The unpacked files are a good reference for people wanting to understand how GameGuard works + eventually making a bypass.
All of the files are unpacked and the executable code is fully readable with all of the APIs resolved. There is just one thing stripped. GameGuard main module, GameMon.exe, uses Themida VMs. Unfortunately unable to resolve Themida VMs so they are stripped, and as a result - the virtualized memory is not available.
List of unpacked files:
- GameGuard.exe (nProtect GameGuard Launcher)
- GameMon.exe (nProtect Game Monitor)
- ggerror.exe (nProtect GameGuard Error Report)
- ggscan.dll (nProtect Scan Module)
- npgg9x.dll (nProtect GameGuard Module)
- npggNT.dll (nProtect GameGuard Module)
- npsc.dll (nProtect SpeedCheck Module)
- npscan.dll (nProtect GameGuard Scan Engine)
Reversed by: HellSpider
Russian
Здесь представлены распакованные файлы GameGuard, что будет полезно для понимания принципов работы данной защиты, а также для написания байпоссов
VirusTotal result: clean
Please register or login to download attachments.