나쁜남자의 블로그

Skip Epic Booster and Repair Kit animations
*275 x64
140482B6F - jb 140482BC2 --->> jmp 140482BC2

*275 x86
0078401E -- jb 00784073--->> jmp 00784073

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - Change your game Version (0)	2025.12.19
EP 35 Address - Change game Lenguage (0)	2025.12.08
EP 35 Address - XOR Function .ENC (0)	2025.12.03
EP 35 Address - Limit how many cabal instances will be allowed in your server. (0)	2025.12.03
EP 35 Address - XOR Function .ENC (0)	2025.11.21

By changing your game version, you can prevent people from joining your server using a custom client, because they all share the same version (275). Below is the address showing how to change the client version—remember to also update your client version in SQL, in cabal_client_version_table, in the "Ver" column.

v275 - ep 35 (x64)

0x141103EE0//Version Pointer

C++:

int my_custom_ver = 275;
*(int*)0x141103EE0 = my_custom_ver;

— AeroSecurity
Advanced Cabal Infrastructure & Exploit Defense
[Onion AntiCheat • Network Hardening • Session & Rollback Protection • Web Security Stack]

contact:
Discord - aero0028

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

Skip animation (0)	2026.01.12
EP 35 Address - Change game Lenguage (0)	2025.12.08
EP 35 Address - XOR Function .ENC (0)	2025.12.03
EP 35 Address - Limit how many cabal instances will be allowed in your server. (0)	2025.12.03
EP 35 Address - XOR Function .ENC (0)	2025.11.21

Remember you must have the correct language folder inside /Data/Language

v275 - ep 35 (x64)

0x140c9de11 //language pointer

C++:

  /*
  | Código | Idioma | Pasta (Data\Language\) | Pasta (Language\) |
|--------|--------|------------------------|-------------------|
| 1 | Korean | KR\ | Korean\ |
| 2 | English | US\ | English\ |
| 3 | Thai | DE\ | Thai\ |
| 4 | Japanese | JP\ | Japanese\ |
| 5 | German | GE\ | German\ |
| 6 | Portuguese | PT\ | Portuguese\ |
| 7 | Indonesian | ID\ | Indonesian\ |
| 9 | Vietnamese | VN\ | Vietnamese\ |
| 10 | Chinese (CN) | PH\ | Chinese(CN)\ |
| 11 | Chinese (TWN) | RU\ | Chinese(TWN)\ |
| 12 | French | FR\ | French\ |
| 13 | Italian | IT\ | Italian\ |
| 14 | Spanish | ES\ | Spanish\ |
| 15 | Turkish | US\ | Turkish\ |
*/

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

Skip animation (0)	2026.01.12
EP 35 Address - Change your game Version (0)	2025.12.19
EP 35 Address - XOR Function .ENC (0)	2025.12.03
EP 35 Address - Limit how many cabal instances will be allowed in your server. (0)	2025.12.03
EP 35 Address - XOR Function .ENC (0)	2025.11.21

If you're setting up an Episode 35 server, you may want to change the default XOR encryption value used in your files. Below is the related function and address so you can modify it as needed.

v275 - ep 35 (x64)
0x14023C688

Code:

000000014023C688           | 4C:6349 14                              | movsxd r9,dword ptr ds:[rcx+14]                                                | rcx+14:ZwOpenProcess+8
000000014023C68C           | 48:8BD1                                 | mov rdx,rcx                                                                    | rcx:ZwQueryInformationThread+14
000000014023C68F           | 44:3B49 10                              | cmp r9d,dword ptr ds:[rcx+10]                                                  | rcx+10:ZwOpenProcess+4
000000014023C693           | 7F 69                                   | jg cabalmain.14023C6FE                                                         |
000000014023C695           | 4C:8B41 08                              | mov r8,qword ptr ds:[rcx+8]                                                    | rcx+08:ZwQueryInformationThread+1C
000000014023C699           | 41:8BC9                                 | mov ecx,r9d                                                                    |
000000014023C69C           | 45:85C9                                 | test r9d,r9d                                                                   |
000000014023C69F           | 74 4C                                   | je cabalmain.14023C6ED                                                         |
000000014023C6A1           | 83E9 01                                 | sub ecx,1                                                                      |
000000014023C6A4           | 74 37                                   | je cabalmain.14023C6DD                                                         |
000000014023C6A6           | 83E9 01                                 | sub ecx,1                                                                      |
000000014023C6A9           | 74 22                                   | je cabalmain.14023C6CD                                                         |
000000014023C6AB           | 83F9 01                                 | cmp ecx,1                                                                      |
000000014023C6AE           | 74 0D                                   | je cabalmain.14023C6BD                                                         |
000000014023C6B0           | 43:0FB60401                             | movzx eax,byte ptr ds:[r9+r8]                                                  |
000000014023C6B5           | 41:8D49 01                              | lea ecx,qword ptr ds:[r9+1]                                                    |
000000014023C6B9           | 894A 14                                 | mov dword ptr ds:[rdx+14],ecx                                                  |
000000014023C6BC           | C3                                      | ret                                                                            |
000000014023C6BD           | 41:0FB640 03                            | movzx eax,byte ptr ds:[r8+3]                                                   |
000000014023C6C2           | 83F0 57                                 | xor eax,57 <<<<<<<<<<<<<<<<<<<<----------------                                                                      |
000000014023C6C5           | C742 14 04000000                        | mov dword ptr ds:[rdx+14],4                                                    |
000000014023C6CC           | C3                                      | ret                                                                            |
000000014023C6CD           | 41:0FB640 02                            | movzx eax,byte ptr ds:[r8+2]                                                   |
000000014023C6D2           | 83F0 67                                 | xor eax,67 <<<<<<<<<<<<<<<<<<<<----------------                                                                      |
000000014023C6D5           | C742 14 03000000                        | mov dword ptr ds:[rdx+14],3                                                    |
000000014023C6DC           | C3                                      | ret                                                                            |
000000014023C6DD           | 41:0FB640 01                            | movzx eax,byte ptr ds:[r8+1]                                                   |
000000014023C6E2           | 83F0 65                                 | xor eax,65 <<<<<<<<<<<<<<<<<<<<------------------                                                                      |
000000014023C6E5           | C742 14 02000000                        | mov dword ptr ds:[rdx+14],2                                                    |
000000014023C6EC           | C3                                      | ret                                                                            |
000000014023C6ED           | 41:0FB600                               | movzx eax,byte ptr ds:[r8]                                                     |
000000014023C6F1           | 35 92000000                             | xor eax,92 <<<<<<<<<<<<<<<<<<<<--------------                                                                      |
000000014023C6F6           | C742 14 01000000                        | mov dword ptr ds:[rdx+14],1                                                    |
000000014023C6FD           | C3                                      | ret                                                                            |
000000014023C6FE           | 83C8 FF                                 | or eax,FFFFFFFF                                                                |
000000014023C701           | C3                                      | ret                                                                            |

To change your XOR, do this: Change all the BOLD ones to your own XOR.

000000014023C6C2 | 83F0 57 | xor eax,57 <<<<<<<<<<<<<<<<<<<<---------------- |
000000014023C6C5 | C742 14 04000000 | mov dword ptr ds:[rdx+14],4 |
000000014023C6CC | C3 | ret |
000000014023C6CD | 41:0FB640 02 | movzx eax,byte ptr ds:[r8+2] |
000000014023C6D2 | 83F0 67 | xor eax,67 <<<<<<<<<<<<<<<<<<<<---------------- |
000000014023C6D5 | C742 14 03000000 | mov dword ptr ds:[rdx+14],3 |
000000014023C6DC | C3 | ret |
000000014023C6DD | 41:0FB640 01 | movzx eax,byte ptr ds:[r8+1] |
000000014023C6E2 | 83F0 65 | xor eax,65 <<<<<<<<<<<<<<<<<<<<------------------ |
000000014023C6E5 | C742 14 02000000 | mov dword ptr ds:[rdx+14],2 |
000000014023C6EC | C3 | ret |
000000014023C6ED | 41:0FB600 | movzx eax,byte ptr ds:[r8] |
000000014023C6F1 | 35 92000000 | xor eax,92 <<<<<<<<<<<<<<<<<<<<--------------

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - Change your game Version (0)	2025.12.19
EP 35 Address - Change game Lenguage (0)	2025.12.08
EP 35 Address - Limit how many cabal instances will be allowed in your server. (0)	2025.12.03
EP 35 Address - XOR Function .ENC (0)	2025.11.21
ECH Extension CabalMain v263; v275 (0)	2025.10.09

We will use game Semaphore to decide how many cabal we want opened in the same pc, but ~~wtf~~ is it?

semaphore is just a shared counter the client/loader uses to control how many Cabal windows can run at the same time on one PC.

Think of it like tickets: you set a limit (1, 2, 3 clients…), the semaphore starts with that many “tickets”. Every time a new Cabal client starts, it tries to take one ticket. If there’s a ticket available, the client opens normally. If there are no tickets left, the client is blocked and closes. When you close a client, the ticket goes back, so another one can open.

Changing that value is what lets you decide if your server allows only 1 client, 2 clients, 3 clients, etc.

v275 - ep 35 (x64)

0x140205a88 --> MOV EDX ,0x2

by default 2 instances are allowed in the game.

Bonus:
change the semaphore name, by default is husky
(this is not a instruction section so you will not see the string in ASM decompiler, use de HEX view)
0x140a9fb6c ----> husky

— AeroSecurity
Advanced Cabal Infrastructure & Exploit Defense
[Onion AntiCheat • Network Hardening • Session & Rollback Protection • Web Security Stack]

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - Change game Lenguage (0)	2025.12.08
EP 35 Address - XOR Function .ENC (0)	2025.12.03
EP 35 Address - XOR Function .ENC (0)	2025.11.21
ECH Extension CabalMain v263; v275 (0)	2025.10.09
Cabal Client Episode 38 (0)	2025.09.30

If you're setting up an Episode 35 server, you may want to change the default XOR encryption value used in your files. Below is the related function and address so you can modify it as needed.

v275 - ep 35 (x64)
0x14023C688

Code:

000000014023C688           | 4C:6349 14                              | movsxd r9,dword ptr ds:[rcx+14]                                                | rcx+14:ZwOpenProcess+8
000000014023C68C           | 48:8BD1                                 | mov rdx,rcx                                                                    | rcx:ZwQueryInformationThread+14
000000014023C68F           | 44:3B49 10                              | cmp r9d,dword ptr ds:[rcx+10]                                                  | rcx+10:ZwOpenProcess+4
000000014023C693           | 7F 69                                   | jg cabalmain.14023C6FE                                                         |
000000014023C695           | 4C:8B41 08                              | mov r8,qword ptr ds:[rcx+8]                                                    | rcx+08:ZwQueryInformationThread+1C
000000014023C699           | 41:8BC9                                 | mov ecx,r9d                                                                    |
000000014023C69C           | 45:85C9                                 | test r9d,r9d                                                                   |
000000014023C69F           | 74 4C                                   | je cabalmain.14023C6ED                                                         |
000000014023C6A1           | 83E9 01                                 | sub ecx,1                                                                      |
000000014023C6A4           | 74 37                                   | je cabalmain.14023C6DD                                                         |
000000014023C6A6           | 83E9 01                                 | sub ecx,1                                                                      |
000000014023C6A9           | 74 22                                   | je cabalmain.14023C6CD                                                         |
000000014023C6AB           | 83F9 01                                 | cmp ecx,1                                                                      |
000000014023C6AE           | 74 0D                                   | je cabalmain.14023C6BD                                                         |
000000014023C6B0           | 43:0FB60401                             | movzx eax,byte ptr ds:[r9+r8]                                                  |
000000014023C6B5           | 41:8D49 01                              | lea ecx,qword ptr ds:[r9+1]                                                    |
000000014023C6B9           | 894A 14                                 | mov dword ptr ds:[rdx+14],ecx                                                  |
000000014023C6BC           | C3                                      | ret                                                                            |
000000014023C6BD           | 41:0FB640 03                            | movzx eax,byte ptr ds:[r8+3]                                                   |
000000014023C6C2           | 83F0 57                                 | xor eax,57 <<<<<<<<<<<<<<<<<<<<----------------                                                                      |
000000014023C6C5           | C742 14 04000000                        | mov dword ptr ds:[rdx+14],4                                                    |
000000014023C6CC           | C3                                      | ret                                                                            |
000000014023C6CD           | 41:0FB640 02                            | movzx eax,byte ptr ds:[r8+2]                                                   |
000000014023C6D2           | 83F0 67                                 | xor eax,67 <<<<<<<<<<<<<<<<<<<<----------------                                                                      |
000000014023C6D5           | C742 14 03000000                        | mov dword ptr ds:[rdx+14],3                                                    |
000000014023C6DC           | C3                                      | ret                                                                            |
000000014023C6DD           | 41:0FB640 01                            | movzx eax,byte ptr ds:[r8+1]                                                   |
000000014023C6E2           | 83F0 65                                 | xor eax,65 <<<<<<<<<<<<<<<<<<<<------------------                                                                      |
000000014023C6E5           | C742 14 02000000                        | mov dword ptr ds:[rdx+14],2                                                    |
000000014023C6EC           | C3                                      | ret                                                                            |
000000014023C6ED           | 41:0FB600                               | movzx eax,byte ptr ds:[r8]                                                     |
000000014023C6F1           | 35 92000000                             | xor eax,92 <<<<<<<<<<<<<<<<<<<<--------------                                                                      |
000000014023C6F6           | C742 14 01000000                        | mov dword ptr ds:[rdx+14],1                                                    |
000000014023C6FD           | C3                                      | ret                                                                            |
000000014023C6FE           | 83C8 FF                                 | or eax,FFFFFFFF                                                                |
000000014023C701           | C3                                      | ret                                                                            |

Last edited: Saturday at 3:52 AM

— AeroSecurity
Advanced Cabal Infrastructure & Exploit Defense
[Onion AntiCheat • Network Hardening • Session & Rollback Protection • Web Security Stack]

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - XOR Function .ENC (0)	2025.12.03
EP 35 Address - Limit how many cabal instances will be allowed in your server. (0)	2025.12.03
ECH Extension CabalMain v263; v275 (0)	2025.10.09
Cabal Client Episode 38 (0)	2025.09.30
Tutorial: 30000 alz drop limit finally broken (0)	2025.09.12

v263:
Extend ECH Limit
#define max_ECH_extend 0x14 //load up to 20.ech
SetMemory<BYTE>(0x0076923A, { 0x83, 0xFE, max_ECH_extend });
SetMemory<BYTE>(0x007693E4, { 0x83, 0xFE, max_ECH_extend });

v275:
14038f2f9 83fe12 cmp esi, 0x12
14038efec 83fb12 cmp ebx, 0x12

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - Limit how many cabal instances will be allowed in your server. (0)	2025.12.03
EP 35 Address - XOR Function .ENC (0)	2025.11.21
Cabal Client Episode 38 (0)	2025.09.30
Tutorial: 30000 alz drop limit finally broken (0)	2025.09.12
multi game (0)	2024.04.14

005B8BD5 /$ C741 01 010000>MOV DWORD PTR DS:[ECX+1],1 /luangage
005FB5AE . C783 7C020000 >MOV DWORD PTR DS:[EBX+27C],CabalMai.00C4>; ASCII "CABAL" /Windows title
006249CD . 90 NOP enc check
Client 13209 Address

저작자표시 비영리 동일조건 (새창열림)

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - XOR Function .ENC (0)	2025.11.21
ECH Extension CabalMain v263; v275 (0)	2025.10.09
Tutorial: 30000 alz drop limit finally broken (0)	2025.09.12
multi game (0)	2024.04.14
php 에 pcntl posix 설치 (0)	2024.03.26

나쁜남자의 블로그

전체 글

Skip animation

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - Change your game Version

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - Change game Lenguage

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - XOR Function .ENC

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - Limit how many cabal instances will be allowed in your server.

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

EP 35 Address - XOR Function .ENC

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

ECH Extension CabalMain v263; v275

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

Cabal Client Episode 38

'게임에 대한 이래저래 > 카발온라인' 카테고리의 다른 글

+ Recent posts

티스토리툴바