[Regularly Updated] Latest Working Tools for NFSW

Quote:

Originally Posted by Malware442  Spoiler look carerefully...and why you lie? your what? is free on the internet mate.. [Only registered and activated users can see links. Click Here To Register...] or [Only registered and activated users can see links. Click Here To Register...] [Only registered and activated users can see links. Click Here To Register...] Why you rage for creditz for something that you didnt do? {I just remove the protection because always will exist a pattern and a handle(nfsw), and improve the speed for scnning less bytes than ever} You you always lie and cry? Maybe do something usefull and improve your MH,,this thread is made by you but is for all of us,if the tools works then it must be added. You made my laugh,your function :)) You change only name.You want gain creditz for something that you didnt make it. ANd another from autoit forums (made by the guys who made autoit) [Only registered and activated users can see links. Click Here To Register...] AGAIN --> your what? Man if you had something with me send a PM,dont post public , you profit by people who dont know to believe you,but you wrong. And function which i use is from autoit forums and improved by me to scan fewer bytes. ;) SO dont bother to answer here,came in PM and tell me the real reason,not lies like here

Func _MemoryPatternSearch($ProcessHandle, $Pattern, $StartAddress = 0x00400000, $StopAddress = 0x00600000, $Step = 51200)
If Not IsArray($ProcessHandle) Then
  SetError(1)
  Return -1
EndIf
$Pattern = StringRegExpReplace($Pattern, '[^0123456789ABCDEFabcdef.]', '')
If StringLen($Pattern) = 0 Then
  SetError(2)
  Return -2
EndIf
Local $BufferPattern, $FormatedPattern
For $i = 0 To ((StringLen($Pattern) / 2) - 1)
  $BufferPattern = StringLeft($Pattern, 2)
  $Pattern = StringRight($Pattern, StringLen($Pattern) - 2)
  $FormatedPattern = $FormatedPattern & $BufferPattern
Next
$Pattern = $FormatedPattern
For $Address = $StartAddress To $StopAddress Step $Step - (StringLen($Pattern) / 2)
  StringRegExp(_MemoryRead($Address, $ProcessHandle, 'byte[' & $Step & ']'), $Pattern, 1, 2)
  If Not @error Then
   Return StringFormat('0x%.8X', $Address + ((@extended - StringLen($Pattern) - 2) / 2))
  EndIf
Next
Return -3
EndFunc   ;==>_MemoryPatternSearch

Func _AOBScan($handle, $sig)
	$sig = StringRegExpReplace($sig, "[^0123456789ABCDEFabcdef.]", "")
	$start_addr = 0x00400000
	$end_Addr = 0x0FFFFFFF
	For $addr = $start_addr To $end_Addr Step 51200 - (StringLen($sig) / 2)
		StringRegExp(_MemoryRead($addr, $handle, "byte[51200]"), $sig, 1, 2)
		If Not @error Then
			Return StringFormat("0x%.8X", $addr + ((@extended - StringLen($sig) - 2) / 2))
		EndIf
	Next
	Return 0
EndFunc   ;==>_AOBScan

Quote:

Maybe do something usefull and improve your MH

Quote:

Originally Posted by berkay2578 All in all, you are still acting childish. Camera Editor is already added to the list, instead of posting stuff like "why u criyyyyyyyy now sugar?"; grow a pair and talk like a real man.

For $Address = $StartAddress To $StopAddress Step $Step - (StringLen($Pattern) / 2)
  StringRegExp(_MemoryRead($Address, $ProcessHandle, 'byte[' & $Step & ']'), $Pattern, 1, 2)
  If Not @error Then
   Return StringFormat('0x%.8X', $Address + ((@extended - StringLen($Pattern) - 2) / 2))
  EndIf
Next
Return 0 ;(-1 ... -10000000) ... same thing

If Not IsArray($ProcessHandle) Then;handle dont need because i know that i must add a handle
  SetError(1)
  Return -1
EndIf
$Pattern = StringRegExpReplace($Pattern, '[^0123456789ABCDEFabcdef.]', '')

If StringLen($Pattern) = 0 Then ;removed because i will give it the pattern...so variant with no ;pattern didn't exist
  SetError(2)
  Return -2
EndIf
;formatten pattern ....dont need
Local $BufferPattern, $FormatedPattern
For $i = 0 To ((StringLen($Pattern) / 2) - 1)
  $BufferPattern = StringLeft($Pattern, 2)
  $Pattern = StringRight($Pattern, StringLen($Pattern) - 2)
  $FormatedPattern = $FormatedPattern & $BufferPattern
Next
$Pattern = $FormatedPattern

Quote:

Originally Posted by berkay2578 ; grow a pair and talk like a real man.

Quote:

Originally Posted by Farming Inc. Back to topic please!

Quote:

Originally Posted by berkay2578 I bet he can't explain how anti-cheat bypass works and what it bypasses.

Global $procesnfsw = "nfsw.exe"
Func shit()
	$pid = ProcessExists($procesnfsw) 
	;pid of "nfsw.exe" process
	$openshit = _memoryopen($pid) 
	;open memory to write there
	$start = ;the begining of scanning (some stuff which i writed to make the interval of scanning bytes smaller for fatser responses)
	$stop = ; the end of scanning (now the interval is smaller)
	$scan1 = searchpattern($openshit,"8B 0D 64 2F ?? ?? E8 20 FB FF",$start,$stop)
	;those 8B 0D 64 2F is a move on a backward location...to recheck some stuff again,so that
	;must be avoid with a little skip of a few bytes.
	_memorywritebyte("0x" & $scan1, $openshit,"EB 09 44 B7","long")
	;bypass is very simple,replace that move with a jump (again EB) on a forward location.
	;with other words it skip 11 bytes...go from 55 to 60 location(hexa)
	$scan2 = searchpattern($openshit,"55 8B EC 0F 57 C0 56 8B 35 A0",$start,$stop)
	;55 - push ebp (load ebp on stack)
	;C3 is bypass because it force a return and the stack will not hve this value,so what should do ;)
	;2 bytes before that is a the byte "5D"--> this shit is a pop of ebp (make stack empty)
	_memorywritebyte("0x" & $scan2, $openshit,"C3","long")
	;so the stack is ready to have elements,but C3 is meaning that the the program will exit from procedure(C style :P)
	$scan3 = searchpattern($openshit,"7E 7C 8B 45 EC 0B 45 F0 74 74",$start,$stop)
	;7E bytes is a jle (jump if is "<=" )
	_memorywritebyte("0x" & $scan3, $openshit,"EB","long")
	;7E is replaced by EB , which is a simple "jmp", will jump there anytime without checking the condition if is "<="
	;2 bytes before that is "3B CA"_a fucking compare of ecx and edx registers 
	;(original...ecx must be <= than edx -->bypass make it happen anytime)
	$scan4 = searchpattern($openshit,"E9 1B E9 FF FF CC CC CC CC CC",$start,$stop)
	;here again the byte "E9" which is a simple jmp and the next bytes is about the location where to jump
	;(more steps backward --> this mean it will recheck some stuff). So the bypass replace that jump
	_memorywritebyte("0x" & $scan4, $openshit,"33 C0 C3 19","long")
	;33 C0 bytes is just a  xor eax,eax   ,which will clear the register
        ;C3 byte is for a simple ret ,which will return from a procedure (like in C)
	;next 2 bytes "19" and "FF"{FF is not replaced this time} is guest what ..to init edi with "0" or "-1"
	_memoryclose($openshit)
	;this the harder...close this fucking memory(no need open anymore)
EndFunc

;findpattern search in memory for those bytes.
;If you change them then second time will crash (bytes are changed,so next scan will not find the bytes)
;A bypass must be made here, very easy that too

Quote:

Originally Posted by berkay2578 He thinks acting childish has something to do with ages

Quote:

Originally Posted by Farming Inc. Back to topic please!

1. Bypass client's local event time check: cmp eax,ebx to push ebx,eax then cmp eax,ebx
2. Bypass client2server max speed check. Done prematurely so it shows 0km/h at end event screen. Currently RET in mid-function, can be modded like GMZ did to push random speed. (in 1-2 weeks my mh will have it that way)
3. NOP HacksDetected function
4. NOP EnvProcVal function (process names)
5. Bypass client's integrity check with using PUSH eax,1 before comp al,eax

Quote:

Originally Posted by berkay2578 Yo wrote a stupid autoit code and literally C&Ped how assembly works, good job pal! Everybody in the world knows how assembly works and you don't find stuff just by "playing with stuff ;)" in memory. Anticheat works like this, step by step: (I'm noting execution order from my MH as it differs from other public AC bypasses in a way) Bypass client's local event time check: cmp eax,ebx to push ebx,eax then cmp eax,ebx Bypass client2server max speed check. Done prematurely so it shows 0km/h at end event screen. Currently RET in mid-function, can be modded like GMZ did to push random speed. (in 1-2 weeks my mh will have it that way) NOP HacksDetected function NOP EnvProcVal function (process names) Bypass client's integrity check with using PUSH eax,1 before comp al,eax List has two more but I'll let them to you since you magically know everything works. You're literally the definition of a script-kiddie btw. Stay away from me if you can, as I hate people like you.

Quote:

Originally Posted by MaceTheAce13 Can you guys please stop arguing? or maybe better, just do it in pm?

Quote:

Originally Posted by MaceTheAce13 What happened? lol... Also someone put this hack: [Only registered and activated users can see links. Click Here To Register...] Completely safe, I tested everything myself!