24012 lines
971 KiB
XML
Executable File
24012 lines
971 KiB
XML
Executable File
<?xml version="1.0"?>
|
|
<guardSpec xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="file:///$RAGE_3RDPARTY/bin/Arxan/GuardIT/$ARXAN_VERSION/plugins/com.arxan.guardit_$ARXAN_VERSION/bin64/x86_windows_guardlibs/guardit.xsd">
|
|
|
|
<seed_cmd>
|
|
$SEED_VALUE
|
|
</seed_cmd>
|
|
|
|
<config_cmd>
|
|
<file>x:/gta5/tools_ng/script/coding/protection/guardit_project_config.xml</file>
|
|
</config_cmd>
|
|
|
|
<image_cmd name="gtav_pc">
|
|
|
|
<image_elements>
|
|
<input_file>X:/gta5/titleupdate/dev_ng_live_epic/game_win64_$FILENAME.exe</input_file>
|
|
<guard_obfuscation>0</guard_obfuscation>
|
|
<dir>
|
|
<path>C:/Program Files (x86)/Microsoft Visual Studio 11.0/VC/lib/amd64</path>
|
|
<path>C:/Program Files (x86)/Microsoft Visual Studio 11.0/VC/atlmfc/lib/amd64</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/game/VS_Project/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/game/VS_Project/RageMisc/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/game/vs_project1_lib/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/game/vs_project2_lib/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/game/vs_project3_lib/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/game/vs_project4_lib/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/game/VS_Project_network/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/base/src/vcproj/RageAudio/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/base/src/vcproj/RageCore/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/base/src/vcproj/RageCreature/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/base/src/vcproj/RageGraphics/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/base/src/vcproj/RageNet/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/base/src/vcproj/RagePhysics/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/framework/src/vcproj/RageFramework/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/naturalmotion/vcproj/NaturalMotion/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/scaleform/Src/vcproj/scaleformgfx/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/script/src/vcproj/RageScript/win64_$RELEASE_unity_2012</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/suite/src/vcproj/RageSuiteCreature/win64_$RELEASE_unity_2012</path>
|
|
<path>X:/gta5/titleupdate/dev_ng_live_epic</path>
|
|
<path>C:/Program Files (x86)/Microsoft DirectX SDK (June 2010)/Lib/x64</path>
|
|
<path>x:/gta5/src/dev_ng_live_epic/rage/lib</path>
|
|
</dir>
|
|
<installation>
|
|
<select_location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label matching="exact">mainCRTStartup</label>
|
|
</location>
|
|
</select_location>
|
|
</installation>
|
|
<map_file>X:/gta5/titleupdate/dev_ng_live_epic/game_win64_$FILENAME.map</map_file>
|
|
<output_file>x:/gta5/tools_ng/script/coding/protection/generated/game_win64_$FILENAME_$CURR_TIME.exe</output_file>
|
|
<clone_import_table>true</clone_import_table>
|
|
<disable_pps>false</disable_pps>
|
|
<garbage_code>true</garbage_code>
|
|
<debug>false</debug>
|
|
<advanced_antidebug_algorithms>false</advanced_antidebug_algorithms>
|
|
</image_elements>
|
|
|
|
<guard_cmd name="GTAVB_0000_ENC_A">
|
|
<encryption_wrapper>
|
|
<action>
|
|
<fail>
|
|
</fail>
|
|
</action>
|
|
<algorithm_decryption>
|
|
<use>fast</use>
|
|
</algorithm_decryption>
|
|
<algorithm_integrity>
|
|
<use>fast</use>
|
|
</algorithm_integrity>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</encryption_wrapper>
|
|
</guard_cmd>
|
|
|
|
|
|
<guard_cmd name="EXECT_0031_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>REVOLVINGCHECKERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
|
|
<guard_cmd name="GTAVB_0001_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>all_guards</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<transformation>obf_chopup</transformation>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="CHLRP_0013_TFIT_AES_CBC_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>aes_cbc.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_op_iAES13.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_op_iAES14.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbaes_init_cbc</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbaes_init_cbc_classical_first_iv</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="CHLRP_0013_TFIT_HMAC_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_ctx_cleanup</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_update</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_final</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_sign</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_verify</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_prepare_key</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_hmac_get_oxdid</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_generated_tables_iHMACredK</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_generated_tables_len_iHMACredK</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_sha_cfg_iHMACredK</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_swap</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_toggle_table_break</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbsha_setup_configuration</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?TFIT_hmac_key_iHMACredK@</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="CHLRP_0013_TFIT_ECDH_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_init_wbecc_dh_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_convert_from_classical_affine_weierstrass_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_convert_to_classical_affine_weierstrass_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_add3_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_shift5_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_correcting_sub_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_point_validate_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_build_pm_table_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecdsa_parameter_helper_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_prepare_constants_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_convert_to_obfuscated_affine_weierstrass_xonly_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_convert_to_obfuscated_affine_weierstrass_xonly_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_sdp_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_ecc_sdp_len_iECDHgreenSSfastP256</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?TFIT_ecc_fast_iECDHgreenSSfastP256@@3U_wbecc_key_pair@@A</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0002_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKGAMEFILTER_APPLYLANGUAGE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKGAMEFILTER_APPLYREGION</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<transformation>obf_chopup</transformation>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0002_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKGAMEFILTER_APPLYREGION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKGAMEFILTER_APPLYLANGUAGE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKGAMECONFIG_APPLY_DISCRIMINATOR</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CREATE_BOOL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0002_ADB_A">
|
|
<antidebug>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0002_ADB_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKGAMECONFIG_APPLY_DISCRIMINATOR</range_name>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</antidebug>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0002_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0002_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKGAMECONFIG_APPLY_DISCRIMINATOR</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINSESSION_CHECK_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>NetworkRemoteCheaterDetector</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?SetNetworkGameMode@CNetwork</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0002_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINSESSION_CHECK_POOL</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTIMECYCLE_LOADMODIFIERFILES_GET_TIME_CYCLE_FILE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0002_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0002_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CUTSMANAGER_DOLOADSTATE_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0002_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0002_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_HOSTSESSION_CHECK_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLSESSIONINFO_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_CHK_A</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_wbaes_ecb_decrypt_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_get_oxd_id_in_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_get_oxd_id_out_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_op_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_validate_key_id_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCRIMEBEINGQD_ADDWITNESS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_CHK_B</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_wbaes_ecb_decrypt_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_get_oxd_id_in_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_get_oxd_id_out_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_op_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?SetupDevices@CFileMgr</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_ADB_A">
|
|
<antidebug>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_ADB_A</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_validate_key_id_iAES2</code>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</antidebug>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_CHK_C</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_op_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_validate_key_id_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_E</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDRADIOSTATION_COMPUTERANDOMTRACK_ON_WEATHER_TRACK</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_CHK_D</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_validate_key_id_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>AES_DECRYPT_TRANSFORMIT_CALL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>AES_TRANSFORMITDECRYPT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCUTSCENECAMERAENTITY_DISPATCHEVENT_CUTSCENE_END_OF_SCENE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_M_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCUTSCENEFADEENTITY_DISPATCHEVENT_FADE_IN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_ADB_B">
|
|
<antidebug>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_ADB_B</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AES_TRANSFORMITDECRYPT_SET_KEY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</antidebug>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_REP_B_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_ADB_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_CHK_E</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>FIRE_COMMANDS_COMMANDSTOPENTITYFIRE_EXTINGUISH_FIRES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_CHK_F_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0003_CHK_F_REVOLVING</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>AES_TRANSFORMITDECRYPT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>PGSTREAMERDEVICEHANDLER_PROCESSREQUEST_CALCULATE_SIZES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.0002</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_CHK_F_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>STRPACKFILEMANAGER_INITIMAGELIST</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0003_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>AES_TRANSFORMITDECRYPT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0003_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CSYSTEM_INIT_INIT_MEMORY_BUCKETS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<patch_cmd name="TRFIT_0004_DMG_A">
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="substring">_iAES1</code>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
<byte_sequence>
|
|
<auto_generate>
|
|
</auto_generate>
|
|
</byte_sequence>
|
|
<all>true</all>
|
|
<disable>true</disable>
|
|
</patch_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0005_ADB_A">
|
|
<antidebug>
|
|
<action>
|
|
<notify_user>
|
|
<message>TFIT_0005_ADB_A</message>
|
|
<exit_code>0005</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSCLIENT_RLROSCLIENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</antidebug>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="TRFIT_0005_VVG_A_TAMPER">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_1_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_6_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_25_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_85_iAES2</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0005_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CERTIFICATEVERIFY_VERIFY_COUNT_SIGNERS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_ADB_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_ADB_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>TRFIT_0005_VVG_A_TAMPER</range_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="TRFIT_0005_VVG_B_TAMPER">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_9_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_21_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_23_iAES2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_79_iAES2</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0005_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAMESTATEMACHINE_PROCESSLOADLEVELSTATE_MATCHALLMODELSTRINGS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GTAVB_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>actual_integrity</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GTAVB_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>expected_integrity</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>TRFIT_0005_VVG_B_TAMPER</range_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0005_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_REP_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.0011</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0005_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_REP_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.0005</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<patch_cmd name="TRFIT_0006_DMG_A">
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="substring">TFIT_Game_key</code>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
<byte_sequence>
|
|
<byte>0xFF</byte>
|
|
</byte_sequence>
|
|
<all>true</all>
|
|
<disable>false</disable>
|
|
</patch_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0006_VVG">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CAPP_INITSYSTEM</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">TFIT_Game_key_63_iAES2</code>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<constant>-1</constant>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0006_REP_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0006_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="substring">TFIT_Game_key_</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_J</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CSYSTEM_INIT_INIT_MEMORY_BUCKETS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>false</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0006_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0006_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CDOOR_ISDOORFULLYOPEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>false</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>0.005</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TRFIT_0006_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TRFIT_0006_CHK_A</message>
|
|
<exit_code>0006</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0006_VVG</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0006_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDSOUNDMANAGER_PROCESSHEIRARCHY_AUDIO_PREPARED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.0031</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKBASECONFIG_GETMATCHMAKINGPOOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_ONHANDLEJOINREQUEST_SWITCH_PLAYER_POOL</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<call_chain>
|
|
<origin_function>GetMatchmakingPool</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">OnHandleJoinRequest</code>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0007_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_ONHANDLEJOINREQUEST_SWITCH_PLAYER_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_BUILDJOINREQUEST</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKBASECONFIG_GETMATCHMAKINGUSER_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKPLAYERMGR_GETPLAYERDATA</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINTRANSITION_GET_MATCHMAKING_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_HOSTTRANSITION_CHECK_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINSESSION_CHECK_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKBASECONFIG_INIT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKCOMMAND_COMMANDNETWORKPLAYERISCHEATER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKCOMMAND_COMMANDNETWORKISCHEATER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CSTUNTJUMPMANAGER_PRINTBIGMESSAGE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_CHK_A</guard_name>
|
|
</range>
|
|
<!--<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_I</guard_name>
|
|
</range>-->
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEATHER_UPDATEDAYNIGHTRATIO_NIGHT_TO_DAY_FADE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.025</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>COMMANDCREATEAMBIENTPICKUP</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_op_iAES4.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<exit>
|
|
<exit_code>$RANDOM_DWORD_EDFMT_0021_CHK_A</exit_code>
|
|
</exit>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Send@netConnectionManager@rage@@QEAA</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CVfxLens</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<fail>
|
|
</fail>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Reset@Data@rlSession@rage@@QEAA</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CSky@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EDFMT_0021_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?OnNetEvent@snSession@rage@@AEAAXP</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?HandleJoinRequest@snSession@rage@@AEAAXA</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<!--<label>?Init@CVfxBlood@@QEAAXI@Z</label>-->
|
|
<location_name>CGAME_INIT_CREATE_FACTORIES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessPostFSM@CTaskEnterVehicle@@MEAA</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessPostFSM@CTaskEnterVehicleSeat@@MEAA?AW4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessPreFSM@CTaskEnterVehicle@@MEAA?AW4FSM_R</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessPreFSM@CTaskEnterVehicleAlign@@MEAA?AW4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessPreFSM@CTaskEnterVehicleSeat@@MEAA?AW4F</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessPostFSM@CTaskEnterVehicle@@MEAA</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CommandGetPedLastWeaponImpactCoord</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CreateAmbientPickup</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CDistantLights2@@QEAAXI@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>GAMESKELETON_INIT_GETMODE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_CHK_C</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_CHK_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<encoding>
|
|
<use>none</use>
|
|
</encoding>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_REP_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EDFMT_0021_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<exit>
|
|
<exit_code>$RANDOM_DWORD_EDFMT_0021_CHK_D</exit_code>
|
|
</exit>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>COMMANDCREATEAMBIENTPICKUP</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_DOQUICKMATCH_ADD_FIND_SESSION_EVENT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_DOQUICKMATCH_HOST_SESSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
|
|
<range_cmd name="EDFMT_0021_GUARDS">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EDFMT_0021_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>EDFMT_0021_GUARDS</range_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKGAMEFILTER_ISVALID_CHECK_DISCRIMINATOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEAPON_DORELOAD_GET_CHECK_AMMO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.40</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEAPON_DORELOAD_GET_CLIP_SIZE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEAPON_STARTRELOAD_CHECK_LOCAL_PLAYER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_PROCESSFINDINGSTATE_CLEARBLACKLISTED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_G</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CBULLET_PROCESSIMPACTS_DOWEAPONIMPACT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.03</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_M_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_K">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_M_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKDYINGDEAD_ONDYINGEXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_L">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKPLAYERMGR_GETPLAYERDATA</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKSCPRECENSEUTIL_UPDATEMPSCPRESENCEINFO</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINTRANSITION_GET_MATCHMAKING_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_HOSTTRANSITION_CHECK_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINSESSION_CHECK_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_HOSTSESSION_CHECK_POOL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_M_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKPOLICEORDERRESPONSE_GOTOINCIDENTLOCATIONINVEHICLE_ONENTER_SET_PARAMS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_J">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_K</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_L</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>NetworkRemoteCheaterDetector</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPHONEMGR_CREATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0007_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_J</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_K</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCRIME_REPORTCRIME_REGISTER_CRIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.15</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_A">
|
|
<repair>
|
|
<description>Restore IsCheater</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORK_ISCHEATER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_BUILDCONTEXTS_SET_ACTIVITY_SESSION</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_SETUPCARDTITLE_IS_TUNABLES_INSTANTIATED</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCONTEXTMENUHELPER_CLBREPORTFORGRIEFING_PRE_ISCHEATER</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCONTEXTMENUHELPER_CLBREPORTFOROFFENSIVELANG_PRE_ISCHEATER</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORK_STARTMATCH_START_SPAWNING_PEDS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>INVITEMGR_REPLYTOINVITE_CHECK_NETWORK_OPEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKSCPRECENSEUTIL_UPDATEMPSCPRESENCEINFO_GET_LOCAL_GAMER_INDEX</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETOBJPLAYER_GETPLAYERGAMERDATA_GET_CLAN_MEMBERSHIP_INFO</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETGAMEPLAYER_ACTIVEUPDATE_GET_PRIMARY_MEMBERSHIP</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKBASECONFIG_GETMATCHMAKINGPOOL_GET_TUNABLES</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKCOMMAND_COMMANDNETWORKISCHEATER_PRE_CALL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_B">
|
|
<repair>
|
|
<description>Damage IsCheater</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORK_ISCHEATER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_BUILDCONTEXTS_GET_PRIMARY_CLAN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_SETUPCARDTITLE_CHECK_BAD_SPORT_LIMIT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCONTEXTMENUHELPER_CLBREPORTFORGRIEFING_POST_ISCHEATER_A</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCONTEXTMENUHELPER_CLBREPORTFORGRIEFING_POST_ISCHEATER_B</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCONTEXTMENUHELPER_CLBREPORTFOROFFENSIVELANG_POST_ISCHEATER_A</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCONTEXTMENUHELPER_CLBREPORTFOROFFENSIVELANG_POST_ISCHEATER_B</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORK_STARTMATCH_CHECK_IS_HOST</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>INVITEMGR_REPLYTOINVITE_IS_STORE_MENU_OPEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKSCPRECENSEUTIL_UPDATEMPSCPRESENCEINFO_IS_HOST</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETOBJPLAYER_GETPLAYERGAMERDATA_GET_MATCHMAKING_GROUP</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETGAMEPLAYER_ACTIVEUPDATE_GET_MATCHMAKING_GROUP</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKBASECONFIG_GETMATCHMAKINGPOOL_RETURN_CHEATER</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKCOMMAND_COMMANDNETWORKISCHEATER_POST_CALL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="MCHMK_RANGE_C_D">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CPLAYERLISTMENU_BUILDCONTEXTS_CHECK_BADSPORT_CHEATER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CPLAYERLISTMENU_SETUPCARDTITLE_BADSPORT_LIMITS</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORK_STARTMATCH_CHECK_CHEATER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKSCPRECENSEUTIL_UPDATEMPSCPRESENCEINFO</range_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>MCHMK_RANGE_C_D</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_BUILDCONTEXTS_SET_ACTIVITY_SESSION</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_SETUPCARDTITLE_GET_RANK</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORK_STARTMATCH_CAST_SYNC_TREE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKSCPRECENSEUTIL_UPDATEMPSCPRESENCEINFO_VALIDATE_LOCAL_GAMER_INDEX</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>MCHMK_RANGE_C_D</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_BUILDCONTEXTS_GET_PRIMARY_CLAN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERLISTMENU_SETUPCARDTITLE_END_METHOD</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORK_STARTMATCH_GET_LOCAL_PLAYER</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKSCPRECENSEUTIL_UPDATEMPSCPRESENCEINFO_IS_INSTANTIATED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="MCHMK_RANGE_E_F">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETOBJPLAYER_GETPLAYERGAMERDATA_GET_QUALIFYING_PROPERTIES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETOBJPLAYER_SETPLAYERGAMERDATA_SET_QUALIFYING_PROPERTIES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>NETWORKBASECONFIG_GETMATCHMAKINGPOOL</range_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>MCHMK_RANGE_E_F</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETOBJPLAYER_GETPLAYERGAMERDATA_GET_CLAN_MEMBERSHIP_INFO</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETOBJPLAYER_SETPLAYERGAMERDATA_SET_CLAN_MEMBERSHIP</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKBASECONFIG_GETMATCHMAKINGPOOL_GET_TUNABLES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>MCHMK_RANGE_E_F</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETOBJPLAYER_GETPLAYERGAMERDATA_GET_MATCHMAKING_GROUP</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETOBJPLAYER_SETPLAYERGAMERDATA_SET_STARTED_TRANSITION</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETWORKBASECONFIG_GETMATCHMAKINGPOOL_RETURN_CHEATER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="MCHMK_RANGE_G_H">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>s_HardKey</code>
|
|
</range>
|
|
</include>
|
|
<disable>true</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>MCHMK_RANGE_G_H</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETCIPHER_CLEAR_PRE_COPY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>MCHMK_RANGE_G_H</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>NETCIPHER_CLEAR_POST_COPY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0008_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<!--<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0007_REP_H</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_B</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CINFOSTATE_REFRESH_PERFORM_CRC</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CINFOSTATE_REFRESH_SHORT_CIRCUIT</range_name>
|
|
</range>
|
|
-->
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_CHK_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_PROCESSFINDINGSTATE_JOIN_SESSION_OR_HOST</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0008_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_CHK_A</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_ADB_A</guard_name>
|
|
</range>
|
|
-->
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEATHER_UPDATEDAYNIGHTRATIO_DAY_TO_NIGHT_FADE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.025</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0008_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<!--<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_B</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0006_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<!--<location_name>CNETWORK_ISCHEATER_CHECK_RLROS_CALL</location_name>-->
|
|
<label>?PlayerHasLeftSession@CStatsDataMgr@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0008_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_I</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_I</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORK_PLAYERHASLEFTSESSION_HAS_PLAYER_LEFT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<!--<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_B</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_INIT_CREATE_FACTORIES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0008_ADB_A">
|
|
<antidebug>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0008_ADB_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORK_ISCHEATER_CHECK_RLROS_CALL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.01</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</antidebug>
|
|
</guard_cmd>
|
|
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_L</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_L</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPEDTARGETEVALUATOR_FINDTARGET_CALCULATE_PED_POSITION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMINIMAP_INIT_RESIZE_MAP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_A">
|
|
<value_verification>
|
|
<description>TODO FIXUP TAMPERACTION</description>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKCARREACTTOVEHICLECOLLISION_START_ONUPDATE_SET_ANGRY_STATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_A</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_B">
|
|
<value_verification>
|
|
<description>TODO FIXUP TAMPERACTION</description>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>PHINSTBEHAVIOREXPLOSIONGTA_PROCESSCOLLISIONSFORONEFRAME_PRE_APPLY_FORCE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_B_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_H">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_H</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_DOMATCHMAKINGCOMMON_SETUP_MM_FILTER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_DOQUICKMATCH_FINDSESSIONSSOCIAL</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_DOQUICKMATCH_FINDSESSIONS</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_DOACTIVITYQUICKMATCH_FINDSESSIONS</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINSESSIONORHOST_FINDSESSIONS_CALLS_1</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_JOINSESSIONORHOST_FINDSESSIONS_CALLS_2</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_BUILDJOINREQUEST</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDRADIOSTATION_COMPUTENEXTTRACKCATEGORY_RETURN_ADVERTISEMENTS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKCARREACTTOVEHICLECOLLISION_START_ONUPDATE_SET_FEAR_STATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_B_REVOLVING</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_C</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPEDMODELINFO_LOADPEDPERSONALITYDATA_POST_LOAD</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_C</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPAUSEMENU_UPDATE_PAUSE_PRESSED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_H</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_H</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_G_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_L</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROS_INITROSSSLCONTEXT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">s_RosCAs</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROS_INITROSSSLCONTEXT_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROS_INITROSSSLCONTEXT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">s_RosCAs</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROS_INITROSSSLCONTEXT_EXIT_A</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROS_INITROSSSLCONTEXT_EXIT_B</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSCREDENTIALS_HASPRIVILEGE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSCREDENTIALS_HASPRIVILEGEENDDATE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_G_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0002_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_L</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERCARDXMLDATAMANAGER_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSCLIENT_SETCREDENTIALS</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_L</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_H</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_L</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>PHMATERIALMGRGTA_LOADGTAMTLFILE_OPEN_FILE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_F</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSCLIENT_UPDATE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSCLIENT_GETLOGINSTATUS</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0008_REP_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOTHMGR_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_D">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMINIMAP_REINIT_EMPTY_BLIP_UPDATE_QUEUE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_E</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_F</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_G">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_G</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_CANCACCESSMULTIPLAYER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_CANENTERMULTIPLAYER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETWORKSESSION_DOMATCHMAKINGCOMMON</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_I</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_ADDMATCHMAKINGRESULTS_CHECK_MAX_SESSIONS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_E">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKFALL_PROCESSPREFSM_STATE_FALL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_E</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_F</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_F">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINMATCHMAKINGSESSION_JOIN_SESSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_F</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_F</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_G</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_G">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CAN_JOIN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_G</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_G</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_H</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_J">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKPARACHUTE_SETTARGET_CHECK_ENTITY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_K">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0006_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKDYINGDEAD_PROCESSBLOODPOOL_FORCE_FINISH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.025</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_I">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_I</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKFIREPATROL_STARTONUPDATE_GET_FIRE_ORDER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_M">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_H</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKWANDER_STATECROSROADATLIGHTS_ONEXIT_RELEASE_PED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.005</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_J">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_J</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_M</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKAIMANDTHROWPROJECTILE_HOLDINGPROJECTILE_ONUPDATE_SET_THROWING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_H">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKAIMANDTHROWPROJECTILE_THROWPROJECTILE_ONEXIT_SET_CLIP_SET</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_J</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_J</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_K">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_K</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_M</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_J</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_DROPSESSION_RESET_PARTY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_VVG_I">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_DROPSESSION_ADD_DELEGATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_K</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_K</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_C_REVOLVING</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_CHK_L">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MCHMK_0009_CHK_L</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_VVG_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_REP_M</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_J</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_SHUTDOWN_FINISH_SAVE_OPERATIONS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MCHMK_0009_REP_L">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MCHMK_0009_CHK_C_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CAMBASECINEMATICCONTEXT_TRYANDCREATEANEWCAMERA_FOUND_GOOD_CAMERA</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?GetMachineHash</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CMACHINEHASH_GETMACHINEHASH_SELECT_STRATEGY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_CALL_MACHINE_HASH</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_CALL_MACHINE_HASH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CMACHINEHASH_GETMACHINEHASH_SELECT_STRATEGY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_GETMACHINEHASH_SELECT_STRATEGY_EXIT_POINT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_A</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CMACHINEHASH_GETMACHINEHASH_SELECT_STRATEGY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_GETMACHINEHASH_PICKSTRATEGYWORKER_WORKERPROC_JENKINS_SHIFTING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CMACHINEHASH_MACHINEHASHWORKER_WORKERPROC</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_MACHINEHASHWORKER_WORKERPROC_CALL_FALLBACK</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CMACHINEHASH_MACHINEHASHWORKER_WORKERPROC</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WORKERPROC_DELETE_HASH_STRATEGY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>FALLBACKMACHINEHASHSTRATEGY_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_MACHINEHASHWORKER_WORKERPROC_CALL_FALLBACK_MACHINE_HASH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_B</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>FALLBACKMACHINEHASHSTRATEGY_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>FALLBACKMACHINEHASHSTRATEGY_GETMACHINEHASH_CHECK_SIZE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>FALLBACKMACHINEHASHSTRATEGY_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_MACHINEHASHWORKER_WORKERPROC_CALL_MACHINE_HASH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SMBIOS_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SMBIOS_GETMACHINEHASH_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_C</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SMBIOS_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SMBIOS_GETMACHINEHASH_LOCATION_A</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>WMI_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WMI_GETMACHINEHASH_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_D</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>WMI_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WMI_GETMACHINEHASH_LOCATION_B</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>W32_GETMATCHINEHASH</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>IMACHINEHASHSTRATEGY_ACCUMULATEREGISTRYSTRVALUE</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>W32_GETMACHINEHASH_GET_PROCESSOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_E</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>WMI_GETMACHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WMI_GETMACHINEHASH_LOCATION_B</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_J">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SMBIOS_GETMACHINEHASH</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>WMI_GETMACHINEHASH</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>W32_GETMATCHINEHASH</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>MACHINEHASH_SHAHASHHELPER_CALL_HASHING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_K">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CMACHINEHASH_GETMACHINEHASH_PICKSTRATEGYWORKER_WORKERPROC_JENKINS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_GETMACHINEHASH_PICKSTRATEGYWORKER_WORKERPROC_JENKINS_SHIFTING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_L">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>IMACHINEHASHSTRATEGY_EXECCMD</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>W32_GETMACHINEHASH_LOCATION_A</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WMI_GETMACHINEHASH_LOCATION_A</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_M">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>IMACHINEHASHSTRATEGY_EXECCMD</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WORKERPROC_DELETE_HASH_STRATEGY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_ADB_A</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_GETMACHINEHASH_PICKSTRATEGYWORKER_WORKERPROC_JENKINS_SHIFTING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="ENTLE_0010_RNG_A">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0010_RNG_B">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_H</guard_name>
|
|
</range>
|
|
<!--<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_F</guard_name>
|
|
</range>-->
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0010_RNG_C">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0010_RNG_D">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_L</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_M</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_F</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0010_RNG_B</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_G</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAMESTATEMACHINE_PROCESSLOADLEVELSTATE_MATCHALLMODELSTRINGS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_G">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_G</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0010_RNG_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_H</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGANGINFO_PICKRANDOMWEAPON</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_H">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_H</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0010_RNG_C</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_O</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_I</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKMOBILEPHONE_TEXTLOOP_ONUPDATE_PUT_UP_TO_EAR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKAIMGUNONFOOT_ISOUTOFAMMO_TRUE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_ADB_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_ADB_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_41_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_O">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_VVG_A</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0010_RNG_D</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGARAGE_OPENTHISGARAGE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_I">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_I</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_K</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKDYINGDEAD_SET_HEALTH_ZERO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_K">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_K</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_P_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKEXITVEHICLESEAT_EXITSEAT_ONEXIT_CLEAR_FLAGS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.15</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_CHK_J">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0010_CHK_J</message>
|
|
<exit_code>0010</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_N</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_INITLEVEL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPLAYERSWITCHMGRLONG_STOPINTERNAL_SET_CAR_GENERATORS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_J</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_J</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_81_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_N">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_K</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKGETUP_PLAYINGREACTIONCLIP_ONENTER_GET_CLIP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.5</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0010_REP_P_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_H</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ParseEntitlementResponse@rlRosGetEntitlements@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessSuccess@rlRosGetEntitlements@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Decode@rlV2EntitlementDataBlock@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SanitizeRecursive@rlV2EntitlementDataBlock@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Reset@rlV2EntitlementDataBlock</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rlRosEntitlement</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="substring">CEntitlementManager</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>dtor</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>unwind</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>pdata</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGER_THREADENTRY</range_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGER_THREADENTRY_ACTUAL_WORK</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ENTITLEMENTMANAGER_INIT_THREAD_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_ADB_A</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_GET_SIGN_IN_INFO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGER_THREADENTRY_ACTUAL_WORK</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_GET_SIGN_IN_INFO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_ISINITIALIZED</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_CALL_LOAD_OFFLINE_ENTITLEMENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_ADB_B">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_ADB_B</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_OPEN_ENTITLEMENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_A</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_DECRYPT_SIGNATURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_GET_OFFLINE_VALUES</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_DOESDATABLOCKGRANTENTITLEMENT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ENTITLEMENTMANAGERDUPLICATE_THREADENTRY_DOESDATABLOCKGRANTENTITLEMENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGER_THREADENTRY_FETCH_OFFLINE_VALUES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_DOESDATABLOCKGRANTENTITLEMENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_TFIT_DECRYPT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_op_iAES4.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_DECODE_CALL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_J">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_TFIT_DECRYPT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_op_iAES4.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_RVERIFY_LENGTH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_K">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_C</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODEVERIFY_BTON_PLAINTEXTLENGTH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_ADB_C">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_ADB_C</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_HASH_PTR_CALC</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_B</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_C</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_PERTINENT_CODE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_RETURNS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_SZ_HASH_LEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_L">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_C</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_VERIFY_ROCKSTAR_ID</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_M">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_PERTINENT_CODE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>sm_Sku</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_DOESDATABLOCKGRANTENTITLEMENT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ENTITLEMENTMANAGERDUPLICATE_THREADENTRY_DOESDATABLOCKGRANTENTITLEMENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_N">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_PERTINENT_CODE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>sm_Sku</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_GET_OFFLINE_ENTITLEMENT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ENTITLEMENTMANAGERDUPLICATE_THREADENTRY_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_O">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CALL_GMTIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_ADB_D">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_ADB_D</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_STRCMP_EXPIRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_P">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_B</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_STRCMP_EXPIRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_Q">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_B</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_GET_OFFLINE_ENTITLEMENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_R">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGER_UPDATEWAITINGFORONLINESTATE</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_STARTCHECK_SET_STATE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_UPDATE_SET_ONLINE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_D</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGER_UPDATEWAITINGFORONLINESTATE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>sha256.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>random.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_UPDATEWAITINGFORONLINESTATE_SHOWSIGNINUI</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_ADB_E">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_ADB_E</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_UPDATE_SET_PENDING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>0.02</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="ENTLE_0011_GUARDS_A">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0011_GUARDS_B">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_ADB_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_G</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0011_GUARDS_C">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_ADB_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_L</guard_name>
|
|
</range>
|
|
<!-- <range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_H</guard_name>
|
|
</range> -->
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0011_GUARDS_D">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_M</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_O</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_ADB_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_N</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0011_GUARDS_E">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_P</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_Q</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ENTLE_0011_GUARDS_F">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_R</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_ADB_E</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AA">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AA</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_B</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_C</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_D</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_E</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAMESESSIONSTATEMACHINE_PROCESSCHECKFORRGSC</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AB">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AB</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_B</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CAUTOMOBILE_PLAYCARHORN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AC">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AC</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_B</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_C</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_D</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWANTED_PLAYERENTERED_VEHICLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_VVG_AD">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CFACIALDATACOMPONENT_PLAYFACIALANIM</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AA</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AA</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_AA</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_VVG_AC">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAMESTATEMACHINE_PROCESSLOADLEVELSTATE_MATCHALLMODELSTRINGS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AA</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AA</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_AA</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_AA">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AB</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AG</guard_name>
|
|
</range>
|
|
<!--<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_AC</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_F</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AG</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDRADIODJSPEECHACTIONAUDRADIODJSPEECHACTIONPREPARE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.5</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_VVG_AB">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWANTED_PLAYERENTERED_VEHICLE_REPORT_CAR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_I</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_I</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_hmac_key_iHMACredK</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_AB">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AC</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKREACTANDFLEE_CANSCREAM_CHECK_BRAVERY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AD">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AD</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_E</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_AA</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_AA</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKWRITEH_TOWRITEH_ONUPDATE_SET_rAGDOLL_COLLISION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AE">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AE</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>sha256.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWIND_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AF">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AF</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AD</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AE</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWIND_ADDEXPLOSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AG">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AG</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AF</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_VVG_AB</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDWANTEDMUSIC_UPDATE_TRIGGER_GAINED_WANTED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AH">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AH</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_VVG_AD</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_VVG_AC</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDWANTEDMUSIC_UPDATE_TRIGGER_ESCAPE_WANTED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AI">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AI</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_VVG_AC</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AH</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_AA</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDVEHICLETRANSMISSION_UPDATE_ON_TRIGGER_SHIFT_UP_WOBBLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.40</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AJ">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AJ</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AI</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_AB</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDVEHICLETRANSMISSION_UPDATE_ON_TRIGGER_SHIFT_DOWN_WOBBLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.15</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_CHK_AK">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>ENTLE_0011_CHK_AK</message>
|
|
<exit_code>0011</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AJ</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ENTLE_0011_GUARDS_D</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>random.obj</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AJ</guard_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>PHWIND_INITSESSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_VVG_AA">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCRIME_REPORTCRIME_FIRES_STARTED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AK</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AK</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>sm_gamePipeEncryptionKey</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ENTLE_0011_REP_AC">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_VVG_AA</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCRIME_REPORTCRIME_SHOOT_COP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
|
|
<!-- StatInterface -->
|
|
<guard_cmd name="SAUTH_0012_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_ADB_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CStatsDataMgr@@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?PlayerHasJoinedSession@CStatsDataMgr@@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?SignedIn@CStatsDataMgr@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>0.1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_ADB_B">
|
|
<debugger_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_ADB_B</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?SetStatIterData@CStatsDataMgr@@</label>
|
|
</location>
|
|
<!--
|
|
<location>
|
|
<label>?GetInt@sUns32StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt@sIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt8@sIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt32@sIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt16@sIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt8@sUns32StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt16@sUns32StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt32@sUns32StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt64@sUns32StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt16@sUns16StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt8@sUns16StatData@@</label>
|
|
</location>
|
|
|
|
<location>
|
|
<label>?GetUInt64@sUns64BaseStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt16@sUns64BaseStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt8@sUns64BaseStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt@sUns64BaseStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt32@sUns64BaseStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt64@sInt64StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt@sInt64StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt64@sUns8StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt32@sUns8StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt16@sUns8StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt@sUns8StatData@@</label>
|
|
</location>
|
|
|
|
<location>
|
|
<label>?GetUInt8@sFloatStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt32@sFloatStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt16@sFloatStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt64@sFloatStatData@@</label>
|
|
</location>
|
|
-->
|
|
<location>
|
|
<label>?GetUInt32@sObfFloatStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt8@sObfFloatStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt16@sObfFloatStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt64@sObfFloatStatData@@</label>
|
|
</location>
|
|
<!--
|
|
<location>
|
|
<label>?GetUInt64@sIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt64@sIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt32@sUns16StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt@sUns16StatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt64@sUns16StatData@@</label>
|
|
</location>-->
|
|
<location>
|
|
<label>?GetUInt16@sObfIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt8@sObfIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUInt32@sObfIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetInt@sObfIntStatData@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?GetUserId@sUserIdStatData@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.0001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<!-- checksum callers of the stat interface -->
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@CStatsDataMgr@@QEAA_NAEBVStatId@@PEAXII@Z</origin_function>
|
|
<caller_depth>2</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<call_chain>
|
|
<origin_function>?GetStatDesc@StatsInterface@@YAPEBUsStatDescription@@AEBVStatId@@@Z</origin_function>
|
|
<caller_depth>2</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetGreater@StatsInterface@@YAXAEBVStatId@@MI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetMaskedInt@StatsInterface@@YA_NAEBVStatId@@HHH_NI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@EI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@GI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@HI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@II@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@MI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@_JI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@_KI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YAXAEBVStatId@@_NI@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatData@StatsInterface@@YA_NAEBVStatId@@PEAXII@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?SetStatsModelPrefix@StatsInterface@@YAXPEAVCPed@@@Z</origin_function>
|
|
<caller_depth>1</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?PostLoad@CStatsDataMgr@@QEAAXXZ</label>
|
|
</location>
|
|
<!-- TODO invocations later in the game, like a transition screen -->
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>1</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="SAUTH_0012_RANGE_A">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsDataMgr.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsInterface.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsMgr.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsSavesMgr.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsTypes.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsUtils.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>MoneyInterface.obj</code>
|
|
</range>
|
|
<range>
|
|
<code>@MoneyInterface@@</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SAUTH_0012_RANGE_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CStatsDataMgr@@</label>
|
|
</location>
|
|
<!-- TODO invocations later in the game, like a transition screen -->
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>1</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ReportCrime@CCrime@@SAXW4eCrimeType@@PEAVCEntity@@PEAVCPed@@I@Z</label> <!-- todo: invocation -->
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_B</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SetStatIterData@CStatsDataMgr@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_HANDLEMESSAGE_MCHL_WAIT_FOR_CHALLENGE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.3</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_C">
|
|
<checksum>
|
|
<description>GetServerAuthoritative Caller Checking</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<!-- because GetServerAuthoritative is inlined, this list is manually collected -->
|
|
<include>
|
|
<range>
|
|
<code>?SetDirtySavegame@sStatDescription@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?SetIsPlayerInventory@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ReadInProfileStat@sStatData@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ResynchServerAuthoritative@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?SetAllStatsToSynched@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?SetAllStatsToSynchedByGroup@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?GetAllOnlineStatsAreSynched@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?HandleEventProfileStats@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?RegisterNewStat@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?SetStatIterData@CStatsDataMgr@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?PostLoad@CStatsDataMgr@@QEAAXXZ</label>
|
|
</location>
|
|
<!-- TODO invocations later in the game like in a transition -->
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>1</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_VVG_B">
|
|
<value_verification>
|
|
<description>VVG GetServerAuthoritative Check</description>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ReportCrime@CCrime@@SAXW4eCrimeType@@PEAVCEntity@@PEAVCPed@@I@Z</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_C</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_F</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_D">
|
|
<checksum>
|
|
<description>GetServerAuthoritative_chk_callers</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<code>?SetStatIterData@CStatsDataMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?IsBadSport@StatsInterface@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_ENCRYPT_AND_STRINGIFY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>1</instances>
|
|
<execution_probability>
|
|
<value>0.001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SetStatData@CStatsDataMgr@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<!--##########################
|
|
|
|
<guard_cmd name="StatInterface_rpr_withdmg">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsInterface.obj</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>StatsDataMgr.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label matching="exact">main</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>crypto</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static />
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
//--> <!-- networking -->
|
|
<guard_cmd name="SAUTH_0012_ADB_C">
|
|
<debugger_detection>
|
|
<description>Networking ADB Always</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_ADB_C</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@GameTransactionSessionMgr@@QEAAXXZ</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ProcessResponse@GameTransactionBaseHttpTask@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?Init@HeartBeatHelper@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?Configure@HeartBeatGameTransactionHttpTask@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?Bail@NetworkInterface@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_ADB_D">
|
|
<debugger_detection>
|
|
<description>Networking_adb_random</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_ADB_D</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<!-- the entire purchase path -->
|
|
<include>
|
|
<location>
|
|
<label>?Configure@GameTransactionBaseHttpTask@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?ProcessResponse@GameTransactionBaseHttpTask@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?ProcessSuccess@GameTransactionHttpTask@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?ProcessSuccess@CNetShopTransaction</label>
|
|
</location>
|
|
<location>
|
|
<label>?ApplyDataToStats@CNetShopTransactionBase@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?ApplyDataToStats@InventoryItemSet@NetworkGameTransactions@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?ApplyDataToStats@PlayerBalance@NetworkGameTransactions@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?ApplyData@GameTransactionSessionMgr@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?ApplyDataToStats@CNetShopTransactionBase@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<!--<guard_cmd name="Networking_chk_all">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>Networking_chk_all</message>
|
|
<exit_code>1002</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>_unity_network_network2.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Bank_InitWidgets@CNetworkShoppingMgr@@</label>
|
|
</location>
|
|
<location>
|
|
<label>?Configure@BaseSessionGameTransactionHttpTask@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</checksum>
|
|
</guard_cmd> --> <!-- heartbeat -->
|
|
<range_cmd name="SAUTH_0012_RANGE_B">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Configure@HeartBeatGameTransactionHttpTask@@</code> <!-- send heartbeat -->
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ProcessResponse@GameTransactionBaseHttpTask@@</code> <!-- receive heartbeat -->
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?ProcessResponse@GameTransactionBaseHttpTask@@UEAA_NPEBDAEAH@Z</origin_function>
|
|
<caller_depth>4</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Bail@NetworkInterface@@</code> <!-- "tamper reaction" -->
|
|
</range>
|
|
<range>
|
|
<call_chain>
|
|
<origin_function>?Bail@NetworkInterface@@SAXW4eBailReason@</origin_function>
|
|
<caller_depth>4</caller_depth>
|
|
</call_chain>
|
|
</range>
|
|
<range>
|
|
<code>@HeartBeatHelper@@</code> <!-- helper/init code -->
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_E">
|
|
<checksum>
|
|
<description>Heartbeat_chk_all</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SAUTH_0012_RANGE_B</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@HeartBeatHelper@@QEAAXXZ</label> <!-- check when setting up the heartbeat manager -->
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Configure@HeartBeatGameTransactionHttpTask@@</label> <!-- ...and when the heartbeat goes out -->
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ProcessResponse@GameTransactionBaseHttpTask@@</label> <!-- ...and when it comes back -->
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SAUTH_0012_RANGE_B</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<!-- networking purchase path and statinterface use -->
|
|
<guard_cmd name="SAUTH_0012_OBF_C">
|
|
<obfuscation>
|
|
<description>Networking_obf</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SAUTH_0012_RANGE_B</range_name>
|
|
</range>
|
|
<range>
|
|
<code>?Configure@GameTransactionBaseHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ProcessResponse@GameTransactionBaseHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ProcessSuccess@GameTransactionHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ProcessSuccess@CNetShopTransaction</code>
|
|
</range>
|
|
<range>
|
|
<code>?Update@CNetworkShoppingMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@CNetShopTransactionBase@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@InventoryItemSet@NetworkGameTransactions@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@PlayerBalance@NetworkGameTransactions@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyData@GameTransactionSessionMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@CNetShopTransactionBase@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyVirtualCashBalance@MoneyInterface@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?DeserializeSessionInfo@BaseSessionGameTransactionHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?SetUsingGSTokenForTransactions@GameTransactionSessionMgr@@QEAAX_N@</code>
|
|
</range>
|
|
<range>
|
|
<code>?InitCatalog@CNetworkShoppingMgr@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_F">
|
|
<checksum>
|
|
<description>Networking_chk_purchase_path_all</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_F</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<code>?Configure@GameTransactionBaseHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ProcessResponse@GameTransactionBaseHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ProcessSuccess@GameTransactionHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ProcessSuccess@CNetShopTransaction</code>
|
|
</range>
|
|
<range>
|
|
<code>?Update@CNetworkShoppingMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@CNetShopTransactionBase@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@InventoryItemSet@NetworkGameTransactions@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@PlayerBalance@NetworkGameTransactions@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyData@GameTransactionSessionMgr@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyDataToStats@CNetShopTransactionBase@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?ApplyVirtualCashBalance@MoneyInterface@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?DeserializeSessionInfo@BaseSessionGameTransactionHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?SetUsingGSTokenForTransactions@GameTransactionSessionMgr@@QEAAX_N@</code>
|
|
</range>
|
|
<range>
|
|
<code>?InitCatalog@CNetworkShoppingMgr@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<label>?ProcessSuccess@GameTransactionHttpTask@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_G">
|
|
<checksum>
|
|
<description>Networking_chk_purchase_path_1</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_G</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@CNetShopTransactionBase@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<label>?Update@CNetworkShoppingMgr@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_H">
|
|
<checksum>
|
|
<description>Networking_chk_purchase_path_2</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_H</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<code>?ProcessSuccess@CNetShopTransaction@@</code>
|
|
</range>
|
|
<range>
|
|
<code>?DeserializeSessionInfo@BaseSessionGameTransactionHttpTask@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<label>?Update@CNetShopTransactionBase@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_I">
|
|
<checksum>
|
|
<description>Networking_chk_purchase_path_3</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_I</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<code>?ApplyDataToStats@CNetShopTransactionBase@@</code>
|
|
</range>
|
|
<range>
|
|
<code>ApplyVirtualCashBalance@MoneyInterface@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<label>?ProcessSuccess@CNetShopTransaction@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_J">
|
|
<checksum>
|
|
<description>Networking_chk_purchase_path_4</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_J</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ApplyDataToStats@PlayerBalance@NetworkGameTransactions@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ApplyDataToStats@InventoryItemSet@NetworkGameTransactions@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<label>?ApplyDataToStats@CNetShopTransactionBase@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_K">
|
|
<checksum>
|
|
<description>Networking_chk_purchase_path_to_statinterface</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_K</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SAUTH_0012_RANGE_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ApplyDataToStats@PlayerBalance@NetworkGameTransactions@@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ApplyDataToStats@InventoryItemSet@NetworkGameTransactions@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<!--
|
|
?Configure@GameTransactionBaseHttpTask@@
|
|
?ProcessResponse@GameTransactionBaseHttpTask@@
|
|
?ProcessSuccess@GameTransactionHttpTask@@
|
|
?Update@CNetworkShoppingMgr@@
|
|
?Update@CNetShopTransactionBase@@
|
|
?ProcessSuccess@CNetShopTransaction@@
|
|
?ApplyDataToStats@CNetShopTransactionBase@@
|
|
?ApplyDataToStats@InventoryItemSet@NetworkGameTransactions@@
|
|
?ApplyDataToStats@PlayerBalance@NetworkGameTransactions@@
|
|
CommandNetworkShopBasketApplyServerData
|
|
|
|
<range><code>?ProcessSuccess@GameTransactionHttpTask@@</code></range>
|
|
<range><code>?Bank_ApplyDataToStats@CNetworkShoppingMgr@@</code></range>
|
|
<range><code>?ApplyVirtualCashBalance@MoneyInterface@@</code></range>
|
|
<range><code>?SetStatValue@netCatalog</code></range>
|
|
<range><code>?GetStatDesc@StatsInterface@@</code></range>
|
|
<range><code>?SetStatData@StatsInterface@@</code></range>
|
|
<range><code>?OnSetStatValue@netCatalogBaseItem@@</code></range>
|
|
<range><code>?SetMaskedInt@StatsInterface@@</code></range>
|
|
<range><code>?SetStatData@CStatsDataMgr@@</code></range>
|
|
<range><code>?SetStatIterData@CStatsDataMgr@@</code></range>
|
|
--> <!-- level 2+ -->
|
|
<guard_cmd name="SAUTH_0012_CHK_L">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_L</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<guard_name>SAUTH_0012_ADB_B</guard_name>
|
|
</range>
|
|
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_G</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_K</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<location_name>CWEAPON_STARTRELOAD_CHECK_LOCAL_PLAYER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_M_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_M_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_ADB_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_I</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_N">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_N</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_E</guard_name>
|
|
</range>
|
|
<!--<range>
|
|
<guard_name>Networking_chk_all</guard_name>
|
|
</range>-->
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<location_name>CDOOR_ISDOORFULLYOPEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>.005</value>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_O_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_O_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_ADB_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_H</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_P">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_P</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<location_name>CWEATHER_UPDATEDAYNIGHTRATIO_DAY_TO_NIGHT_FADE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>.008</value>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_Q">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_Q</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_ADB_A</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<guard_name>SAUTH_0012_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_VVG_C</guard_name>
|
|
</range>
|
|
-->
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<location_name>CWEATHER_UPDATEDAYNIGHTRATIO_NIGHT_TO_DAY_FADE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>.0001</value>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_R_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_R_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_N</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_L</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_Q</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_R_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<location_name>CTASKWANDER_STATECROSROADATLIGHTS_ONEXIT_RELEASE_PED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_S">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_S</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_O_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_P</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<location_name>CVEHICLEMODELINFO_LOADVEHICLEMETAFILE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>crypto</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.75</value>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_T">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_T</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_R</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<guard_name>SAUTH_0012_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_S</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<location_name>CTASKDYINGDEAD_PROCESSBLOODPOOL_FORCE_FINISH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.3600</value>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_CHK_U">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SAUTH_0012_CHK_U</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_T</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_R_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<guard_name>SAUTH_0012_CHK_S</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<label>?LoadLoadingScreenMovie@CLoadingScreens@@</label> <!-- TODO: does this happen multiple times during gameplay? -->
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SAUTH_0012_VVG_C">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ReportCrime@CCrime@@SAXW4eCrimeType@@PEAVCEntity@@PEAVCPed@@I@Z</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_U</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_U</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SAUTH_0012_CHK_H</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CHLRP_0013_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rlComputeHMACTaskWorkItem</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rlComputeHMACTask</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CalculateHMACAndCompare</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>EncryptAndStringify</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Decrypt@rlPcPipeLauncherBaseWorkItem@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Encrypt@rlPcPipeLauncherBaseWorkItem@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>SendGameEccKey</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CertificateDetails</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>unwind</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>pdata</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CHLRP_0013_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_ECDH_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_HMAC_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>unwind</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>pdata</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CHLRP_0013_OBF_C">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CGAMESESSIONSTATEMACHINE_SWITCH_SECTION</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CHLRP_0013_OBF_D">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TamperActions</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>unwind</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>pdata</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>TAMPERACTIONS_INIT_NOP</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>3</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="CHLRP_0013_RANGES_A">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CERTIFICATEVERIFY_VERIFY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ROCKSTARCERTIFICATEVERIFICATION_DOWORK</range_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<patch_cmd name="TIEUP_0014_NOP_RANGES">
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>TAMPERACTIONS_INIT_NOP</range_name>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
<byte_sequence>
|
|
<byte>0x90</byte>
|
|
</byte_sequence>
|
|
<all>true</all>
|
|
<disable>false</disable>
|
|
</patch_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?CEntitlementManagerDuplicateEntitlementCheck@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_TIEUP_0014_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>TAMPERACTIONS_INIT_NOP</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKFIREPATROL_STARTONUPDATE_GET_FIRE_ORDER</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKDYINGDEAD_ONDYINGEXIT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPHONEMGR_CREATE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINMATCHMAKINGSESSION_JOIN_SESSION</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPAUSEMENU_UPDATE_PAUSE_PRESSED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_WORK</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_GET_SIGNIN_INFO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_WORK</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>sm_Sku</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_CLEANUP_DATA</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?StateHolster_OnEnter@CTaskSwapWeapon@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMACHINEHASH_MACHINEHASHWORKER_WORKERPROC_CALL_MACHINE_HASH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@CWeaponTarget</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGER_THREADENTRY_DOESDATABLOCKGRANTENTITLEMENT_GAME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?StateGunOnEnter@CTaskWeapon@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_ROCKSTARID</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CloseDoor_OnEnter@CTaskCloseVehicleDoorFromInside@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_ROCKSTARID</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCRIME_REPORTCRIME_REGISTER_CRIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_14_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCRIME_REPORTCRIME_SHOOT_COP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_B</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_B</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_22_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_C">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCARDOOR_BREAKLATCH_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_C</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_C</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_19_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_D">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDRADIOSTATION_COMPUTENEXTTRACKCATEGORY_RETURN_ADVERTISEMENTS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_D</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_D</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_1_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_E">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKMOBILEPHONE_TEXTLOOP_ONUPDATE_PUT_UP_TO_EAR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_E</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_E</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_89_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_F">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCOVER_FINDCLOSEST_COVER_POINT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_B</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_B</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_68_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_G">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_CREATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_K</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_K</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_H">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKCARREACTTOVEHICLECOLLISION_START_ONUPDATE_SET_ANGRY_STATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_F</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_F</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_I">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKCARREACTTOVEHICLECOLLISION_START_ONUPDATE_SET_FEAR_STATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_B</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_REP_B</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_27_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_J">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKREACTANDFLEE_CANSCREAM_CHECK_BRAVERY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_21_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_K">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWANTED_PLAYERENTERED_VEHICLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_6_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_L">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWIND_ADDEXPLOSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_B</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_B</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_M">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>FIRE_COMMANDS_COMMANDSTOPENTITYFIRE_EXTINGUISH_FIRES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_N</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_N</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_19_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_N">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CVEHICLEMODELINFO_LOADVEHICLEMETAFILE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_M</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_M</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_85_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_O">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKFIREPATROL_STARTONUPDATE_GET_FIRE_ORDER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_P</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_P</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_3_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_P">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKGETUP_PLAYINGGETUPCLIP_ONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_Q</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_REP_Q</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_9_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_VVG_Q">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKGETUP_PLAYINGREACTIONCLIP_ONENTER_GET_CLIP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TFIT_Game_key_54_iAES2</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_E_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_L</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_M</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_N</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_O</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_P</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_Q</guard_name>
|
|
</range>
|
|
-->
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_E_2">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_B</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_G</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEATHER_UPDATEDAYNIGHTRATIO_DAY_TO_NIGHT_FADE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.005</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TIEUP_0014_CHK_B</message>
|
|
<exit_code>0014</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_B</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_L</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_M</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_N</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_O</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_VVG_P</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_GUARDS_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKENTERVEHICLE_OPENDOOR_ONENTER_SETUP_RAGDOLL_COLLISION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TIEUP_0014_CHK_C</message>
|
|
<exit_code>0014</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_E</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?StartReload@CWeapon@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEAPON_STARTRELOAD_RAGESEC_REACTION</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOADINGSCREENS_INITUPDATEINTROMOVIE_SET_VOLUME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_E</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_E_2</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?DoReload@CWeapon@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CSAVEGAMEAUTOLOAD_AUTOLOADCHECKFORSIGNEDINPLAYER_SIGNED_IN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TIEUP_0014_CHK_D</message>
|
|
<exit_code>0014</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_GUARDS_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOTHMGR_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TIEUP_0014_CHK_D</message>
|
|
<exit_code>0014</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_E</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_REP_E_2</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_GUARDS_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_INITLEVEL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="TIEUP_0014_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>TIEUP_0014_CHK_F</message>
|
|
<exit_code>0014</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TIEUP_0014_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CMINIMAP_INIT_RESIZE_MAP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>SHAHashHelper</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SHAHashHelper@rage@@YAXPEBEIPEAD@Z</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_SHIFT@?1??SHAHashHelper@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_ALPHABET@?1??SHAHashHelper@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SMBIOS_GETMACHINEHASH_LOCATION_B</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>W32_GETMACHINEHASH_LOCATION_A</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>FALLBACKMACHINEHASHSTRATEGY_GETMACHINEHASH_CHECK_SIZE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WMI_GETMACHINEHASH_LOCATION_C</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>crypto</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SHAHashHelper@rage@@YAXPEBEIPEAD@Z</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_SHIFT@?1??SHAHashHelper@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_ALPHABET@?1??SHAHashHelper@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WORKERPROC_DELETE_HASH_STRATEGY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>crypto</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>3DMFX_0015_CHK_A</message>
|
|
<exit_code>0015</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SHAHashHelper@rage@@YAXPEBEIPEAD@Z</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>MACHINEHASH_SHAHASHHELPER_CALL_HASHING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>3DMFX_0015_ADB_A</message>
|
|
<exit_code>0015</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_HANDLEMESSAGE_TINI_PREPARE_CHALLENGE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_REP_C_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_D</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0010_CHK_I</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ENTLE_0011_CHK_AF</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>false</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_VVG_D">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCOVER_FINDCLOSEST_COVER_POINT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_ADB_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_ADB_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_REP_C_REVOLVING</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SHAHashHelperDuplicate@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_SHIFT@?1??SHAHashHelperDuplicate@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_SHIFT@?1??SHAHashHelperDuplicate@rage@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_CALL_MACHINE_HASH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>crypto</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SHAHashHelperDuplicate@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_SHIFT@?1??SHAHashHelperDuplicate@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BASE64_SHIFT@?1??SHAHashHelperDuplicate@rage@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CENTITLEMENTMANAGERDUPLICATE_THREADENTRY_CHECK_BLOCK_SIZE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>crypto</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>3DMFX_0015_CHK_B</message>
|
|
<exit_code>0015</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SHAHashHelperDuplicate@rage@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>MACHINEHASHDUPLICATE_SHAHASHHELPERDUPLICATE_CALL_HASHING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="3DMFX_0015_ADB_B">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>3DMFX_0015_ADB_B</message>
|
|
<exit_code>0015</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="3DMFX_0015_GUARDS_A">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_REP_C_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="3DMFX_0015_GUARDS_B">
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_VVG_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_VVG_C</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_VVG_D</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="3DMFX_0015_GUARDS_C">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_CHK_B</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>3DMFX_0015_ADB_B</guard_name>
|
|
</range>
|
|
-->
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="LUXE_0017_SCRIPT_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@apps_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@audio_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@camera_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@hud_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@misc_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@pad_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@ped_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@player_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@task_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@vehicle_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@object_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@script_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@stats_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@streaming_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@path_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@weapon_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@fire_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@zone_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@graphics_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@cutscene_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@clock_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@network_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@brain_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@water_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@lobby_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@event_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@interior_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@physics_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@gta_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@entity_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@itemsets_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@shapetest_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@decorator_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@datafile_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@socialclub_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@extrametadata_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@dlc_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@money_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@recording_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@replay_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@netshopping_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?SetupScriptCommands@localization_commands@@YAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="exact">?RegisterBuiltinCommands@scrThread@rage@@SAXXZ </code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RegisterCommand@scrThread@rage@</code>
|
|
</range>
|
|
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>SetupScriptCommands</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Init@CTheScripts@@SAXI@Z</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RegisterScriptCommands@CTheScripts@@CAXXZ</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RegisterCommand@scrThread@rage@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>3</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0017_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_INIT_FRAGMANAGER_CREATEALLOCATOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>WATER_INIT_GET_WATER_SURFACE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_CHK_A</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKTRYTOGRABVEHICLEDOOR_GRABVEHICLEDOOR_ONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>LUXE_0017_SCRIPT_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTHESCRIPTS_INIT_REGISTER_BUILTIN_COMMANDS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>LUXE_0017_SCRIPT_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTHESCRIPTS_INIT_INITIALIZE_SCRIPT_SHAPE_TEST_MANAGER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTHESCRIPTS_INIT_INIT_ENTRY_POINT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTHESCRIPTS_INIT_INITIALIZE_MISSION_REPLAY_STATS_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0017_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0017_ADB_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APP_COMMANDS_SETUPSCRIPTCOMMANDS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Init@fiPackfile@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ReInit@fiPackfile@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CAN_JOIN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_DROPSESSION_SETATTRIBUTE_NAMES</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_DOMATCHMAKINGCOMMON_SETUP_PROBABILITY_MATCHMAKING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Init@fiPackfile@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ReInit@fiPackfile@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKSWAPWEAPON_STATEDRAW_ONENTER_GETWEAPON_INFO</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKAIMGUNONFOOT_AIMOUTRO_NOT_AIMING_RECENTLY</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKTRYTOGRABVEHICLEDOOR_GRABVEHICLEDOOR_ONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_I">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_I</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0017_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPHYSICSCORE_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_ADDMATCHMAKINGRESULTS_CHECK_MAX_SESSIONS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_I</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_I</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VerifySignature@rlRosHttpFilter@rage@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VerifySignature@fiCloudHandle@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VerifySha1@Rsa@rage@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_VVG_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_SET_SIGNATURE_LENGTH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VerifySignature@rlRosHttpFilter@rage@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VerifySignature@fiCloudHandle@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VerifySha1@Rsa@rage@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_FINAL_SHA</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_ADB_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_FINAL_SHA</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_F</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbaes_api.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_VERSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>wbaes_api.obj</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_GET_DECODED_SIZE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_VVG_C">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKAIMGUNONFOOT_START_ONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_C</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKAIMGUNONFOOT_START_ONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_F</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_F</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CCRIMEWITNESSES_PROCESSRESULTCRIMEWITNESSED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.30</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_ADB_A</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@CInfoState@@SAXXZ</code>
|
|
</range>
|
|
-->
|
|
</include>
|
|
<!--
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CINFOSTATE_UPDATE_ACTIONS</range_name>
|
|
</range>
|
|
</exclude>
|
|
-->
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKUSEVEHICLESCENARIO_DRIVINGTOSCENARIO_ONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPEDINTELLIGENCE_CALLEDPOLICE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_G">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_G</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_REP_B</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CINFOSTATE_REFRESH_NEXT_CHECK</range_name>
|
|
</range>
|
|
-->
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CAI_INIT_CCOMBBATMANAGER_INITCLASS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_VVG_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CEXPLOSIONMANAGER_STARTEXPLOSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE_0018_CHK_H">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE_0018_CHK_H</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE_0018_REP_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>LIGHTS_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_CHECK_TUNABLES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_ENTRY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE2_0020_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_CALL_LOAD_MEMORY_CHECKS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_CHECK_TUNABLES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_CREATE_ITERATOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_CHECK_TUNABLES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_RESET_SYSTEM_TIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_LOADMEMORYCHECKS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_CALL_LOAD_MEMORY_CHECKS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_LOADMEMORYCHECKS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_CALL_LOAD_TUNABLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_LOADFROMJSON_LOAD_STUFF</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_VALIDATE_JSON</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_LOADFROMJSON_LOAD_STUFF</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_GETSYSTEMMSTIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="LUXE2_0020_BASE_GUARDS">
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_B</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE2_0020_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_ENTRY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKDIVETOGROUND_GETUPONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<fail/>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendInfoMetric@CNetworkTelemetry@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendTamperMetric@CNetworkTelemetry@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendMetric@CNetworkTelemetry@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Push@?$atQueue@VRageSecPluginGameReactionObject@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RemoteCheaterDetected@NetworkRemoteCheaterDetector@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKPLAYERONFOOT_SWAPWEAPONONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<fail/>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendInfoMetric@CNetworkTelemetry@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendTamperMetric@CNetworkTelemetry@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RemoteCheaterDetected@NetworkRemoteCheaterDetector@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_G</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_G</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADMEMORYCHECKS_LOOK_FOR_CRC</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE2_0020_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<!--
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CINFOSTATE_UPDATE_OTHER_ACTIONS</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CINFOSTATE_UPDATE_ENTRY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_D</guard_name>
|
|
</range>
|
|
|
|
-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKSHOCKINGEVENTREACT_STATEPLAYINGGENERICONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_K">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKSHOOTATTARGET_SHOOTATTARGET_ONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.008</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKVAULT_STATECLAMBERVAULT_ONENTER</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_WORK_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_REP_J">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKVEHICLECHASE_RAMONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.08</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE2_0020_CHK_F</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LUXE2_0020_REP_F</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTASKREACTANDFLEE_FLEEONENTER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LUXE2_0020_CHK_G">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LUXE2_0020_CHK_G</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>LUXE2_0020_BASE_GUARDS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAMESESSIONSTATEMACHINE_PROCESSCHECKFORRGSC</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWRD_0021_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SetVideoClipModifiedContent@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWRD_0021_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Init@fiPackfile@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ReInit@fiPackfile@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?GetSizeOfPool@fwConfigManager@rage@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_INIT_UPDATE_PROFILE_SETTINGS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>1</instances>
|
|
<debug>false</debug>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
|
|
<guard_cmd name="MGNTE_0023_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLIVEMANAGER_INIT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0023_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLIVEMANAGER_INIT_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLIVEMANAGER_INIT_CREATENETWORKHEAP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0023_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLIVEMANAGER_INIT_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLIVEMANAGER_INIT_INSTANTIATE_CLOUD_MANAGER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0023_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0023_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0023_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?HandleEntitlementEvent@rlPc</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Configure@rlRosTelemetryImmediateSubmissionTask@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CommonInit@rlRosTitleId@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??0rlRosTitleId@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPHONEMGR_INIT_CORE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.15</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRTHREAD_CREATETHREAD_STORE_SCRTHREAD_VFT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="substring">rageSec</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRTHREAD_CREATETHREAD_STORE_SCRTHREAD_VFT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SCRTHREAD_CREATETHREAD_RESET</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRTHREAD_CREATETHREAD_STORE_SCRTHREAD_VFT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SCRTHREAD_CREATETHREAD_RETURN_SUCCESS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CDISTANTLIGHTS2_UPDATE_REPORT_MODIFIED_VFT_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CDISTANTLIGHTS2_UPDATE_REPORT_MODIFIED_VFT_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CDISTANTLIGHTS2_UPDATE_REPORT_MODIFIED_VFT_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CDISTANTLIGHTS2_UPDATE_REPORT_MODIFIED_VFT_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CSTUNTJUMPMANAGER_INIT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTRAFFICLIGHTS_UPDATE_FIVEAM</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.0001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CPAUSEMENU_OPENCORRECTMENU</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTRAFFICLIGHTS_UPDATE_FIVEAM</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.0001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_D</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTRAIN_INIT_REGISTER_MOUNT_INTERFACES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0023_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_C</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPAUSEMENU_OPENCORRECTMENU_OPENMP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTRAFFICLIGHTS_UPDATE</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CSTUNTJUMPMANAGER_INIT_CORE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_F</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CDISTANTLIGHTS2_UPDATE_CHECK_MODIFIED_VFT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CDISTANTLIGHTS2_UPDATE_REPORT_MODIFIED_VFT_INNER</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPOSTSCAN_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MGNTE_0022_CHK_G_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MGNTE_0022_CHK_G_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MGNTE_0022_CHK_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>MGNTE_0023_CHK_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RtmaPlugin</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VideoModificationPlugin</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0023_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_SHORT_CIRCUIT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_CREATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
|
|
<guard_cmd name="LOWR2_0023_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0023_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RtmaPlugin_Work@@</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_DETERMINE_CHECK</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_QUEUE_OBJECT</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_DETERMINE_CHECK</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?EnumerateMemoryRegions@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_XOR_VALUE_SIZES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_DETERMINE_CHECK</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?EnumerateMemoryRegions@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_MOVEONTONEXTCHECK</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_QUEUE_OBJECT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_ADD_TO_FAILED_CRCS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_QUEUE_OBJECT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_SET_MEMORY_FLAGS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@MemoryRegionCheckDllName@@UEAA_</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_DETERMINE_CHECK_DLL_NAME_SETUP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@MemoryRegionCheckByteString@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_DETERMINE_CHECK_BYTE_STRING_SETUP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@MemoryRegionCheckDllName@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@MemoryRegionCheckByteString@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_CHECK_FAILED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0023_ADB_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_SET_PROCESSED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_ADB_B">
|
|
<debugger_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0023_ADB_B</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_CREATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VIDEOMODIFICATIONPLUGIN_WORK_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VIDEOMODIFICATIONPLUGIN_WORK_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_WORK_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0024_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECENGINE_INIT_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECENGINE_INIT_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0024_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECENGINE_INIT_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECENGINE_INIT_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0024_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ReInit@rageSecEngine@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECENGINE_UPDATE_REINIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0024_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0024_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rageSecEngine</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECENGINE_INIT_INNER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ReInit@rageSecEngine@rage</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPATHSERVER_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@rageSecEngine@rage@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@rageSecPluginManager@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RegisterPluginFunction@rageSecPluginManager@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECPLUGINMANAGER_CREATEPLUGINTASK_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECPLUGINMANAGER_CREATEPLUGINTASK</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECPLUGINMANAGER_CREATEPLUGINTASK_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECPLUGINMANAGER_CREATEPLUGINTASK_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECPLUGINMANAGER_DESTROYPLUGIN</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECPLUGINMANAGER_DESTROYPLUGIN_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECPLUGINMANAGER_DESTROYPLUGIN</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECPLUGINMANAGER_DESTROYPLUGIN_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECPLUGINMANAGER_DESTROYPLUGIN</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECGAMEPLUGINMANAGER_INIT_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECPLUGINMANAGER_DESTROYPLUGIN</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECPLUGINMANAGER_DESTROYPLUGIN_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLUGINBONDER_UPDATEBONDER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECGAMEPLUGINBONDER_UPDATEBONDER_SET_NEXT_CHECK_TIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLUGINBONDER_UPDATEBONDER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECGAMEPLUGINBONDER_UPDATEBONDER_SET_LAST_CHECK_TIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLGUINBONDERMANAGER_REBALANCEBONDERS_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECGAMEPLGUINBONDERMANAGER_REBALANCEBONDERS_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLGUINBONDERMANAGER_REBALANCEBONDERS_INNER</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECGAMEPLGUINBONDERMANAGER_REBALANCEBONDERS_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEAPON_STARTRELOAD_RAGESEC_REACTION</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEAPON_STARTRELOAD_CHECK_LOCAL_PLAYER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEAPON_STARTRELOAD_RAGESEC_REACTION</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CWEAPON_STARTRELOAD_PROCESS_STATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0023_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CREATE_BOOL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0023_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_G</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_PROCESSMATCHMAKINGRESULTS_ADD_MATCHMAKING_RESULTS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0023_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0023_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_ADB_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_REP_I</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>COMMANDCREATEAMBIENTPICKUP_CASH_CREATED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0024_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0024_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0024_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0024_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0024_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0024_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPAUSEMENU_CLOSE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0025_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@AmbientLights@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0025_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0025_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CAgitatedManager</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0026_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0026_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0026_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0024_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0025_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_CALL_LOAD_TUNABLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0026_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_MODIFICATIONDETECTIONUPDATE_CREATE_ITERATOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0026_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?GetPluginUpdateReferences@rageSecPluginManager</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@rageSecPluginManager@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?UpdateBonder@rageSecGamePluginBonder</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CreatePluginTask@rageSecPluginManager@rage</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLUGINBONDER_UPDATEBONDER</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECPLUGINMANAGER_CREATEPLUGINTASK_INNER</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKTELEMETRY_PLAYERSPAWN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0026_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0026_CHK_F</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTHESCRIPTS_INIT_INITIALIZE_MISSION_REPLAY_STATS_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0027_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CommandAddExplosion@fire_commands</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CommandAddExplosionWithUserVfx@fire_commands</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??CommandAddOwnedExplosion@fire_commands</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0027_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0027_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CommandAddExplosion@fire_commands</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CommandAddExplosionWithUserVfx@fire_commands</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??CommandAddOwnedExplosion@fire_commands</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADMEMORYCHECKS_LOOK_FOR_CRC</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="LOWR2_0027_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_LOWR2_0027_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0027_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SpentOnVehicleInsurancePremium@money_commands</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_VALIDATE_JSON</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0028_REP_A">
|
|
<repair>
|
|
<description>This is protecting the actual work that the rlPcPipeSendLauncherChallengeWorkItem::DoWork() is doing</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0028_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0028_REP_C">
|
|
<repair>
|
|
<description>This is protecting the actual work that the rlComputeHMACWorkItem::DoWork() is doing</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLCOMPUTEHMACWORKITEM_DOWORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_HMAC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Decrypt@rlPcPipeLauncherBaseWorkItem@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLCOMPUTEHMACWORKITEM_DOWORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0028_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLCOMPUTEHMACWORKITEM_DOWORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_HMAC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Decrypt@rlPcPipeLauncherBaseWorkItem@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLCOMPUTEHMACWORKITEM_DOWORK_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0028_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0028_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0028_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0028_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0028_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0028_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0029_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>ScriptHookPlugin</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>3</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0029_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0029_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?GetSizeOfPool@fwConfigManager@rage@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SCRIPTHOOKPLUGIN_WORK_SET_MP_HANDLED</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_IN_MULTIPLAYER</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_PROCESSFINDINGSTATE_JOIN_SESSION_OR_HOST</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0029_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0029_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>EXECT_0029_CHK_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0029_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0029_CHK_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?GetSizeOfPool@fwConfigManager@rage@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="EXECT_0030_TAMPERACTION_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?TamperAction_SendTelemetry@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?TamperAction_ReportPlayer@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?TamperAction_ClobberCode@@</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>EXECT_0030_TAMPERACTION_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@rlPcPipeSendLauncherChallengeWorkItem</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@rlPcPipeSendLauncherChallengeTask</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0030_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@rlPcPipeSendLauncherChallengeWorkItem</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@rlPcPipeSendLauncherChallengeTask</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_BODY</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_CHK_E_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<fail/>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>EXECT_0030_TAMPERACTION_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_REP_A">
|
|
<repair>
|
|
<description>This handles the sending of the ECC key. Nothing huge.</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPE_SENDGAMEECCKEY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_CONNECT_SENDGAMEECCKEY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPE_SENDGAMEECCKEY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_CONNECT_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0030_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0030_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0030_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_ECDH_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<!-- This is for the message handling -->
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_HANDLEMESSAGE_TINI_CONVERT_ECC_KEY</location_name>
|
|
</location>
|
|
<!-- This is for the constructor when I'm forming the ECDH key -->
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_CONSTRUCTOR_INITIALIZE_RNG</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_AES_CBC_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_TFIT_ECDH_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<!-- This is for the message handling -->
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_HANDLEMESSAGE_TINI_PREPARE_CHALLENGE</location_name>
|
|
</location>
|
|
<!-- This is for the constructor when I'm forming the ECDH key -->
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_CONSTRUCTOR_SET_END_TIMES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_REP_E">
|
|
<repair>
|
|
<description>This is protecting the code that does the basic handling of the incoming messages</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPE_HANDLEMESSAGE_CHALLENGE_RESPONSE_SECTION</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_CHECKINCOMINGDATA_HANDLE_MESSAGE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_REP_F">
|
|
<repair>
|
|
<description>This is protecting the code that does the basic handling of the incoming messages</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPE_HANDLEMESSAGE_CHALLENGE_RESPONSE_SECTION</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPE_CHECKINCOMINGDATA_HANDLE_MESSAGE_END_LOOP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_EXECT_0030_CHK_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0030_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0030_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0030_CHK_D_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0030_CHK_D_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0030_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0030_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0031_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>GameTransactionBaseHttpTask</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0031_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0031_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>GameTransactionBaseHttpTask</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0032_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<!--<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>AppendInfoMetric</code>
|
|
</range>-->
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>SetPlayerGamerData</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0032_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0032_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>SetPlayerGamerData</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CNETOBJPLAYER_SETPLAYERGAMERDATA_SET_QUALIFYING_PROPERTIES</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0033_REP_A">
|
|
<repair>
|
|
<description>This is where we protect the actual revolving checker plugin code</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>REVOLVINGCHECKERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>RevolvingCheckerPlugin_NestedWork</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>REVOLVINGCHECKERPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0033_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>REVOLVINGCHECKERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>RevolvingCheckerPlugin_NestedWork</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>REVOLVINGCHECKERPLUGIN_WORK_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0033_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<description>Protecting some of the guards covering revolving checks</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0033_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0033_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0033_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_RANGES_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0027_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_CHK_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection - replacing LOWR2_0026_CHK_D</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0026_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>LOWR2_0023_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_D_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_D_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PlayerSpawn@CNetworkTelemetry</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_E_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_E_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CHLRP_0013_RANGES_A</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_F_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_F_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?LoadFromJSON@CTunables</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_LOADFROMJSON_LOAD_STUFF</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_G_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_G_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RLPCPIPE_CONSTRUCTOR</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_H_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection - protecting code clobbering</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_H_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SetMemoryTamper</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RefreshCrc</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_I_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection - protecting code clobbering</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGpuCrash@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_I_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEATHER_UPDATE_RAGESEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Run@CPathServerThread@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0034_CHK_K_REVOLVING">
|
|
<checksum>
|
|
<description>Tying up loose ends from the previous protection - protecting code clobbering</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0034_CHK_K_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?InternalProcess@CTheScripts</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Process@CTheScripts@@SAXXZ</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0036_REP_A">
|
|
<repair>
|
|
<description>Doing some more protection on the ScriptHook Plugin</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRIPTHOOKPLUGIN_WORK_DETECTED_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SCRIPTHOOKPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0036_REP_C">
|
|
<repair>
|
|
<description>Doing some more protection on the ScriptHook Plugin</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRIPTHOOKPLUGIN_CONFIGURE_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>ScriptHookPlugin_Configure</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0036_REP_B">
|
|
<repair>
|
|
<description>Doing some more protection on the ScriptHook Plugin</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRIPTHOOKPLUGIN_WORK_DETECTED_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRIPTHOOKPLUGIN_CONFIGURE_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SCRIPTHOOKPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>SCRIPTHOOKPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0036_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0036_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0036_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0036_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>ScriptHookPlugin_Work</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>ScriptHookPlugin_OnSuccess</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>ScriptHookPlugin_OnFailure</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRIPTHOOKPLUGIN_WORK_DETECTED_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>SCRIPTHOOKPLUGIN_CONFIGURE_BODY</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0037_CHK_A">
|
|
<checksum>
|
|
<description>Protecting a bit of rage-sec that's so far gone unprotected</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ClobberCode@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0037_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RegisterPluginFunction@rageSec</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CScaleformMgr</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0037_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>AUDVEHICLECOLLISIONAUDO_HEADLIGHTSMASH_CALC_MAG</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GTAVB_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GTAVB_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<encoding>
|
|
<use>none</use>
|
|
</encoding>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0037_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<description>Protecting a bit of rage-sec that's so far gone unprotected</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ClobberCode@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0037_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0037_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0037_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0037_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<description>Protecting a bit of rage-sec that's so far gone unprotected</description>
|
|
<action>
|
|
<fail/>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_VVG_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>TRFIT_0005_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0037_CHK_D_REVOLVING">
|
|
<checksum>
|
|
<description>Protecting a bit of rage-sec that's so far gone unprotected</description>
|
|
<action>
|
|
<fail/>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GTAVB_0000_ENC_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>0.0001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0035_REP_A">
|
|
<repair>
|
|
<description>Protecting all of the revolving guards</description>
|
|
<protected_range>
|
|
<include>
|
|
$REVOLVING_GUARDS
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLPCPIPESENDLAUNCHERCHALLENGEWORKITEM_DOWORK_ENCRYPT_AND_STRINGIFY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0035_REP_B">
|
|
<repair>
|
|
<description>Protecting all of the revolving guards</description>
|
|
<protected_range>
|
|
<include>
|
|
$REVOLVING_GUARDS
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_WORK_CHECK_NUMBER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0035_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<fail/>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
$REVOLVING_GUARDS
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RLCOMPUTEHMACWORKITEM_DOWORK_UPDATE_WBSHA</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CPHONEMGR_INIT_CORE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0035_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0035_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0035_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0035_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0033_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_DOQUICKMATCH_FIND_SESSIONS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADFROMJSON_VALIDATE_JSON</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0035_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ClobberCode@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_EXECT_0035_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0035_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0033_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?LoadSaveGame@CGameSessionStateMachine</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?StartNewGame@CGameSessionStateMachine</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?ProcessReInitState@CGameSessionStateMachine</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="EXECT_0035_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ClearFacialIdleAnimOverride@CFacialDataComponent</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@CAgitatedConditionCanStepOutOfVehicle</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>TAMPERACTION_CLOBBERCODE_CLOBBER_MATCHMAKING</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_REP_A">
|
|
<repair>
|
|
<description>VEH Plugin Protection</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VEHDEBUGGERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VEHDEBUGGERPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_REP_B">
|
|
<repair>
|
|
<description>VEH Plugin Protection</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VEHDEBUGGERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VEHDEBUGGERPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VEHDEBUGGERPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_REP_C">
|
|
<repair>
|
|
<description>Linked Data Reporter Plugin Protection</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>LINKDATAREPORTERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>LINKDATAREPORTERPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_REP_D">
|
|
<repair>
|
|
<description>Linked Data Reporter Plugin Protection</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>LINKDATAREPORTERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>LINKDATAREPORTERPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>LINKDATAREPORTERPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_REP_E">
|
|
<repair>
|
|
<description>Position Plugin Protection</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>POSITIONPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>POSITIONPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_REP_F">
|
|
<repair>
|
|
<description>Position Plugin Protection</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>POSITIONPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>POSITIONPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>POSITIONPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_BIKER_0038_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>BIKER_0038_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>BIKER_0038_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_BIKER_0038_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>BIKER_0038_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>BIKER_0038_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_BIKER_0038_CHK_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>BIKER_0038_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>BIKER_0038_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_CHK_D_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_BIKER_0038_CHK_D_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>PositionPlugin_Create</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>PositionPlugin_Configure</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>PositionPlugin_Work</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>POSITIONPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_CHK_E_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_BIKER_0038_CHK_E_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>PositionPlugin_OnSuccess</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>PositionPlugin_OnFailure</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="BIKER_0038_POSITION_REFRESH_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Teleport@CVehicle@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SetWarp@CWarpManager@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Teleport@CPed</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AttachPedToEnterCar@CPed</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?CreatePlayer@CGameWorld</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="BIKER_0038_CHK_F_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_BIKER_0038_CHK_F_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>BIKER_0038_POSITION_REFRESH_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<protected_types>
|
|
<custom>
|
|
<data>false</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="IMEXP_0039_HKD_A_REVOLVING">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_IMEXP_0039_HKD_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<description>GetWriteWatch</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>GetWriteWatch</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="IMEXP_0039_HKD_B_REVOLVING">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_IMEXP_0039_HKD_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<description>ResetWriteWatch</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>ResetWriteWatch</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="IMEXP_0039_HKD_C_REVOLVING">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_IMEXP_0039_HKD_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<description>GetFrameCounter</description>
|
|
<module_name>GTAV.exe</module_name>
|
|
<function_name>?Call@scrWrapped_GET_FRAME_COUNT@</function_name>
|
|
</target>
|
|
<target>
|
|
<description>GetFrameCounter</description>
|
|
<module_name>GTA5.exe</module_name>
|
|
<function_name>?Call@scrWrapped_GET_FRAME_COUNT@</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="IMEXP_0039_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_IMEXP_0039_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ObjectCreationFunction@object_commands</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0035_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="IMEXP_0039_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_IMEXP_0039_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>GetCurrentGtaScriptHandlerNetwork@CTheScripts@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="IMEXP_0039_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>IMEXP_0039_HKD_A_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>IMEXP_0039_HKD_B_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>IMEXP_0039_HKD_C_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0040_HKD_A">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SRACE_0040_HKD_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_WORK_BODY_RESOLVING_VTABLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<description>GetFrameCounter</description>
|
|
<module_name>GTAV.exe</module_name>
|
|
<function_name>?Call@scrWrapped_GET_FRAME_COUNT@</function_name>
|
|
</target>
|
|
<target>
|
|
<description>GetFrameCounter</description>
|
|
<module_name>GTA5.exe</module_name>
|
|
<function_name>?Call@scrWrapped_GET_FRAME_COUNT@</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0040_HKD_B">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SRACE_0040_HKD_B</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_WORK_BODY_RESOLVING_VTABLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<description>VirtualQueryEx</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>VirtualQueryEx</function_name>
|
|
</target>
|
|
<target>
|
|
<description>OpenProcess</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>OpenProcess</function_name>
|
|
</target>
|
|
<target>
|
|
<description>GetModuleHandle</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>GetModuleHandle</function_name>
|
|
</target>
|
|
<target>
|
|
<description>GetModuleHandleEx</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>GetModuleHandleEx</function_name>
|
|
</target>
|
|
<target>
|
|
<description>GetModuleFileNameA</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>GetModuleFileNameA</function_name>
|
|
</target>
|
|
<target>
|
|
<description>GetModuleFileNameW</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>GetModuleFileNameW</function_name>
|
|
</target>
|
|
<target>
|
|
<description>ReadProcessMemory</description>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>ReadProcessMemory</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0040_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VFXLENS_UPDATE_RAGE_SEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Run@CPathServerThread@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PlayerSpawn@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendInfoMetric@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@MetricInfoChange@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendTamperMetric@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@MetricTamper@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>LINKDATAREPORTERPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0040_REP_B_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VFXLENS_UPDATE_RAGE_SEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Run@CPathServerThread@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PlayerSpawn@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendInfoMetric@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@MetricInfoChange@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendTamperMetric@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@MetricTamper@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0041_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>APICHECKPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0040_HKD_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0040_HKD_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_WORK_BODY_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0041_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>APICHECKPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0040_HKD_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0040_HKD_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0041_REP_C_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>ApiCheckPlugin_Work</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>APICHECKPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0040_HKD_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0040_HKD_B</guard_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0041_REP_D_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0040_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0041_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0041_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0041_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLUGINMANAGER_INIT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ApiCheckPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?LinkDataReporterPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PositionPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RevolvingCheckerPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RtmaPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RtmaHelperPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ScriptHookPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VehDebuggerPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VideoModificationPlugin_Init</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECGAMEPLUGINMANAGER_INIT_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0041_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLUGINMANAGER_INIT</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ApiCheckPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?LinkDataReporterPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PositionPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RevolvingCheckerPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RtmaPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?ScriptHookPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VehDebuggerPlugin_Init</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?VideoModificationPlugin_Init</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ECPLUGIN_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0041_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SRACE_0041_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0041_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0041_REP_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0042_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>APICHECKPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_WORK_BODY_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0042_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>APICHECKPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0042_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>OSMODULEINITIALIZER_INITIALIZE</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>OSMODULEINITIALIZER_INITIALIZE_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0042_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>OSMODULEINITIALIZER_INITIALIZE</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>OSMODULEINITIALIZER_INITIALIZE_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0042_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>APICHECKPLUGIN_CREATE_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_INIT_REGISTER_PLUGIN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0042_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>APICHECKPLUGIN_CREATE_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_CREATE_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
</custom>
|
|
</protected_types>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0042_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SRACE_0042_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0042_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0042_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0042_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0042_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0042_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0042_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0043_REP_A">
|
|
<repair>
|
|
<description>Protecting some of the guards covering revolving checks</description>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0033_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>EXECT_0033_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CREATE_BOOL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0043_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<description>Protecting some of the guards covering revolving checks</description>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_SendTelemetry@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SRACE_0043_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>SRACE_0043_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0044_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>IsCheatAlreadyNotified</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>SetCheatAsNotified</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0044_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_SRACE_0044_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CReportCashSpawnEvent</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SRACE_0044_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<fail/>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>HasBeenReported</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>AddToReported</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CUpdateFxnEvent</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="GNRNR_0045_HKD_A_REVOLVING">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_GNRNR_0045_HKD_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<module_name>Kernel32.dll</module_name>
|
|
<function_name>GetSystemTimeAsFileTime</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="GNRNR_0045_HKD_B_REVOLVING">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_GNRNR_0045_HKD_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<module_name>GTA5.exe</module_name>
|
|
<function_name>?IsRecordingMapObject@CReplayInterfaceObject</function_name>
|
|
</target>
|
|
<target>
|
|
<module_name>GTAV.exe</module_name>
|
|
<function_name>?IsRecordingMapObject@CReplayInterfaceObject</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="GNRNR_0045_HKD_C_REVOLVING">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_GNRNR_0045_HKD_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<module_name>GTA5.exe</module_name>
|
|
<function_name>?IsRadioUpgraded@audCarAudioEntity</function_name>
|
|
</target>
|
|
<target>
|
|
<module_name>GTAV.exe</module_name>
|
|
<function_name>?IsRadioUpgraded@audCarAudioEntity</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="GNRNR_0046_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEATHER_UPDATE_RAGESEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Run@CPathServerThread@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CREATE_BOOL</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="GNRNR_0046_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEATHER_UPDATE_RAGESEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Run@CPathServerThread@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_C_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_C_REVOLVING</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>LINKDATAREPORTERPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="GNRNR_0046_REP_C_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEATHER_UPDATE_RAGESEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Run@CPathServerThread@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>GNRNR_0046_REP_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0047_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*brain_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*ped_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*player_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*object_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*netshopping_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*money_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*misc_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*event_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Command.*entity_commands.*</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0047_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Call.*scrWrapped.*player_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Call.*scrWrapped.*ped_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Call.*scrWrapped.*netshopping_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Call.*scrWrapped.*money_commands.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Call.*scrWrapped.*entity_commands.*</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0047_OBF_C">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>GameTransactionHttpTask</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>NetworkGameTransactions</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?GetTransactionObj</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0047_OBF_D">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>PATHSERVER_RUN_RAGE_SEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEATHER_UPDATE_RAGESEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CWEAPON_STARTRELOAD_RAGESEC_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VFXLENS_UPDATE_RAGE_SEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PlayerSpawn@CNetworkTelemetry</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0047_OBF_E">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CStatsSavesMgr</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0047_OBF_F">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>RtmaHelperPlugin</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Read@pgStreamer</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TamperAction_ReactGpuCrash</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?LockTargets@GBuffer@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VEHDEBUGGERPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>VIDEOMODIFICATIONPLUGIN_IN_MULTIPLAYER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>.25</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_XMS17_0048_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Bail@CNetwork@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SetMemoryTamperCRC@CNetworkAssetVerifier</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Trigger@CNetworkInfoChangeEvent@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?StartWeatherTransitionToGlobal@CNetwork@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Trigger@CGameClockEvent</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?SubmitText@CNetworkTextChat@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CREATE_BOOL</location_name>
|
|
</location>
|
|
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>.50</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_XMS17_0048_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VFXLENS_UPDATE_RAGE_SEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>PATHSERVER_RUN_RAGE_SEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@CVfxLens@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?SetPlayerInfo@CNetGamePlayer</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>.20</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>XMS17_0048_CHK_C</message>
|
|
<exit_code>0048</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Read@pgStreamer</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TamperAction_ReactGpuCrash</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?LockTargets@GBuffer@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Serialize@SpendEarnTransaction@NetworkGameTransactions</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>CommandNetGameServerStartSession</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>CommandNetGameServerBasketStart</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?PlayerHasJoined@CNetObjPlayer</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>XMS17_0048_CHK_D</message>
|
|
<exit_code>0048</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>VFXLENS_UPDATE_RAGE_SEC_POP_REACTION</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Run@CPathServerThread@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PlayerSpawn@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendInfoMetric@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@MetricInfoChange@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendTamperMetric@CNetworkTelemetry</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@MetricTamper@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAHELPERPLUGINAPPEND_GENERATE_TIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAHELPERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAHELPERPLUGIN_WORK_CHECK_ITEMS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAHELPERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAHELPERPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAHELPERPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_REP_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAHELPERPLUGINAPPEND_APPEND</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Read@pgStreamer</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?LockTargets@GBuffer@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAHELPERPLUGIN_WORK_SET_GPU_CRASH</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAHELPERPLUGIN_WORK_SET_CRASH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0048_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_XMS17_0048_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CommandAddOwnedExplosion</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Update@CWeather</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>CommandNetGameServerBasketApplyServerData</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0049_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0049_REP_B_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="XMS17_0049_REP_C_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>XMS17_0048_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="CLOCK_BODIES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_50_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_40_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_30_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_20_BODY</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_10_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ACSPU_0050_PLUGIN_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>ClockGuardPlugin</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>DebuggerCheckPlugin</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>TunablesVerifierPlugin</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0050_PLUGIN_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="ACSPU_0050_COMMAND_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CommandTriggerScriptEvent</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CommandCreateObjectNoOffset</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CommandNetGameServerBeginService</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CommandSetWantedLevelDifficulty</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CommandAddExplosion</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<range_cmd name="ACSPU_0050_GAMSERVER_BONUS_RANGES">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>SendBonusEvent</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>HttpTask</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0050_COMMAND_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_OBF_C">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0050_GAMSERVER_BONUS_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>DEBUGGERCHECKPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_WORK</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>DEBUGGERCHECKPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>DebuggerCheckPlugin_Check</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_WORK_BODY_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>DebuggerCheckPlugin_Check</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>TUNABLESVERIFIERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>TUNABLESVERIFIERPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>TUNABLESVERIFIERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>TUNABLESVERIFIERPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>TUNABLESVERIFIERPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0050_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CTUNABLES_LOADMEMORYCHECKS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CTUNABLES_LOADMEMORYCHECKS_VERSION_SHA</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0050_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_10</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0050_CHK_C</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_20</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0050_CHK_D</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_30</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0050_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>TamperAction_ReactGpuCrash</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0050_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0050_COMMAND_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0050_GAMSERVER_BONUS_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_40</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="ACSPU_0051_GPU_CRASH_RANGE">
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?TamperAction_ReactGpuCrash@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?LockTargets@GBuffer@</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0051_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<fail>
|
|
</fail>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0051_GPU_CRASH_RANGE</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>TUNABLESVERIFIERPLUGIN_WORK_GET_NUM_CHECKS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_WORK_BODY_ENTRY</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_20</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_50</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_WORK_BODY_RESOLVING_VTABLE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0051_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>TamperAction_GameserverReport</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0051_CHK_B</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Trigger@CNetworkIncrementStatEvent@@SAXIHPEAVnetPlayer@r</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?SetMemoryTamperCRC@CNetworkAssetVerifier</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>Trigger@CNetworkInfoChangeEvent@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AppendInfoMetric@CNetworkTelemetry</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>DEBUGGERCHECKPLUGIN_WORK_BODY_MID</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_00</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_30</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>.40</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0052_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0052_REP_B_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_REP_H</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0052_REP_C_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0052_REP_D_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0050_CHK_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0051_GPU_CRASH_RANGE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0050_COMMAND_RANGES</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ACSPU_0050_GAMSERVER_BONUS_RANGES</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0052_REP_E_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0051_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0051_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
|
|
<guard_cmd name="ACSPU_0054_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>RTMAPLUGIN_WORK_MOVEONTONEXTCHECK_BODY</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_MOVEONTONEXTCHECK</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0054_HKD_A">
|
|
<hook_detection>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0054_HKD_A</action_param>
|
|
</call>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_00</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<description>Wait</description>
|
|
<module_name>GTAV.exe</module_name>
|
|
<function_name>?Wait@scrThread@</function_name>
|
|
</target>
|
|
<target>
|
|
<description>IsDlcPresent</description>
|
|
<module_name>GTAV.exe</module_name>
|
|
<function_name>?CommandIsDLCPresent@dlc_commands@</function_name>
|
|
</target>
|
|
<target>
|
|
<description>Wait</description>
|
|
<module_name>GTA5.exe</module_name>
|
|
<function_name>?Wait@scrThread@</function_name>
|
|
</target>
|
|
<target>
|
|
<description>IsDlcPresent</description>
|
|
<module_name>GTA5.exe</module_name>
|
|
<function_name>?CommandIsDLCPresent@dlc_commands@</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0054_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGpuCrash@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_ACSPU_0054_CHK_A</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RTMAPLUGIN_WORK_SHORT_CIRCUIT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_30</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_WORK_BODY_RESOLVING_FIRST_BYTE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ACSPU_0054_REP_B_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0054_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0054_HKD_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ACSPU_0054_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CLOCKGUARDPLUGIN_WORK_00_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGameServerAndCrash@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MBHUB_0055_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?BeginService@CNetworkShoppingMgr@@QEAA_NAEAIIIIIHH@Z</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGameServerAndCrash@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MBHUB_0055_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??$CreateTask@VBonusEventHttpTask@@@rlTaskManager@rage@@QEAAPEAVBonusEventHttpTask@@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGameServerAndCrash@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MBHUB_0055_CHK_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?HandleEvent@netEventMgr@rage@@QEAAXPEAVnetGameEvent@2</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_CHK_D_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGameServerAndCrash@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MBHUB_0055_CHK_D_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PrepareEvent@netEventMgr@rage@@QEAAXPEAVnetGameEvent@2</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>RevolvingCheckerPlugin_NestedWork</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CNetShopTransactionBase</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_ReactGameServerAndCrash@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MBHUB_0055_CHK_E</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>RevolvingCheckerPlugin_Work</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>REVOLVINGCHECKERPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>APICHECKPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MBHUB_0055_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??$CreateTask@VBonusEventHttpTask@@@rlTaskManager@rage@@QEAAPEAVBonusEventHttpTask@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?HandleEvent@netEventMgr@rage@@QEAAXPEAVnetGameEvent@2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?PrepareEvent@netEventMgr@rage@@QEAAXPEAVnetGameEvent@2</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_40</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_00</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0056_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_ARENA_0056_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?AngleClamp@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0056_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_ARENA_0056_CHK_B_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Truncate@datGrowBuffer</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0056_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_ARENA_0056_CHK_C_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?GetInf@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0056_CHK_D_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_ARENA_0056_CHK_D_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?MoveColEntToList@CPlantMgr</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0056_CHK_E_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_ARENA_0056_CHK_E_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?RenderAlphaEntityInteriorLocationCheck_Common@CRenderPhaseDrawSceneInterface</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0055_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ARENA_0056_CHK_A_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ARENA_0056_CHK_B_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ARENA_0056_CHK_C_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ARENA_0056_CHK_D_REVOLVING</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ARENA_0056_CHK_E_REVOLVING</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_00</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0058_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>EcPlugin</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0058_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ECPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ECPLUGIN_WORK_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0058_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ECPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ECPLUGIN_ONSUCCESS</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>ECPLUGIN_ONFAILURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0058_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ARENA_0058_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>ARENA_0058_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="ARENA_0058_REP_B_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CNetworkShoppingMgr</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_00</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CLOCKGUARDPLUGIN_WORK_20</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0059_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@MemoryRegionCheckPageByteString@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_DETERMINE_CHECK_PAGE_BYTE_STRING_SETUP</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.01</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0059_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@MemoryRegionCheckPageByteString@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RTMAPLUGIN_WORK_CHECK_FAILED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.01</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<compression>none</compression>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0059_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Check@MemoryRegionCheckPageByteString@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>EnumerateMemoryRegions</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0059_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MISSL_0059_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MISSL_0059_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0059_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<call>
|
|
<action_proc>?TamperAction_GameserverReport@@</action_proc>
|
|
<action_param>$RANDOM_DWORD_MISSL_0059_CHK_A_REVOLVING</action_param>
|
|
</call>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MISSL_0059_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MISSL_0059_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0060_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>MISSL_0060_CHK_A</message>
|
|
<exit_code>0060</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??$WriteInt@_J@datBitBuffer@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?WriteUnsigned@datBitBuffer@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?WriteUns@datBitBuffer@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CNETWORKSESSION_JOINSESSIONORHOST_CONSIDER_SESSION_CAN_JOIN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0060_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>MISSL_0060_CHK_B</message>
|
|
<exit_code>0060</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??$WriteInt@_J@datBitBuffer@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?WriteUnsigned@datBitBuffer@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?WriteUns@datBitBuffer@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?PlayerHasJoinedSession@CNetwork</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>0.33</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0060_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>MISSL_0060_CHK_C</message>
|
|
<exit_code>0060</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>??$WriteInt@_J@datBitBuffer@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?WriteUnsigned@datBitBuffer@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?WriteUns@datBitBuffer@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?PlayerHasLeftSession@CNetwork</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0060_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?PlayerHas.*CNetwork.*</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>4</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0060_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CNetwork@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>NetworkInterface</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Bail@CNetwork</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<transformation>obf_chopup</transformation>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0060_OBF_C">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Register.*gameSkeleton.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Register.*CGame.*</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Init@CGameWorld@@SAXI@Z</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CGAME_INIT_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CGame</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>CGAME_INIT_BODY</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_INIT_TELEMETRY_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Register.*CGame.*</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_REGISTER_GAME_SKELETON_FUNCTIONS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code matching="regex">$BACKSLASH?Register.*CGame.*</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>CGAME_INIT_TELEMETRY_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>MISSL_0061_CHK_A</message>
|
|
<exit_code>0061</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Init@rageSecGamePluginManager@@SAXI</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>RAGESECGAMEPLUGINMANAGER_INIT</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@PostFX</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@AnimPostFXManager</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CShaderHairSort</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CTheScripts</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CTrain</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CPhoneMgr</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CMiniMap_Common</label>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CGameWorldHeightMap</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<guard_name>MISSL_0061_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>?Init@CLoadingScreens</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_OBF_C">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rageSecGenericTask</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rageSecGenericWorkItem</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>MISSL_0061_CHK_B</message>
|
|
<exit_code>0061</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rageSecGenericTask</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rageSecGenericWorkItem</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<label>ClearTransitionParameters</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.10</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rageSecGenericTask</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>rageSecGenericWorkItem</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>RAGESECGENERICTASK_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_REP_G_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CNetworkShoppingMgr</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>EcPlugin_Work</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ECPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="MISSL_0061_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>MISSL_0061_CHK_C_REVOLVING</message>
|
|
<exit_code>0061</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>CNetworkShoppingMgr</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>EcPlugin_Work</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<range_name>ECPLUGIN_WORK_BODY</range_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CSHST_0062_HKD_A_REVOLVING">
|
|
<hook_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>CSHST_0062_HKD_A_REVOLVING</message>
|
|
<exit_code>0062</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
<target>
|
|
<module_name>ntdll.dll</module_name>
|
|
<function_name>NtQueryVirtualMemory</function_name>
|
|
</target>
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CSHST_0062_CHK_A_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>CSHST_0062_CHK_A_REVOLVING</message>
|
|
<exit_code>0062</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@papi</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CSHST_0062_CHK_B_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>CSHST_0062_CHK_B_REVOLVING</message>
|
|
<exit_code>0062</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@Kernel32</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@NtDll</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Push@?$atQueue@VRageSecPluginGameReactionObject@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CSHST_0062_CHK_C_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>CSHST_0062_CHK_C_REVOLVING</message>
|
|
<exit_code>0062</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@papi</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CSHST_0062_REP_A_REVOLVING">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@Kernel32</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@NtDll</code>
|
|
</range>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?Push@?$atQueue@VRageSecPluginGameReactionObject@</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CSHST_0062_CHK_D_REVOLVING">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>CSHST_0062_CHK_D_REVOLVING</message>
|
|
<exit_code>0062</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>?StateDraw_OnEnter@CTaskSwapWeapon@@AEAA?AW4FSM_Return@aiTask@rage@@XZ</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>gtav_pc</image_name>
|
|
<location_name>$REVOLVING_LOCATION_GEN</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="CSHST_0062_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
<code>@papi</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<print_cmd name="print_image">
|
|
<range>
|
|
<image_name>gtav_pc</image_name>
|
|
</range>
|
|
<disable>$FAST_PROTECT</disable>
|
|
</print_cmd>
|
|
|
|
$QA_PRINT_COMMANDS
|
|
$GUARD_OBFUSCATION
|
|
</image_cmd>
|
|
</guardSpec> |