Code:
#define ADR_HSCALLBACK1 0x007907A
#define ADR_HSCALLBACK2 0x0009FA8
#define ADR_HSNNANOSCAN1 0x0096863
#define ADR_HSNNANOSCAN2 0x009457F
#define ADR_HS_CRCPATCH 0x00786DC
#define ADR_CRCPATCH 0x417E77
#define ADR_EHSVCJUMP2 0x005C19B4
BYTE NOPS [] = { 0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90 };
BYTE RETR [] = { 0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31 };
BYTE NANOSCAN1ON [2] = { 0x03,0xD2 };
BYTE NANOSCAN2ON [5] = { 0xB8,0x00,0x00,0x00,0x00 };
BYTE NANOSCAN1OFF [2] = { 0x03,0xC2 };
BYTE NANOSCAN2OFF [5] = { 0xE8,0xFE,0x17,0x00,0x00 };
INT BypassMain ( void )
{
BOOL Patched = FALSE;
BOOL Patch = TRUE;
DWORD dwHSModule = NULL;
do{
dwHSModule = (DWORD)GetModuleHandleA("ehsvc.dll");
Sleep(15);
}while(!dwHSModule);
for ( ; ; )
{
if(dwHSModule != 0 && Patched == FALSE && Patch == TRUE)
{
cTools->WriteMemory((PVOID)ADR_CRCPATCH,(LPVOID)NOPS,2);
cTools->WriteMemory((PVOID)ADR_EHSVCJUMP2,(LPVOID)"\xEB",1);
cTools->WriteMemory((PVOID)(dwHSModule+ADR_HSCALLBACK1),(LPVOID)"\x74",1);
cTools->WriteMemory((PVOID)(dwHSModule+ADR_HSCALLBACK2),(LPVOID)"\xC3",1);
cTools->WriteMemory((PVOID)(dwHSModule+ADR_HS_CRCPATCH),(LPVOID)"\xC2\x04\x00",3);
cTools->WriteMemory((PVOID)(dwHSModule+ADR_HSNANOSCAN1),(LPVOID)NANOSCAN1ON,2);
cTools->WriteMemory((PVOID)(dwHSModule+ADR_HSNANOSCAN2),(LPVOID)NANOSCAN2ON,5);
Sleep(4000);
cTools->WriteMemory((PVOID)(dwHSModule+ADR_HSNANOSCAN1),(LPVOID)NANOSCAN1OFF,2);
Patched = TRUE;
Patch = FALSE;
}
else
{
if(dwHSModule != 0 && Patched == TRUE && Patch == FALSE)
{
cTools->WriteMemory((PVOID)(dwHSModule+ADR_HSNANOSCAN2),(LPVOID)NANOSCAN2OFF,5);
Patched = FALSE;
Patch = TRUE;
}
}
Sleep(30);
}
return NULL;
}