UPK's real bypass from the last update:
DWORD EHSVC = 0 ,ADDIE = 0;
void GoodByeHackshield()
{
while(!(DWORD)GetModuleHandle("Ehsvc.dll"))Sleep(1 00);
ADDIE = (DWORD)GetModuleHandle("Ehsvc.dll");
Memcpy( (ADDIE + 0x19000), "\xC3", 1 );
Memcpy( 0x4D9E35, "\x32\xC0\xC3", 2 );
Memcpy( 0x4D9DD4, "\xB0\x01\xC2\x04\x00", 5 );
Memcpy( 0x780A2F, "\xC2\x04\x00", 3 );
Memcpy( 0x5812B1, "\xC3", 1 );
}
RemoveProtection shit from him:
void RemoveProtection()
{
if(!EHSVC) return;
DWORD tempProtection;
VirtualProtect((void*)(EHSVC+0xF55BC),0x40,tempPro tection,&tempProtection);
*(int*)(EHSVC+0xF55BC) =0;
VirtualProtect((void*)(EHHSVC+0xF55BC),4,tempProte ction,&tempProtection);
}
How to Decrypt Hackshield log:
pSend = (oSend)DetourFunc((PBYTE)0x4A6C42,(PBYTE),6);
pRevc = (oRecv)DetourFunc((PBYTE)0x5AA13C,(PBYTE),6);
typedef int (__stdcall *oRecv)(const char * al, DWORD DataSize, DWORD a3);
oRecv pRecv;
int __stdcall myRecv(const char *Data, DWORD DataSize, DWORD a3)
{
for (int i = 0; i < DataSize; ++i)
{
*(BYTE *)(i + Data) ^= 0x96u;
}
add_log(1,"[--Recv--]-< %s", Data);
return DataSize;
}
typedef int (__stdcall *oSend)(const char * Data, DWORD DataSize, DWORD a3);
oSend pSend;
int __stdcall mySend(const char *Data, Dword DataSize, Dword a3)
{
add_log(1,"[--Send--]-< %s", Data);
for (int i = 0; i < DataSize; ++i)
{
*(BYTE *)(i + Data) ^= 0xC3;
}
return DataSize;
}
I'll post later more from his shit