Osiris: Fake Prime Lobby

[Chopard]

add?

https://www.unknowncheats.me/forum/counterstrike-global-offensive/365447-fake-lobby-prime.html

[ZerGo0]

add?

https://www.unknowncheats.me/forum/counterstrike-global-offensive/365447-fake-lobby-prime.html

Pretty cool concept, I would've added it just for the meme, but I don't know how to convert the pattern to the Osiris pattern. I thought it is just ASCII to Hex, but that didn't seem to work or the signature is old, idk. I already said it before, my reverse engineering skills are little to none so yea, I can't do it myself.

Converted pattern (doesn't work): \x41\x31????\x38\x35\x20\x43\x30\x20\x37\x35\x20\x30\x37\x20\x38\x33\x20\x46\x38\x20\x30\x35\x20\x30\x46\x20\x39\x34\x20\x43\x30\x20\x43\x33

If anyone can convert the pattern, then feel free to do so and send it here or make your own pull request.

[xAkiraMiura]

wouldnt you just convert the code style sig to an ida style sig by removing \x and adding a space? ie \x41\x31????\x38 -> 41 31 ?? ?? 38. i forget if ???? is 2 wildcards or 4. btw the numbers are x86 instructions, if my reference is correct, \x31 is a XOR instruction.

[ZerGo0]

wouldnt you just convert the code style sig to an ida style sig by removing \x and adding a space? ie \x41\x31????\x38 -> 41 31 ?? ?? 38. i forget if ???? is 2 wildcards or 4. btw the numbers are x86 instructions, if my reference is correct, \x31 is a XOR instruction.

No idea to be honest, like I said I don't have any reverse engineering skills. I just used a online convert.

The signature has to look like that: https://github.com/danielkrupinski/Osiris/blob/master/Osiris/Memory.cpp

[xAkiraMiura]

ah ida -> code, my mistake.
\xA1????\x85\xC0\x75\x07\x83\xF8\x05\x0F\x94\xC0\xC3" should be correct
for both ida and code style sigs the thing that is like 05 is an assembly instruction. both ida and code use the hex rather than an ascii representation.

[ZerGo0]

ah ida -> code, my mistake.
\xA1????\x85\xC0\x75\x07\x83\xF8\x05\x0F\x94\xC0\xC3" should be correct
for both ida and code style sigs the thing that is like 05 is an assembly instruction. both ida and code use the hex rather than an ascii representation.

Thanks, gonna check it out in a bit, I hope that it is really that easy. :D

[xAkiraMiura]

only issue might be that instead of ???? it would be ???????? but im too tired to pull up a disassembler and find out.
(i dont know if the pattern scan interprets ? as a wildcard or ??)

[ZerGo0]

only issue might be that instead of ???? it would be ???????? but im too tired to pull up a disassembler and find out.
(i dont know if the pattern scan interprets ? as a wildcard or ??)

Thanks, got it to work with "your" signature. #865
@Chopard

[0xE232FE]

When I enable Fake Prime I don't get invites of other players anymore. But I can invite prime players myself. :-) And they really see me prime. XD this is so fucking stupid. But it looks that there are more faking the Prime Status now. XD