[EMS] HackShield & MS CRC Bypass.

[Enable]
Alloc(NewMemory, 4194304)
Alloc(CRCCave, 128)
Alloc(CopyMemory, 128)
CreateThread(CopyMemory)
Label(End)

00485A1C:
jmp CRCCave

CRCCave:
cmp ecx,00400000
jl End
cmp ecx,00A00000
jg End
add ecx,NewMemory-00400000

End:
mov eax,[ebp+10]
push esi
push edi
jmp 00485A21

CopyMemory:
mov esi,00400000
mov edi,NewMemory
mov ecx,00100000
rep movsd
push 00
call ExitThread
[Disable]

[Enable]
//Name: HackShield CRC Check Bypassing CE Assembly Script.
alloc(HSCRCFail,256)
label(BackToOP)

OpenProcess:
jmp HSCRCFail

HSCRCFail:
mov eax, fs:[20]
cmp eax, [esp+0c]

jne BackToOP
mov fs:[34], 57
xor eax, eax
ret 000c

BackToOP:
mov edi, edi
push ebp
mov ebp, esp
jmp OpenProcess+5

[Disable]
OpenProcess:
mov edi, edi
push ebp
mov ebp, esp
dealloc(HSCRCFail)

#include <windows.h>

#define JMP(frm, to) (int)(((int)to - (int)frm) - 5)

DWORD dwOpenProcess = (DWORD)OpenProcess;  

__declspec(naked) VOID WINAPI OpenProcessHook()
{
  __asm {
    call GetCurrentProcessId
    cmp  eax, [esp+0Ch]
    jnz  Return
    push ERROR_INVALID_PARAMETER
    call SetLastError
    xor  eax, eax
    ret  0Ch
Return:
    push ebp
    mov  ebp, esp
    jmp  [dwOpenProcess+5]
  }
}

inline BOOL ToggleBypass(__in BOOL b)
{
  static BOOL bEnabled = FALSE;
  BOOL        bRet = FALSE;
  
  if(b != (bEnabled = !bEnabled))
    return FALSE;
    
  __try {
    if(b)
    {
      *(BYTE*)dwOpenProcess = 0xE9;
      *(DWORD*)(dwOpenProcess + 1) = JMP(dwOpenProcess, OpenProcessHook);
    }
    else
    {
      *(WORD*)dwOpenProcess = 0xFF8B;	      // mov  edi, edi
      *(BYTE*)(dwOpenProcess + 2) = 0x55;   // push ebp
      *(WORD*)(dwOpenProcess + 3) = 0xEC8B;	// mov  ebp, esp
    }
    bRet = TRUE;
  }
  __except(EXCEPTION_EXECUTE_HANDLER) {
    bRet = FALSE;
  }
  
  return bRet;
}

BOOL APIENTRY DllMain(__in HMODULE hModule, __in DWORD fdwReason, __in __reserved LPVOID lpvReserved)
{
  switch(fdwReason)
  {
    case DLL_PROCESS_ATTACH:
      dwOpenProcess = (DWORD)OpenProcess;
      if(dwOpenProcess != 0)
      {
        if(ToggleBypass(TRUE))
        {
          DisableThreadLibraryCalls(hModule);
          break;
        }
      }
      return FALSE;
      
    case DLL_PROCESS_DETACH:
      ToggleBypass(FALSE);
      break;
  }
  
  return TRUE;
}