[Release] XTrap Bypass

Quote:

Originally Posted by Slicktor

Yo, today i want to release my xcrap bypass.
a >>[Only registered and activated users can see links. Click Here To Register...]<< can be found here

[Screen]

Spoiler

[Only registered and activated users can see links. Click Here To Register...]

[How to?]

-Download and unpack the zip-archive
-Start "Injector.exe" as administrator
-Start S4League

[Main-Functions]

-process detection
-64 bit driver bypass

[Download & VT]

You can download it by clicking the attachment.
VT - Bypass.dll: [Only registered and activated users can see links. Click Here To Register...]
VT - Injector: [Only registered and activated users can see links. Click Here To Register...]

src:

Spoiler

main.cpp

PHP Code:

#include <Windows.h> #include "Bypass.h" DWORD WINAPI InitializeXTrapBypass() { DWORD nBase; while(1) { nBase = (DWORD)GetModuleHandleA("XTrapVa.dll"); if(nBase){ Sleep(500); BYPASS bypass; bypass.Driver64(); bypass.ProcessDetection(); break; } } return 0; } BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved ) { DisableThreadLibraryCalls(hDll); if( dwReason == DLL_PROCESS_ATTACH) { _beginthread((void(*)(void*))InitializeXTrapBypass,sizeof(&InitializeXTrapBypass),0); } return TRUE; }

Bypass.h

PHP Code:

#include <Windows.h> #include <tlhelp32.h> #include <process.h> #include <wchar.h> class BYPASS { public: int BYPASS::ProcessDetection(); int BYPASS::Driver64(); }; int BYPASS::ProcessDetection() { DWORD K32EnumAddr = (DWORD)GetProcAddress(LoadLibraryA("Kernel32.dll"),"K32EnumProcesses"); DWORD EnumAddr = (DWORD)GetProcAddress(LoadLibraryA("Psapi.dll"),"EnumProcesses"); DWORD old; VirtualProtect((LPVOID)K32EnumAddr,sizeof(K32EnumAddr),PAGE_EXECUTE_READWRITE,&old); VirtualProtect((LPVOID)EnumAddr,sizeof(EnumAddr),PAGE_EXECUTE_READWRITE,&old); memcpy((LPVOID)K32EnumAddr,(LPVOID)"\xC2\x0C\x00",3); memcpy((LPVOID)EnumAddr,(LPVOID)"\xC2\x0C\x00",3); return 0; } int BYPASS::Driver64() { wmemcpy((wchar_t*)0x40557EEC,(const wchar_t*)"X6va01",6); return 0; }

works only on 64 bit!
don't work on win8!

Have fun ;)

Help?!