CLEO related
monday
Expert
- Joined
- Jun 23, 2014
- Messages
- 1,126
- Solutions
- 1
- Reaction score
- 158
it didn't have the source code included, only the compiled code, that's how it looks
Code:
// This file was decompiled using SASCM.ini published by GTAG (http://gtag.gtagaming.com/opcode-database) on 14.6.2013
{$CLEO .cs}
//-------------MAIN---------------
0000: NOP
thread "THREAD_NAME__"
:THREAD_NAME___19
wait 0
SAMP.Available
jf @THREAD_NAME___19
17@ = -2460
16@ = -2338
15@ = -1500
14@ = -431
0B34: samp register_client_command "aim" to_label @THREAD_NAME___2388
25@ = 0
wait 10000
:THREAD_NAME___96
wait 0
if
SAMP.IsLocalPlayerSpawned
jf @THREAD_NAME___254
call 17@ 0 18@
if or
18@ == 1
18@ == 2
18@ == 3
18@ == 4
jf @THREAD_NAME___254
chatmsg "Leidimas naudotis {00FF00}< Aim > {FFFF00}duotas! Aktyvuoti su: {00FF00}/aim" -256
goto @THREAD_NAME___261
:THREAD_NAME___254
goto @THREAD_NAME___96
:THREAD_NAME___261
wait 0
if
25@ == 1
jf @THREAD_NAME___405
call 16@ 4 24 56 2.0 4
if
key_down 2
jf @THREAD_NAME___398
if
call 15@ 1 50.0 24@
jf @THREAD_NAME___398
if
0AD2: 23@ = player $PLAYER_CHAR targeted_actor //IF and SET
jf @THREAD_NAME___384
call 14@ 2 23@ 18@
goto @THREAD_NAME___398
:THREAD_NAME___384
call 14@ 2 24@ 18@
:THREAD_NAME___398
goto @THREAD_NAME___424
:THREAD_NAME___405
call 16@ 4 24 56 1.0 4
:THREAD_NAME___424
goto @THREAD_NAME___261
10@ = -2030
11@ = -877
12@ = -670
if and
not Actor.Dead(0@)
not SAMP.IsPlayerPaused(0@)
02CB: actor 0@ bounding_sphere_visible
jf @THREAD_NAME___665
if
call 10@ 2 0@ 1@
jf @THREAD_NAME___665
068D: get_camera_position_to 4@ 5@ 6@
04C4: store_coords_to 7@ 8@ 9@ from_actor 0@ with_offset 0.0 0.0 0.0
if
06BD: no_obstacles_between 7@ 8@ 9@ and 4@ 5@ 6@ solid 1 car 0 actor 0 object 1 particle 0
jf @THREAD_NAME___665
call 11@ 3 7@ 8@ 9@ 5@ 4@
call 12@ 2 5@ 4@ 5@ 4@
if
key_down 1
jf @THREAD_NAME___665
0A8C: write_memory 11989592 size 4 value 4@ virtual_protect 0
:THREAD_NAME___665
ret 0
if
not 0@ >= -0.2
jf @THREAD_NAME___768
0087: 3@ = 0@ // (float)
3@ *= 10.0
3@ = Math.Ceil(3@)
3@ *= -1.0
3@ -= 1.0
4@ = Math.Power(1.47, 3@)
4@ /= 1000.0
005B: 1@ += 4@ // (float)
:THREAD_NAME___768
if
0@ > 0.2
jf @THREAD_NAME___866
0087: 3@ = 0@ // (float)
3@ *= -10.0
3@ = Math.Ceil(3@)
3@ *= -1.0
3@ -= 1.0
4@ = Math.Power(1.67, 3@)
4@ /= 1000.0
005B: 1@ += 4@ // (float)
:THREAD_NAME___866
ret 2 0@ 1@
20@ = -1421
21@ = -1465
068D: get_camera_position_to 9@ 10@ 11@
call 20@ 6 0@ 1@ 2@ 9@ 10@ 11@ 12@
call 21@ 4 0@ 1@ 9@ 10@ 13@
12@ -= 270.0
13@ -= 90.0
12@ /= 57.29578
13@ /= 57.29578
22@ = -1071
23@ = -1206
call 22@ 2 12@ 13@ 12@ 13@
call 23@ 2 12@ 13@ 12@ 13@
ret 2 12@ 13@
if
0@ > 3.141593
jf @THREAD_NAME___1102
0@ -= 6.283185
:THREAD_NAME___1102
if
not 0@ >= -3.141593
jf @THREAD_NAME___1133
0@ += 6.283185
:THREAD_NAME___1133
if
1@ > 3.141593
jf @THREAD_NAME___1164
1@ -= 6.283185
:THREAD_NAME___1164
if
not 1@ >= -3.141593
jf @THREAD_NAME___1195
1@ += 6.283185
:THREAD_NAME___1195
ret 2 0@ 1@
0470: 31@ = actor $PLAYER_ACTOR current_weapon
if and
31@ >= 22
not 31@ > 29
jf @THREAD_NAME___1259
0@ -= 0.0778
1@ += 0.04253
:THREAD_NAME___1259
if
31@ == 32
jf @THREAD_NAME___1297
0@ -= 0.0778
1@ += 0.04253
:THREAD_NAME___1297
if and
31@ >= 30
not 31@ > 31
jf @THREAD_NAME___1342
0@ -= 0.052
1@ += 0.028
:THREAD_NAME___1342
20@ = -1071
if
31@ == 33
jf @THREAD_NAME___1390
0@ -= 0.0357
1@ += 0.01897
:THREAD_NAME___1390
call 20@ 2 0@ 1@ 0@ 1@
ret 2 0@ 1@
0509: 6@ = distance_between_XY 0@ 1@ and_XY 3@ 4@
0063: 2@ -= 5@ // (float)
0604: get_Z_angle_for_point 6@ 2@ store_to 7@
ret 1 7@
0063: 0@ -= 2@ // (float)
0063: 1@ -= 3@ // (float)
0604: get_Z_angle_for_point 0@ 1@ store_to 4@
ret 1 4@
0087: 28@ = 0@ // (float)
0A8D: 29@ = read_memory 12010640 size 4 virtual_protect 0
29@ += 4
0A8D: 29@ = read_memory 29@ size 4 virtual_protect 0
30@ = 0
:THREAD_NAME___1548
0A8D: 31@ = read_memory 29@ size 1 virtual_protect 0
29@ += 1
if and
31@ >= 0
128 > 31@
jf @THREAD_NAME___1803
005A: 31@ += 30@ // (int)
if
056D: actor 31@ defined
jf @THREAD_NAME___1803
if
803C: not $PLAYER_ACTOR == 31@ // (int)
jf @THREAD_NAME___1803
04C4: store_coords_to 27@ 26@ 25@ from_actor 31@ with_offset 0.0 0.0 0.0
068D: get_camera_position_to 24@ 23@ 22@
if and
02CB: actor 31@ bounding_sphere_visible
06BD: no_obstacles_between 27@ 26@ 25@ and 24@ 23@ 22@ solid 1 car 0 actor 0 object 1 particle 0
jf @THREAD_NAME___1803
call @THREAD_NAME___1863 3 27@ 26@ 25@ 24@ 23@
0509: 22@ = distance_between_XY 339.0 179.0 and_XY 24@ 23@
if
0035: 28@ >= 22@ // (float)
jf @THREAD_NAME___1803
0087: 28@ = 22@ // (float)
0087: 15@ = 31@ // (float)
:THREAD_NAME___1803
30@ += 256
30@ > 35584
jf @THREAD_NAME___1548
if
056D: actor 15@ defined
jf @THREAD_NAME___1853
return_true
goto @THREAD_NAME___1855
:THREAD_NAME___1853
return_false
:THREAD_NAME___1855
ret 1 15@
:THREAD_NAME___1863
0AC7: 14@ = var 0@ offset
0AC7: 15@ = var 3@ offset
0AC7: 16@ = var 6@ offset
0AC7: 17@ = var 9@ offset
0AA5: call 7392816 num_params 6 pop 6 0 0 17@ 16@ 15@ 14@
12@ = 640.0
13@ = 448.0
0A8D: 14@ = read_memory 12677188 size 4 virtual_protect 0
0A8D: 15@ = read_memory 12677192 size 4 virtual_protect 0
0093: 14@ = integer 14@ to_float
0093: 15@ = integer 15@ to_float
0073: 12@ /= 14@ // (float)
0073: 13@ /= 15@ // (float)
006B: 3@ *= 12@ // (float)
006B: 4@ *= 13@ // (float)
ret 2 3@ 4@
33@ = 1
0665: get_actor 0@ model_to 30@
if
1@ == 1
jf @THREAD_NAME___2109
if or
30@ == 105
30@ == 106
30@ == 107
30@ == 65
jf @THREAD_NAME___2109
33@ = 0
:THREAD_NAME___2109
if
1@ == 2
jf @THREAD_NAME___2174
if or
30@ == 102
30@ == 103
30@ == 104
30@ == 195
jf @THREAD_NAME___2174
33@ = 0
:THREAD_NAME___2174
if
1@ == 3
jf @THREAD_NAME___2239
if or
30@ == 124
30@ == 125
30@ == 126
30@ == 169
jf @THREAD_NAME___2239
33@ = 0
:THREAD_NAME___2239
if
1@ == 4
jf @THREAD_NAME___2304
if or
30@ == 117
30@ == 118
30@ == 120
30@ == 263
jf @THREAD_NAME___2304
33@ = 0
:THREAD_NAME___2304
if
33@ == 1
jf @THREAD_NAME___2331
return_true
goto @THREAD_NAME___2333
:THREAD_NAME___2331
return_false
:THREAD_NAME___2333
ret 0
0@ += 36
0@ *= 112
0@ += 13150904
005A: 0@ += 1@ // (int)
0A8C: write_memory 0@ size 3@ value 2@ virtual_protect 0
ret 0
:THREAD_NAME___2388
0B12: 25@ = 25@ XOR 1
if
25@ == 1
jf @THREAD_NAME___2440
print "Aim: ~g~ON" 1500
goto @THREAD_NAME___2458
:THREAD_NAME___2440
print "Aim: ~r~OFF" 1500
:THREAD_NAME___2458
SAMP.CmdRet
17@ = 0
19@ = 0
0A8D: 29@ = read_memory 12010640 size 4 virtual_protect 0
29@ += 4
0A8D: 29@ = read_memory 29@ size 4 virtual_protect 0
30@ = 0
:THREAD_NAME___2514
0A8D: 31@ = read_memory 29@ size 1 virtual_protect 0
29@ += 1
if and
31@ >= 0
128 > 31@
jf @THREAD_NAME___2813
005A: 31@ += 30@ // (int)
if and
803B: not 31@ == $PLAYER_ACTOR // (int)
056D: actor 31@ defined
jf @THREAD_NAME___2813
20@ = SAMP.GetSAMPPlayerIDByActorHandle(31@)
21@ = SAMP.GetPlayerNickname(20@)
if or
0C29: $4 = stristr string1 21@ string2 "Edvincik_Savas"
0C29: $4 = stristr string1 21@ string2 "Edvin_Moroz"
0C29: $4 = stristr string1 21@ string2 "Edvin_Gopnik"
0C29: $4 = stristr string1 21@ string2 "Zdanka_Tawer"
0C29: $4 = stristr string1 21@ string2 "Audi_Rulit"
jf @THREAD_NAME___2813
18@ = -2846
0665: get_actor 31@ model_to 23@
call 18@ 2 19@ 23@ 19@
0665: get_actor $PLAYER_ACTOR model_to 23@
call 18@ 2 17@ 23@ 17@
if
803B: not 17@ == 19@ // (int)
jf @THREAD_NAME___2813
19@ = 0
:THREAD_NAME___2813
30@ += 256
30@ > 35584
jf @THREAD_NAME___2514
ret 1 19@
if or
1@ == 105
1@ == 106
1@ == 107
1@ == 65
jf @THREAD_NAME___2892
0@ = 1
:THREAD_NAME___2892
if or
1@ == 102
1@ == 103
1@ == 104
1@ == 195
jf @THREAD_NAME___2939
0@ = 2
:THREAD_NAME___2939
if or
1@ == 124
1@ == 125
1@ == 126
1@ == 169
jf @THREAD_NAME___2986
0@ = 3
:THREAD_NAME___2986
if or
1@ == 117
1@ == 118
1@ == 120
1@ == 263
jf @THREAD_NAME___3033
0@ = 4
:THREAD_NAME___3033
ret 1 0@monday
Expert
- Joined
- Jun 23, 2014
- Messages
- 1,126
- Solutions
- 1
- Reaction score
- 158
using HxD and python, using this file:
https://github.com/michalmonday/decryptCleo/blob/master/decryptCleo.py
with this part appended and ran (using python 2.7)
(it wasn't written all by once)
Step by step, I opened the file in sanny builder (or opened only the ending part where decryption occurs) and checked how it decrypts itself, then did the same in python. Repeated this process 3 times and finally was able to open it in sanny builder.
It also used a trick of calling the thread by "$PLAYER_ACTOR", (which renamed all labels to it, making it impossible to compile again), so I changed it using HxD to "THREAD_NAME__"
If you take a look at that "decrypting cleos" thread, and go through few pages, I explained some things in more detail.
When checking how the cleo mod decrypts itself, I usually pay attention to "length", method (usually xor operation) and offsets (usually it reads the encrypted code from offset 7, 13 or 39 and writes it to 0)
Sometimes people use trick of writing "06" byte instead of the original "01", this way when you decompile mod using sanny builder, it thinks that some offset/length is a float (when it's really integer)
So sometimes few "06" bytes have to be changed into "01" in HxD before you'll be able to see the offsets/lengths in sanny builder
https://github.com/michalmonday/decryptCleo/blob/master/decryptCleo.py
with this part appended and ran (using python 2.7)
Python:
f_name = "AIM"
length = 21259
starting_offset = 13
def AIM():
data = GetData()
new_data = ''
for c in data[starting_offset: length+starting_offset]:
new_c = chr(ord(c) ^ (256 - 102))
new_data += new_c
data = new_data[13: 20975+13]
new_data = ''
for c in data:
new_data += chr(255 - ord(c))
data = new_data[13: 20614 + 13]
new_data_2 = ""
offset_xor = 0
for i, c in enumerate(data):
new_data_2 += chr(ord(c) ^ ord(new_data[20627 + offset_xor % 16]))
offset_xor += 1
SaveData(new_data_2, "new_new_new")
AIM()(it wasn't written all by once)
Step by step, I opened the file in sanny builder (or opened only the ending part where decryption occurs) and checked how it decrypts itself, then did the same in python. Repeated this process 3 times and finally was able to open it in sanny builder.
It also used a trick of calling the thread by "$PLAYER_ACTOR", (which renamed all labels to it, making it impossible to compile again), so I changed it using HxD to "THREAD_NAME__"
If you take a look at that "decrypting cleos" thread, and go through few pages, I explained some things in more detail.
When checking how the cleo mod decrypts itself, I usually pay attention to "length", method (usually xor operation) and offsets (usually it reads the encrypted code from offset 7, 13 or 39 and writes it to 0)
Sometimes people use trick of writing "06" byte instead of the original "01", this way when you decompile mod using sanny builder, it thinks that some offset/length is a float (when it's really integer)
So sometimes few "06" bytes have to be changed into "01" in HxD before you'll be able to see the offsets/lengths in sanny builder
- Status