Second, most of us already assume the following:
IF YOU USE MQ, YOU WILL GET BANNED.
Most of us just accept that getting caught is eventually gonna happen.. and we're prepared to go to another MMORPG when that happens... or better yet, get out and get laid. I'm not one to complain, but I'm kinda getting tired of all these "SOE's gonna getcha" posts.
If, in fact, you made no mistake and SOE is looking at our IE cache, that'd be rather interesting.
Posted: Fri Jul 16, 2004 4:24 pm
by aChallenged1
It may have fallen within the "memory" allocated to EQ but that does not mean that EQ was using it, yet.
As I seem to recall, programs are known to not flush code from memory addresses it will be using until it needs it.
Posted: Fri Jul 16, 2004 5:02 pm
by Mimatas
That's more likely aChallenged1. I didn't even think of that, but you're right.. many programs don't clean up memory before releasing it (helll, many don't even release it) when closing. Restart the computer, run EQ, then run IE... see if you see the same thing.
Posted: Fri Jul 16, 2004 5:10 pm
by curiosity
Mimatas....what an idiot
Now on to better business, I'll just quote this one again, for you Mimatas:
Yes, notice the name? That means you have downloaded MQ2. This doesn't mean you've used it, but hell who'm I kidding. If you've downloaded it, you've used it, and probably still are.
And you're right aChallenged1, just because it is in there doesn't mean it's affiliated with SoE, but the fact that it is resting in EQs memory range could arise some suspicion.
And this isn't a "SoE's gonna getcha" post. It is a post about suspicious content in EQs memory address....for the love.
Mimates...you suck. Don't ever post again on these forums, your intelligence is too low to comprehend 9th grade English. Who knows, maybe you're still in 7th grade....if so, MQ is too high for your intellect and you should go hang yourself.
Posted: Fri Jul 16, 2004 5:25 pm
by Pheph
Actually, there was a post on the exact same subject a couple of months ago or thereabouts. Live with it, etc.
Posted: Sat Jul 17, 2004 12:16 am
by zanomo
IF YOU USE MQ, YOU WILL GET BANNED.
Most of us just accept that getting caught is eventually gonna happen.. and we're prepared to go to another MMORPG when that happens... or better yet, get out and get laid. I'm not one to complain, but I'm kinda getting tired of all these "SOE's gonna getcha" posts.
Well said Mimatas...
While discretely using MQ, deep inside I am actually looking forward to this day...
And in fact, MQ is beginning to be the motivation of playing this game...
Posted: Sat Jul 17, 2004 1:56 am
by Lax
My EQ adress is $00400000 - $093BD000, and the address of the info I found was 030DDXXX. That is definately in the range of EQ's memory. And I guess you're right, your memory address would be different then mine for that hehe....so you may have to search for it.
LOL
phew. Hey, do me a favor, attach MS Visual Studio .NET debugger to eqgame.exe. Now do Debug->Windows->Modules. Now read the module list, starting from the top, and look at the address ranges.
EQ goes from 00400000 to 008B9000, a mere 4B9000 total (about 4.9mb). Your total on the othr hand is 8FBD000, which is about 150mb.
93BD000 is well into the address space of DLLs.
You're an idiot.. have a nice day
Posted: Sat Jul 17, 2004 3:02 am
by guest_01
Truthfully, quite aside from whether this is true or not (not going there, but doubt it), why would SoE bother to store your web history to look for MQ and such, when they could just store the list of running processes ? if you're using MQ2, it will show up in the process list.... seems much more logical to me than scanning through tons of web pages that you may or may not have actually acted on.
Posted: Sat Jul 17, 2004 5:02 pm
by Sparr
MacroFiend wrote:If SOE wanted to (and didn't care about violating your privacy and potentially breaking a few laws), they could find out anything they wanted to on your computer. They don't do that (yet) though.
anyone who has been paying attention long enough will remember that sony DID do this. they were sending your running process list back to the servers. some hackers caught them, then there was a login poll ~"how would you feel if sony checked you for cheats?", and it PASSED, but they stopped anyways.
Posted: Sat Jul 17, 2004 6:19 pm
by Pheph
It wouldn't really matter what the result of that poll was, unless they only snooped on the ones that agreed to it. Snoop on a couple of thousand people that _don't_ agree to it, get sued, and lose a shitload of money/reputation.