geleecht aus UC..forum für hs bypass
Credits : xUrban, Gordon' for FindPattern
Code:
BOOL bCompare (const BYTE* pData, const BYTE* bMask, const char* szMask)
{
for(;*szMask;++szMask,++pData,++bMask)
{
if(*szMask == 'x' && *pData != *bMask)
return 0;
}
return (*szMask) == NULL;
}
DWORD FindPattern(BYTE *bMask, char * szMask, int codeOffset, BOOL extract)
{
for(DWORD i = 0; i < dwSize; i++)
{
if(bCompare((BYTE*)(dwStartAddress + i),bMask,szMask))
{
if(extract)
{
return *(DWORD*)(dwStartAddress + i + codeOffset);
}
else
{
return (DWORD)(dwStartAddress + i + codeOffset);
}
}
}
return NULL;
}
Code:
void HackShield ()
{
Sleep (1000);
dwStartAddress = 0;
do{
dwStartAddress = (DWORD)GetModuleHandleA("EhSvc.dll"));
Sleep(10L);
}while
(!dwStartAddress);
dwSize = 0x50000 // This is dont need update this is standard module of hackshield
DWORD HS1 = FindPattern((PBYTE)"\x89\x4D\xFC\xE9\x00\x00\x00\x00\x07","xxxx????x",3, false);
DWORD HS2 = FindPattern((PBYTE)"\xE8\x00\x00\x00\x00\x83\xF8\x01\x0F\x84\x00\x00\x00\x00\xC6\x85\x00\x00\x00\x00\x00","x????xxxxx????xx?????",0,false);
DWORD HS3 = FindPattern((PBYTE)"\x75\x00\x8B\x74\x24\x00\x53\xB9\x00\x00\x00\x00","x?xxx?xx????",0, false);
// if you dont want using sigs just make log and take addy
Memcpy((LPBYTE)HS1,(PBYTE)"\x90\x90\x90\x90\x90",5);
Memcpy((LPBYTE)HS2,(PBYTE)"\xB8\x01\x00\x00\x00",5);
Memcpy((LPBYTE)HS3,(PBYTE)"\x90\x90",2);
}