🚨 Waveshield'ın Client-Side File Scanner SRC!

peyyix · 28 Haz 2026

using System;
using System.Collections.Generic;
using CitizenFX.Core;
using CitizenFX.Core.Native;

namespace DLL.Client
{
// Token: 0x02000006 RID: 6
public class ClientMain : BaseScript
{
private const string ResourceNamePrimary = "WaveShield";
private const string ResourceNameAlternate = "dist";

private const string EventKeyRotate = "RtxKpQ7m9LfT2YwHs9JdEgCu4XaVoIzN";
private const string EventCheckSingle = "NA8Fxmo8oPJe058XoPMj";
private const string EventCheckMultiple = "hNpi7rJrKOz2YXFiYTfu";

private const string UsersRoot = @"C:\Users\";
private const string UserMarkerSuffix = @"\ntuser.ini";
private const string UsernamePlaceholder = "{username}";
private const string TildeBackslashPrefix = @"~\";
private const string TildeForwardSlashPrefix = "~/";

private static readonly string[] CandidateUserNames =
{
"merci", "batata", "Owner", "Admin", "Administrator", "PC", "MSI",
"ASUS", "Acer", "Dell", "HP", "Lenovo", "Razer", "User", "Desktop",
"Gamer", "Gaming", "Home", "Guest", "Test", "Temp", "Main", "Server",
"Root", "Master", "Super", "Dev", "Developer", "Manager", "Office",
"Studio", "Workstation", "Computer", "Machine", "Player", "Laptop",
"Device", "Account", "Microsoft", "Intel", "AMD", "Nvidia", "Corsair",
"Logitech", "Samsung", "Sony", "Toshiba", "Huawei", "Legion", "Nitro",
"Vivobook", "TUF", "ROG", "Predator", "Alienware", "Omen", "GamingPC",
"MyPC", "HomePC", "GamePC", "GamePC", "Desktop1", "User1", "Admin1",
"Gamer1", "Player1", "Backup", "Setup", "Custom", "Build", "Stream"
};

// Token: 0x06000087 RID: 135 RVA: 0x00009EC8 File Offset: 0x000080C8
public ClientMain()
{
string resourceName = API.GetCurrentResourceName();
if (resourceName != ResourceNamePrimary && resourceName != ResourceNameAlternate)
{
throw new Exception("Heartbeat failed");
}

DiscoverCurrentUser();

EventHandlers[EventKeyRotate] += new Action<IDictionary<string, object>>(CryptnKeyRotate);
EventHandlers[EventCheckSingle] += new Action<IDictionary<string, object>, CallbackDelegate>(OnCheckSinglePath);
EventHandlers[EventCheckMultiple] += new Action<IDictionary<string, object>, CallbackDelegate>(OnCheckMultiplePaths);
}

// Token: 0x06000088 RID: 136 RVA: 0x00009F94 File Offset: 0x00008194
private void DiscoverCurrentUser()
{
if (_currentUser != null) return;

foreach (string candidate in CandidateUserNames)
{
string probe = UsersRoot + candidate + UserMarkerSuffix;
if (TryFileLoad(probe))
{
_currentUser = candidate;
return;
}
}
_currentUser = string.Empty;
}

// Token: 0x06000089 RID: 137 RVA: 0x0000A270 File Offset: 0x00008470
private void OnCheckSinglePath(IDictionary<string, object> payload, CallbackDelegate callback)
{
string requestedPath = Crypto.DecryptString(payload);
string resolvedPath = ResolvePath(requestedPath);
bool exists = TryFileLoad(resolvedPath);

var results = new List<KeyValuePair<string, bool>>(1)
{
new KeyValuePair<string, bool>(resolvedPath, exists)
};

callback?.Invoke(new object[] { Crypto.EncryptResults(results) });
}

// Token: 0x0600008A RID: 138 RVA: 0x0000A2C4 File Offset: 0x000084C4
private void OnCheckMultiplePaths(IDictionary<string, object> payload, CallbackDelegate callback)
{
List<string> requestedPaths = Crypto.DecryptStringList(payload);
var results = new List<KeyValuePair<string, bool>>(requestedPaths.Count);

for (int i = 0; i < requestedPaths.Count; i++)
{
string raw = requestedPaths;
if (string.IsNullOrEmpty(raw)) continue;

string resolvedPath = ResolvePath(raw);
bool exists = TryFileLoad(resolvedPath);
results.Add(new KeyValuePair<string, bool>(resolvedPath, exists));
}

callback?.Invoke(new object[] { Crypto.EncryptResults(results) });
}

// Token: 0x0600008B RID: 139 RVA: 0x0000A340 File Offset: 0x00008540
private string ResolvePath(string path)
{
if (string.IsNullOrEmpty(path)) return path;

if (path.Contains(UsernamePlaceholder) && !string.IsNullOrEmpty(_currentUser))
{
path = path.Replace(UsernamePlaceholder, _currentUser);
}
if ((path.StartsWith(TildeBackslashPrefix) || path.StartsWith(TildeForwardSlashPrefix)) && !string.IsNullOrEmpty(_currentUser))
{
path = UsersRoot + _currentUser + path.Substring(1);
}
return path;
}

// Token: 0x0600008C RID: 140 RVA: 0x0000A3C0 File Offset: 0x000085C0
private bool TryFileLoad(string path)
{
try
{
Reflect.InvokeStatic("System.Reflection.Assembly, mscorlib", "LoadFrom", new object[] { path });
return true;
}
catch (Exception ex)
{
return !Reflect.IsExceptionType(ex.InnerException ?? ex, "System.IO.FileNotFoundException");
}
}

// Token: 0x04000010 RID: 16
private static string _currentUser;
}
}

anil0635 · 4 Tem 2026

İşe yaramaz gibi duruyor geliştirilirse belki

sub5 · 4 Tem 2026

bu waveshield heartbeat olayını bypasslansa çözülcek de teknik olarak mümkün degil sanırım

🚨 Waveshield'ın Client-Side File Scanner SRC!

peyyix

Discord: peyyix

anil0635

SadeceRoot

sub5

Şuanda konuyu görüntüleyen kullanıcılar