[QUESTION]About Bypass Programming

Page 1 of 2 1 2
02/09/2014 00:04 likapielikapie#1
Hello everybody,
I was working on xtrap bypass development. So I got some results for x64 xtrap bypassing.

I learnt that bypassing in x64 systems has 2 steps:
1-Terminate K32EnumProcesses in kernel32 (I can make it)
2-Change the name of "X6va016" service to "X6va01"

I need help for making the second step. How can I find the address of this service ? Or it has an other way ?

Thanks~
02/09/2014 00:27 SilverEmerald#2
Use Cheat Engine to find X6va016's addy.

For 32 bit, you have to show xtrap that you're using 64 bit OS.
02/09/2014 09:57 Omdi#3
You have to disable the memory detection as well ;)
02/09/2014 11:24 K1ramoX#4
[Only registered and activated users can see links. Click Here To Register...]

isn't that hard or?

edit:

look at 40546390. you dont need to change the string:

Code:
push    0               ; _DWORD
push    80h             ; _DWORD
push    3               ; _DWORD
push    0               ; _DWORD
push    0               ; _DWORD
push    0C0000000h      ; _DWORD
push    offset a_X6va016 ; "\\\\.\\X6va016"
mov     [edi+0Ch], eax
call    dword_406448E0
cmp     eax, 0FFFFFFFFh
jnz     short loc_405463FA
just edit the code here. there is also the load of the second driver:

Code:
mov     edx, [esi]
push    edi
push    offset a_Xdva407 ; "\\\\.\\XDva407"
mov     ecx, esi
call    dword ptr [edx+60h]
just sayin
02/09/2014 12:59 onahoe#5
Quote:
Originally Posted by K1ramoX View Post
you dont need to change the string:
but its easier ;o
---------------------

[Only registered and activated users can see links. Click Here To Register...]: Just look into ProcessHacker -> Services
[Only registered and activated users can see links. Click Here To Register...]

u see the running driver (X6va017) << you have to search this string in cheatengine. you'll probably find 3/4 statics:

[Only registered and activated users can see links. Click Here To Register...]

~this is done for microvolts, in s4 its the same.. (idk the current driver name ;O)
02/09/2014 15:12 likapielikapie#6
Quote:
Originally Posted by onomato View Post
but its easier ;o
---------------------

[Only registered and activated users can see links. Click Here To Register...]: Just look into ProcessHacker -> Services
[Only registered and activated users can see links. Click Here To Register...]

u see the running driver (X6va017) << you have to search this string in cheatengine. you'll probably find 3/4 statics:

[Only registered and activated users can see links. Click Here To Register...]

~this is done for microvolts, in s4 its the same.. (idk the current driver name ;O)
By this way, X6va017 service will be still running. Doesn't it makes problem ?
02/09/2014 21:16 Forbidi#7
Just search in memory x6va016 as string that's not that hard, maybe learn how to bypass memory scan after that ?
02/09/2014 21:22 onahoe#8
Quote:
Originally Posted by likapielikapie View Post
By this way, X6va017 service will be still running. Doesn't it makes problem ?

No ;o Change it to X6va111 or something idk ^.^
02/10/2014 14:35 likapielikapie#9
Quote:
Originally Posted by onomato View Post
No ;o Change it to X6va111 or something idk ^.^
When I do it, XTrap says "A program is effecting game client"
Help bro :D
02/10/2014 15:59 Slicktor#10

Scroll up.


[Only registered and activated users can see links. Click Here To Register...](SC_HANDLE,LPCSTR lpServiceName,DWORD);
ERROR_INVALID_NAME
[Only registered and activated users can see links. Click Here To Register...](LPCTSTR,LPCTSTR,DWORD dwDesiredAccess)
ERROR_ACCESS_DENIED

There are many methods to bypass the 64-bit driver :P
02/15/2014 16:29 bangjons#11
Quote:
Originally Posted by Slicktor View Post
Scroll up.


[Only registered and activated users can see links. Click Here To Register...](SC_HANDLE,LPCSTR lpServiceName,DWORD);
ERROR_INVALID_NAME
[Only registered and activated users can see links. Click Here To Register...](LPCTSTR,LPCTSTR,DWORD dwDesiredAccess)
ERROR_ACCESS_DENIED

There are many methods to bypass the 64-bit driver :P

Give me bro :)
02/15/2014 16:34 Forbidi#12
Quote:
Originally Posted by likapielikapie View Post
When I do it, XTrap says "A program is effecting game client"
Help bro :D
You do it with wich language ?
02/16/2014 10:50 likapielikapie#13
Quote:
Originally Posted by Forbidi View Post
You do it with wich language ?
Trying with AutoIT
02/16/2014 17:36 Hybrid~#14
Quote:
Originally Posted by likapielikapie View Post
Trying with AutoIT
omg. Screw AutoIt.
Learn C++ Basics and code it in C++ ffs.
AutoIT is good for basic and easy shit.
02/16/2014 19:00 Forbidi#15
Quote:
Originally Posted by Hybrid~ View Post
omg. Screw AutoIt.
Learn C++ Basics and code it in C++ ffs.
AutoIT is good for basic and easy shit.
[Only registered and activated users can see links. Click Here To Register...]

So this is a shit ?
Page 1 of 2 1 2