Chinese Server Inject Dll Error Log

[Clownsw]

BugTrace.log
MiniDumpType:0; Time:2021-10-31 14:31:34; Thread ID:0x00002BBC; ExceptionAddress:0x9E6BA; ExceptionCode:0xC0000005; RetAddr:ModName:Args to Child; [0x9e6ba]:[0x1B200000]:[R3nzSkin.dll]:[0xF6A0D394,0x208,0x3FC9DD60,0x3FC9DE38]; [0x9E3DE]:[0x00000000]:[unknown module]:[0x0,0x1A0B1420,0xF6A0D2C0,0x769109C0]; [0xA2A09]:[0x00000000]:[unknown module]:[0x0,0x1B36FF68,0x1B36FF68,0x1F4]; [0x1F989]:[0x768F0000]:[KERNEL32.DLL]:[0x1B200000,0x7690F970,0x1B36FFDC,0x779674A4]; [0x674A4]:[0x77900000]:[ntdll.dll]:[0x1B200000,0x56C8E731,0x0,0x0]; [0x67474]:[0x77900000]:[ntdll.dll]:[0xFFFFFFFF,0x77987362,0x0,0x0]; [0x0]:[0x00400000]:[League of Legends.exe]:[0x1B2A2990,0x1B200000,0x0,0x0];

[Clownsw]

MiniDumpType:0;
Time:2021-10-31 14:31:34;
Thread ID:0x00002BBC;
ExceptionAddress:0x9E6BA;
ExceptionCode:0xC0000005;
RetAddr:ModName:Args to Child;
[0x9e6ba]:[0x1B200000]:[R3nzSkin.dll]:[0xF6A0D394,0x208,0x3FC9DD60,0x3FC9DE38];
[0x9E3DE]:[0x00000000]:[unknown module]:[0x0,0x1A0B1420,0xF6A0D2C0,0x769109C0];
[0xA2A09]:[0x00000000]:[unknown module]:[0x0,0x1B36FF68,0x1B36FF68,0x1F4];
[0x1F989]:[0x768F0000]:[KERNEL32.DLL]:[0x1B200000,0x7690F970,0x1B36FFDC,0x779674A4];
[0x674A4]:[0x77900000]:[ntdll.dll]:[0x1B200000,0x56C8E731,0x0,0x0];
[0x67474]:[0x77900000]:[ntdll.dll]:[0xFFFFFFFF,0x77987362,0x0,0x0];
[0x0]:[0x00400000]:[League of Legends.exe]:[0x1B2A2990,0x1B200000,0x0,0x0];

[R3nzTheCodeGOD]

Now let's study the problem

• When I first look at the error code, I see the code 0xC0000005. This code tells us that the DLL has committed a memory access violation.
• DLL returned error in field [0xF6A0D394.0x208.0x3FC9DD60.0x3FC9DE38].
• Let's Disassemble the 0x208 hex code with x86.
• I now have the add cl,BYTE PTR [eax] assembly code. This code is most likely in the findPattern function.

Possible Solutions

• Static analysis with IDA.
  • Dump Legue_of_Legends.exe, here is the tutorial.
  • Manually test the patterns I use in my cheat with the Plugin.
  • Either find a new pattern or remove it if it is not an important feature for you.

These are the ones I can extract from this log file for now, if I think of a better solution, I'll update the message.