Hack Forums
[help] HOI4 Cheat reversing - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+----- Forum: Reverse Engineering (https://hackforums.net/forumdisplay.php?fid=229)
+----- Thread: [help] HOI4 Cheat reversing (/showthread.php?tid=6222027)



[help] HOI4 Cheat reversing - Pluralistic ignorance - Sep 23, 2022

Hello all,

Due to an influx of hackers/script kiddies in the Hearts of Iron IV (hoi4) community I started investigating...

Website called jewishtricks.me sells the cheats $10 a pop. Pretty cheap, so I got my hands on the executable provided when you purchase the cheat.

After doing a little digging I found that the file was packed with themida - so I submitted the .exe to an unpacking website called unpac.me. The file linked below is the .bin output of the original .exe.

https://drive[WARNING POSSIBLY INFECTED]google.com/file/d/1gTzaizSHeCY0x_laMhRU7Gn07usPft46/view?usp=sharing

https://www.virustotal.com/gui/file/ac18d73c7ed967cec773fae76f7a2eb9e85a5e6d7c8182d93daff69fd248b879/detection

Is there anyone on this forum that can assist with decrypting/reversing this .bin? 😎

Here's a snippit of the strings provided on unpac.me
Spoiler (Click to View)

From what I gathered the cheat works by contacting an RPC server located on the jewishtricks.me domain. Then it executes the instructions in game to activate the cheat.

That's about all I got so far.


RE: [help] HOI4 Cheat reversing - dizzymizzy - Feb 25, 2024

did the cheat work tho


RE: [help] HOI4 Cheat reversing - K947AGENT - Jun 18, 2024

the link isnt working tho if u can send me the account to download it and i can investegiate it