The addresses are no longer valid, they should of course update. Code is used as an example.
Code:
void HsBypass( void* pxAddress, BYTE *code, int size )//define virtual protect
{
unsigned long Protection;
VirtualProtect((void*)pxAddress, size, PAGE_READWRITE, &Protection);
memcpy((void*)pxAddress, (const void*)code, size);
VirtualProtect((void*)pxAddress, size, Protection, 0);
}
void CopyModules()
{
/*0x5E38F \xB8\x01\x00\x00\x00\xC3
0x2823F \x31
0x27FFB \xEB
0x28145 \xEB
0x2823F \x31
0x2A1A1 \x31
0x29588 \xEB
0x29697 \xEB
0x29AE0 \xEB
0x6C7F8 \xEB
0x6C822 \xEB
0x30228 \x90\x90
0x2A1A1 \x31*/
BYTE HSAddy[6] = {0xB8, 0x01, 0x00, 0x00, 0x00, 0xC3};
BYTE HSAddy2[1] = {0x31};
BYTE HSAddy3[1] = {0xEB};
BYTE HSAddy4[2] = {0x90, 0x90};
HsBypass((void*)0x5E38F,HSAddy,6);
HsBypass((void*)0x2823F,HSAddy2,1);
HsBypass((void*)0x27FFB,HSAddy3,1);
HsBypass((void*)0x28145,HSAddy3,1);
HsBypass((void*)0x2823F,HSAddy2,1);
HsBypass((void*)0x2A1A1,HSAddy2,1);
HsBypass((void*)0x29588,HSAddy3,1);
HsBypass((void*)0x29697,HSAddy3,1);
HsBypass((void*)0x29AE0,HSAddy3,1);
HsBypass((void*)0x6C7F8,HSAddy3,1);
HsBypass((void*)0x6C822,HSAddy3,1);
HsBypass((void*)0x30228,HSAddy4,1);
HsBypass((void*)0x2A1A1,HSAddy2,1);
How to use it?
HsBypass () is part of bytes at specified addresses Ehsvc.dll module (so you can download a base and add offsets, remember that these listed here are out of date!) And CopyModules () should be run as a thread to constantly overwrite these values, the block HackShield
Enjoy and have fun






