Bypass aus dem Hack ist in diesem ASM Bereich mit IDA oder sonstigem Debugger eurer wahl zu finden:
Screenshot:
// removed - Advertising
Viruscan:
[Only registered and activated users can see links. Click Here To Register...]
Download:
[Only registered and activated users can see links. Click Here To Register...]
Greetz von: Chowniiqhtz & KingClem
Info's about the Hack:
*Hackshield --> Hooked :
BULLSHIT! He dont know what a Hook is and he didn't hooked it ;)
Code:
.text:10006BC3 loc_10006BC3: ; CODE XREF: StartAddress+22j .text:10006BC3 push offset ModuleName ; "Ehsvc.dll" .text:10006BC8 call esi ; GetModuleHandleA .text:10006BCA push 1Eh ; dwMilliseconds .text:10006BCC mov edi, eax .text:10006BCE call ebx ; Sleep .text:10006BD0 test edi, edi .text:10006BD2 jz short loc_10006BC3 .text:10006BD4 mov esi, ds:VirtualProtect .text:10006BDA lea eax, [ebp+flNewProtect] .text:10006BDD push eax ; lpflOldProtect .text:10006BDE push 4 ; flNewProtect .text:10006BE0 push 1 ; dwSize .text:10006BE2 lea ebx, [edi+7C139h] .text:10006BE8 push ebx ; lpAddress .text:10006BE9 call esi ; VirtualProtect .text:10006BEB mov edx, [ebp+flNewProtect] .text:10006BEE movzx ecx, ds:byte_100253CC .text:10006BF5 push 0 ; lpflOldProtect .text:10006BF7 push edx ; flNewProtect .text:10006BF8 push 1 ; dwSize .text:10006BFA push ebx ; lpAddress .text:10006BFB mov [ebx], cl .text:10006BFD call esi ; VirtualProtect .text:10006BFF lea eax, [ebp+flNewProtect] .text:10006C02 push eax ; lpflOldProtect .text:10006C03 push 4 ; flNewProtect .text:10006C05 push 1 ; dwSize .text:10006C07 lea ebx, [edi+0A048h] .text:10006C0D push ebx ; lpAddress .text:10006C0E call esi ; VirtualProtect .text:10006C10 mov edx, [ebp+flNewProtect] .text:10006C13 movzx ecx, ds:byte_10025568 .text:10006C1A push 0 ; lpflOldProtect .text:10006C1C push edx ; flNewProtect .text:10006C1D push 1 ; dwSize .text:10006C1F push ebx ; lpAddress .text:10006C20 mov [ebx], cl .text:10006C22 call esi ; VirtualProtect .text:10006C24 lea eax, [ebp+flNewProtect] .text:10006C27 push eax ; lpflOldProtect .text:10006C28 push 4 ; flNewProtect .text:10006C2A push 2 ; dwSize .text:10006C2C lea ebx, [edi+9A520h] .text:10006C32 push ebx ; lpAddress .text:10006C33 call esi ; VirtualProtect .text:10006C35 mov edx, [ebp+flNewProtect] .text:10006C38 mov cx, ds:word_1002556C .text:10006C3F push 0 ; lpflOldProtect .text:10006C41 push edx ; flNewProtect .text:10006C42 push 2 ; dwSize .text:10006C44 push ebx ; lpAddress .text:10006C45 mov [ebx], cx .text:10006C48 call esi ; VirtualProtect .text:10006C4A lea eax, [ebp+flNewProtect] .text:10006C4D push eax ; lpflOldProtect .text:10006C4E push 4 ; flNewProtect .text:10006C50 push 5 ; dwSize .text:10006C52 add edi, 97F6Fh .text:10006C58 push edi ; lpAddress .text:10006C59 call esi ; VirtualProtect .text:10006C5B mov eax, [ebp+flNewProtect] .text:10006C5E mov ecx, ds:dword_10025570 .text:10006C64 push 0 ; lpflOldProtect .text:10006C66 push eax ; flNewProtect .text:10006C67 mov [edi], ecx .text:10006C69 mov dl, ds:byte_10025574 .text:10006C6F push 5 ; dwSize .text:10006C71 push edi ; lpAddress .text:10006C72 mov [edi+4], dl .text:10006C75 call esi ; VirtualProtect .text:10006C77 pop edi .text:10006C78 pop esi .text:10006C79 mov eax, 1 .text:10006C7E pop ebx .text:10006C7F mov esp, ebp .text:10006C81 pop ebp .text:10006C82 retn .text:10006C82 StartAddress endp .text:10006C82 .text:10006C82 ; --------------------------------------------------------------------------- .text:10006C83 align 4 .text:10006C84 dd 0Fh dup(0CCCCCCCCh) .text:10006CC0
Screenshot:
// removed - Advertising
Viruscan:
[Only registered and activated users can see links. Click Here To Register...]
Download:
[Only registered and activated users can see links. Click Here To Register...]
Greetz von: Chowniiqhtz & KingClem
Info's about the Hack:
*Hackshield --> Hooked :
BULLSHIT! He dont know what a Hook is and he didn't hooked it ;)