Quote:
Originally Posted by MaBarker
@wSiiCK Only Steal and no Skill
|
Code:
void __fastcall InitiliazateHook (void)
{
//VMProtectBeginMutation("InitiliazateHook");
bool HS = InitializeGuardBypass();
if ( HS == true )
{
CreateThread(0,0,(LPTHREAD_START_ROUTINE)HackThread,0,0,0);
//CreateThread(0,0,(LPTHREAD_START_ROUTINE)BOTFunction,0,0,0);
bool bValid = false;
while(true)
{
bValid = d3d->EngineDevice (0) > 0;
if( bValid )
{
if( *(DWORD*) d3d->EngineDevice(16) != (DWORD)&hkReset && d3d->EngineDevice(16) != NULL)
{
oReset = (tReset) *(DWORD*)d3d->EngineDevice(16);
*(DWORD*)d3d->EngineDevice(16) = (DWORD)&hkReset ;
}
if( *(DWORD*) d3d->EngineDevice(42) != (DWORD)&hkEndScene && d3d->EngineDevice(42) != NULL)
{
oEndScene = (tEndScene) *(DWORD*)d3d->EngineDevice(42);
*(DWORD*)d3d->EngineDevice(42) = (DWORD)&hkEndScene;
}
if( *(DWORD*) d3d->EngineDevice(44) != (DWORD)&hkSetTransformer && d3d->EngineDevice(44) != NULL)
{
oSetTransformer = (tSetTransformer) *(DWORD*)d3d->EngineDevice(44);
*(DWORD*)d3d->EngineDevice(44) = (DWORD)&hkSetTransformer;
}
if( *(DWORD*) d3d->EngineDevice(82) != (DWORD)&hkDrawIndexedPrimitive && d3d->EngineDevice(82) != NULL)
{
oDrawIndexedPrimitive = (tDrawIndexedPrimitive) *(DWORD*)d3d->EngineDevice(82);
*(DWORD*)d3d->EngineDevice(82) = (DWORD)&hkDrawIndexedPrimitive;
}
}
Sleep(300);
}
}
//VMProtectEnd();
}
Code:
void FakeHeuristicScanThread ( void )
{
VMProtectBeginUltra("FakeHeuristicScanThread");
DWORD dwEvent_ = (dwGGDes+0x12BD50);
DWORD dwEvent__ = *(DWORD *)(dwEvent_+0xBCC);
SetEvent((HANDLE)dwEvent__);
VMProtectEnd();
while ( bThreadTerminate == false )
{
Sleep(1000);
}
}
Code:
HANDLE WINAPI hkCreateRemoteThreadEx ( HANDLE hProcess, LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, DWORD lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPPROC_THREAD_ATTRIBUTE_LIST lpAttributeList, LPDWORD lpThreadId)
{
VMProtectBeginUltra("hkCreateRemoteThreadEx");
if ( lpStartAddress == cMainStarting )
{
__asm pushad
__asm mov esi,dword ptr ss:[esi+0x48];
__asm mov realThreadAddress,esi;
__asm popad
if ( realThreadAddress == cAsmThread )
{
__asm pushad
__asm mov edi, FakeASMThread;
__asm mov dword ptr ss:[esi+0x48], edi;
__asm mov dword ptr ss:[esi+0x4C], edi;
__asm popad
}
if ( realThreadAddress == cThread_1 )
{
__asm pushad
__asm mov edi, FakeHeuristicScanThread;
__asm mov dword ptr ss:[esi+0x48], edi;
__asm mov dword ptr ss:[esi+0x4C], edi;
__asm popad
}
if ( realThreadAddress == cThread_2 )
{
__asm pushad
__asm mov edi, FakeStrangeCheckScanThread;
__asm mov dword ptr ss:[esi+0x48], edi;
__asm mov dword ptr ss:[esi+0x4C], edi;
__asm popad
}
if ( realThreadAddress == cThread_3 )
{
__asm pushad
__asm mov edi, FakeHeuristicModulesScanThread;
__asm mov dword ptr ss:[esi+0x48], edi;
__asm mov dword ptr ss:[esi+0x4C], edi;
__asm popad
}
if ( realThreadAddress == cThread_4 )
{
__asm pushad
__asm mov edi,FakeKernelTraceThread;
__asm mov dword ptr ss:[esi+0x48],edi;
__asm mov dword ptr ss:[esi+0x4C], edi;
__asm popad
__asm pushad
DWORD old;
tools->VProtect((void*)(dwCreateRemoteThreadEx-0x7585),0x7590,PAGE_EXECUTE_READWRITE,&old);
for(int i = 0; i < sizeof(ORIGINALBYTES); i++)
{
*(BYTE*)(dwCreateRemoteThreadEx+i) = ORIGINALBYTES[i];
}
tools->VProtect((void*)(dwCreateRemoteThreadEx-0x7585),0x7590,old,&old);
__asm popad
}
}
VMProtectEnd();
return oCreateRemoteThreadEx ( hProcess, lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpAttributeList, lpThreadId);
}
I see ... no skill ;)