King7 benutzt momentan keinen Bypass, er benutzt Hardware Breakpoints.
WR-VIP HackShield Bypass -
Credits:
King7,
VirtualProtect.
WwW.WR-ViP.CoM
HackShield Latest Version Released By AHNLab Destroyed.
__declspec(naked) void __cdecl PatchHS1(int v1, long v2, char* v3)
{
//restoring original code
__asm
{
push ebp;
mov ebp, esp;
sub esp, 140;
push edi;
mov edi, v1;
push ebx;
mov ebx, v2;
push esi;
mov v3, esi;
pushad;
mov eax, dword ptr ds:[esp*4];
cmp eax, 0x1000055 //10705
je detect1;
cmp eax, 0x1000181 //10501
je detect2;
pop edi;
pop ebx;
pop esi;
popad;
jmp [oLocation1];
}
detect1:
pop edi;
pop ebx;
pop esi;
popad;
jmp [oLocation1];
detect2:
pop edi;
pop ebx;
pop esi;
popad;
jmp [oLocation1];
}
}
char* String1 = "AHNHS_CRC32MD5_EXECUTABLE_";
char* String2 = "AHNHS_CRC32MD5_EHSVCMODULE_";
char* String3 = "AHNHS_VMT_BACKUP_TABLE_";
__declspec(naked) void __cdecl PatchHS2(int v1, long v2, int v4, char* v5/*Request*/, int v6)
{
//restoring original code
__asm
{
push ebp;
mov ebp, esp;
sub esp, 360;
pushad;
push esi;
mov v1, esi;
push eax;
mov v2, eax;
push edi;
mov v4, edi;
push ebx;
mov v5, ebx;
mov[v6], 0; //always 0 or detection;
cmp v5, String1;
je Jumpback;
cmp v5, String2;
je Jumpack;
cmp v5, String3;
je Jumpback;
popad
pop eax;
pop edi;
pop ebp;
jmp [oLocation2];
}
Jumpback:
__asm
{
popad
pop eax;
pop edi;
pop ebp;
jmp [oLocation2];
}
}
bool bPatchNotWrited = true;
void HSBypass_RunPatch()
{
for(;;)
{
DWORD hEhSvc = (long)GetModuleHandleA("EHSvc.dll");
if(hEhSvc !=0)
{
if(bPatchNotWrited)
{
DetourFunction((PBYTE)(hEhSvc + 0x1A520), (PBYTE)PatchHS1);
DetourFunction((PBYTE)(hEhSvc + 0x1A980), (PBYTE)PatchHS2);
bPatchNotWrited = false;
}
}
Sleep(1000);
}
}
...
CreateThread(0, 0, (LPTHREAD_START_ROUTINE)HSBypass_RunPatch, 0, 0, 0);
Enjoy, guyz.
mov eax, dword ptr ds:[esp+4];Quote:
[Only registered and activated users can see links. Click Here To Register...]
KING7 >> Hey !
KING7 >> Its my nice bypass !
KING7 >> I am a Pro in Asm!!!
KING7 >> ESP*4
KING7 >> Yeah!
Code:WR-VIP HackShield Bypass - Credits: King7, VirtualProtect. WwW.WR-ViP.CoM HackShield Latest Version Released By AHNLab Destroyed. __declspec(naked) void __cdecl PatchHS1(int v1, long v2, char* v3) { //restoring original code __asm { push ebp; mov ebp, esp; sub esp, 140; push edi; mov edi, v1; push ebx; mov ebx, v2; push esi; mov v3, esi; pushad; mov eax, dword ptr ds:[COLOR="Red"][esp*4];[/COLOR] cmp eax, 0x1000055 //10705 je detect1; cmp eax, 0x1000181 //10501 je detect2; pop edi; pop ebx; pop esi; popad; jmp [oLocation1]; } detect1: pop edi; pop ebx; pop esi; popad; jmp [oLocation1]; detect2: pop edi; pop ebx; pop esi; popad; jmp [oLocation1]; } } char* String1 = "AHNHS_CRC32MD5_EXECUTABLE_"; char* String2 = "AHNHS_CRC32MD5_EHSVCMODULE_"; char* String3 = "AHNHS_VMT_BACKUP_TABLE_"; __declspec(naked) void __cdecl PatchHS2(int v1, long v2, int v4, char* v5/*Request*/, int v6) { //restoring original code __asm { push ebp; mov ebp, esp; sub esp, 360; pushad; push esi; mov v1, esi; push eax; mov v2, eax; push edi; mov v4, edi; push ebx; mov v5, ebx; mov[v6], 0; //always 0 or detection; cmp v5, String1; je Jumpback; cmp v5, String2; je Jumpack; cmp v5, String3; je Jumpback; popad pop eax; pop edi; pop ebp; jmp [oLocation2]; } Jumpback: __asm { popad pop eax; pop edi; pop ebp; jmp [oLocation2]; } } bool bPatchNotWrited = true; void HSBypass_RunPatch() { for(;;) { DWORD hEhSvc = (long)GetModuleHandleA("EHSvc.dll"); if(hEhSvc !=0) { if(bPatchNotWrited) { DetourFunction((PBYTE)(hEhSvc + 0x1A520), (PBYTE)PatchHS1); DetourFunction((PBYTE)(hEhSvc + 0x1A980), (PBYTE)PatchHS2); bPatchNotWrited = false; } } Sleep(1000); } } ... CreateThread(0, 0, (LPTHREAD_START_ROUTINE)HSBypass_RunPatch, 0, 0, 0); Enjoy, guyz.
Nein der ASM Pro King7 sagt es mit ESP*4 ;)Quote:
mov eax, dword ptr ds:[esp+4];
lol wenn dann schon richtig xD
€: Man hat der Hängetitten.
Quote:
Hello!
We decide to remove some protection from execute file becouse it begin to be very slow. But, Ahnlab C is ready to do his AntiCheat most powerful.
Regards, Staff.
if(STW)
{
if(GetAsyncKeyState(VK_LBUTTON))
{
const BYTE STW_on[3] = { 0x90,0x90,0x90 };
{
DWORD dwProtect;
VirtualProtect((void*)(ADR_ASM_STW), 3, PAGE_EXECUTE_READWRITE, &dwProtect);
memcpy((void*)(ADR_ASM_STW), &STW_on, 3);
VirtualProtect((void*)(ADR_ASM_STW), 3, dwProtect, NULL);
}
}
if(!GetAsyncKeyState(VK_LBUTTON))
{
const BYTE STW_off[3] = { ADR_ASM_STW_OFF };
{
DWORD dwProtect;
VirtualProtect((void*)(ADR_ASM_STW), 3, PAGE_EXECUTE_READWRITE, &dwProtect);
memcpy((void*)(ADR_ASM_STW), &STW_off, 3);
VirtualProtect((void*)(ADR_ASM_STW), 3, dwProtect, NULL);
}
}
}
if(STW==0)
{
const BYTE STW_off[3] = { ADR_ASM_STW_OFF };
{
DWORD dwProtect;
VirtualProtect((void*)(ADR_ASM_STW), 3, PAGE_EXECUTE_READWRITE, &dwProtect);
memcpy((void*)(ADR_ASM_STW), &STW_off, 3);
VirtualProtect((void*)(ADR_ASM_STW), 3, dwProtect, NULL);
}
}