Code:
void DetouringHackShield ( void )
{
//Scanning for Module
PDWORD dwHSModule;
do
{
*(DWORD*)&dwHSModule = *(DWORD*)GetModuleHandleA("EhSvc.dll");
}
while ( !dwHSModule );
//Searching Addys...
DWORD dwHSCallBack1 = Tools.FindPatternRemote((DWORD)dwHSModule,0x11E000,(PBYTE)"\x55\x8B\xEC\x83\xEC\x00\x53\x56\x57\x89\x4D\xE0",ASM);
DWORD dwHSCallBack2 = Tools.FindPatternRemote((DWORD)dwHSModule,0x11E000,(PBYTE)"\x83\xC4\x00\x85\xDB\x75\x00\x55\xE8\x00\x00\x00\x00\x83\xC4\x00\x33\x00",ASM);
DWORD dwHSNanoScan1 = Tools.FindPatternRemote((DWORD)dwHSModule,0x11E000,(PBYTE)"\x8B\x45\x00\x03\xC2\x89\x45\x00\x83\x7D\xDC\x00",ASM);
DWORD dwHSNanoScan2 = Tools.FindPatternRemote((DWORD)dwHSModule,0x11E000,(PBYTE)"\x8B\x55\x00\x52\xE8\x00\x00\x00\x00\x83\xC4\x14\x89\x45\x00\x83\x7D\xE4\x00",ASM);
//Setting up our Bytes...
BYTE bpJe [1] = { 0x74 };
BYTE bpRetnA [1] = { 0xC3 };
BYTE bpAddEdx [2] = { 0x03,0xD2 };
BYTE bpMovEax [5] = { 0xB8,0x00,0x00,0x00,0x00 };
BYTE NanoScan1OFF [2] = { 0x03,0xC2 };
BYTE BTOFFanoScan2 [5] = { 0xE8,0xFE,0x17,0x00,0x00 };
//Some Other Stuff
BOOL FirstLog = TRUE;
BOOL SecondLog = FALSE;
//Detouring the Hackshield
Tools.WriteMemory((void*)(dwHSCallBack2),bpJe,1); //EhSvc.dll CRC Check new actualy working
Tools.WriteMemory((void*)(dwHSCallBack1),bpRetnA,1); //EhSvc.dll Main EhSvc.dll Kill all HS ERROR
do
{
DWORD S_Pointer = *(DWORD*)0x00A30994;
if ( S_Pointer != 0 && FirstLog && !SecondLog )
{
Tools.WriteMemory((void*)(dwHSNanoScan1),bpAddEdx,2); // HS Sub Main Forcing Detection 1
Tools.WriteMemory((void*)(dwHSNanoScan2),bpMovEax,5); // HS Sub Call Forcing Detection 2
Sleep(5000); // Begin of Endless Loop
Tools.WriteMemory((void*)(dwHSNanoScan1),NanoScan1OFF,2); // Restoring after 5 second inside server
FirstLog = false;
SecondLog = true;
}
if ( S_Pointer == 0 && SecondLog )
{
BYTE BTOFFanoScan2 [5] = { 0xE8,0xFE,0x17,0x00,0x00 }; // Restoing if server is == 0
Tools.WriteMemory((void*)(dwHSNanoScan2),BTOFFanoScan2,5);
FirstLog = true;
SecondLog = false;
}Sleep(20);
}while (TRUE);
}