Wind Client Addons

[Gatorade]

I have a doubt

As i have readed, all i need to run the windaddons is the server ip address / user / pw. So even if i am using windows 7 (in my case) i can buy this VPS (listed below) knowing that the Operating System required for this server is Linux? and btw, i am running windows on a virtual machine since my laptop is a macpro, should it work anyway or...? and last, this server iam willing to buy is enough to play 1 tibia? since all i want is to reduce the latency a little bit (they are located in atlanta)
BudgetVZ - BVZ1024
1 vCPU Core
1024MB RAM
1024MB vSwap
25GB HDD
1.5TB @ 1Gbit
Dedicated IPv4 Address
IPv6 Subnet
OpenVZ

thanks

[rogikush]

sup, my name is Igor, and i'm having a problem with this 2.7 Wind, because i need to install fireframer 3.5, but i can't, because it give an error.

what i'm suposed to do ?

[dididumal]

have a tutorial in portuguese?? very hard for me in english :/

[Karzatin]

Hey guys, it's been a while since the last time I played and botted. How were I supposed to start the clients with addons to be able to play on a safe non-manipulated client?

If I first open up 2 clients using the windaddons that have the fps control toggled on, and then open up 1 client normally after than(got another mc), will the last opened client also have its memory fixed to limit the fps or will it be a clean normal client I can safely use on my main account?

Or should I first open 1 client manually to use on my main, then open up clients with the windaddons with fps control on. Would this have no affect on the first client I opened in any way and It should be safe to use?

[kimse]

Does it inject any DLLs to the client?
It does not inject any DLLs to your client, the modifications are made by writing to the program's memory.

If Wind Addon doesn't inject into the memory, can you explain:
http://forums.xenobot.net/showthread.php?38875

?? :S

[HjugO]

@Lucas Terra Why did you lie?

[Stusse]

It has always been claimed "we dont inject, only simulate mouse/key strokes" so I'm also interested in a comment of what was said in this post on XenoBot forums.

For those that can't access it I quote DarkstaR's (creator of XenoBot) post below, edited out last content for obvious reasons.

Wind Addons Uses Code Injection

While analyzing Wind Addons, @jo3bingham found that Wind Addons was injecting code into the Tibia Client. Naturally I wanted to verify this claim, so I went and reverse engineered Wind Addons myself. What I found was astonishing. Using API monitor, I confirmed that Wind Addons was injecting a TON of memory into the Tibia Client. As you can see in the following screenshot, it injects 1507328 bytes of memory at address 0x00ae0000 using NtWriteVirtualMemory():

That's a large, suspicious amount of memory. Even if we ignore the TWO other calls to NtWriteVirtualMemory() (which seem to modify Tibia's code directly), this has already proven our case. To investigate if this is really code - and lets face it, at this size, it must be - I dumped it out of memory using a Cheat Engine script:

Then, I took the result file and dropped it in Sublime Text's hex viewer (this is just a small chunk of the code):

This proves that it is code that was injected. Why? Well, for those you you unfamiliar with assembly code, here's a few facts:

• Recurring groups of 1-4 consecutive 0x00 bytes are common in x86 assembly
• Recurring groups of 1-3 consecutive 0xFF bytes are common in x86 assembly
• The byte 0xCC is used to pad functions to periods of 16 bytes

The first two points are very easy to verify by eye. These points are especially strong when you consider that 0x00 and 0xFF bytes won't be abundantly present in other types of data, such as text or images (and why would Wind Addons inject text or images, anyways?). As for the last point, we can also verify that easily. If you look at the hex viewer, you will see that there are 16 bytes per line (8 groups of 2 bytes). Additionally, you'll notice that every single group of 0xCC bytes ends at the end of a line, meaning the bytes are padding the lines, which are 16 bytes long. Therefore, the 0xCC bytes are indeed used to pad functions in this code to periods of 16 bytes.

Conclusion: without a doubt, Wind Addons is injecting a LARGE amount of code into Tibia.

Is This The Same As DLL Injection?

Essentially, yes. The term DLL Injection refers to a type of code injection that uses the standard Windows API to load code in the form of a dynamic library into a remote process. In this case, Wind Addons is loading the code manually, and in some format that does not resemble a dynamic library. The fact remains, however, that both DLL Injection and this type of Code Injection both have the same result: they place new code inside of Tibia and then execute that new code inside of Tibia's process' context.

Saying these aren't the same thing is like putting a bullet in somebody's brain using a large hammer instead of a gun and then saying "I didn't shoot them."

I Thought Windbot didn't use injection?!?!

Me too. I guess they lied to everybody, didn't they?

Injection and You

What does this mean? Well, nothing really. As I've said time and time again, injection is safe. I'm not condemning Windbot for injecting code, I'm condemning the fact that they lied to everyone about injection being unsafe, just to sell their "injection free" software. If you had any doubts that injection is safe, you can lay them to rest now. Even the people telling you that it's unsafe don't believe that.

[iMike]

[ozzix]

It has always been claimed "we dont inject, only simulate mouse/key strokes" so I'm also interested in a comment of what was said in this post on XenoBot forums.

For those that can't access it I quote DarkstaR's (creator of XenoBot) post below, edited out last content for obvious reasons.

https://forums.tibiawindbot.com/show...ll=1#post32460

windaddons changes things in the memory, feel free to post your definition of "injection" and compare it to your definition on "change" (codewise)
windbot doesnt inject nor change anything

[BenAtWindBot]

https://forums.tibiawindbot.com/show...ll=1#post32460

windaddons changes things in the memory, feel free to post your definition of "injection" and compare it to your definition on "change" (codewise)
windbot doesnt inject nor change anything

Did you even read the "Is This The Same As DLL Injection?" part of the quoted post you replied to?