As the title already says, I just want to release it with source code, so you guys can use, change, study or whatever you want.
Language: C.
IDE: Visual Studio 2008 Pro.
Source:
Language: C.
IDE: Visual Studio 2008 Pro.
Source:
PHP Code:
#pragma warning (disable: 4996)
#ifdef UNICODE
#undef UNICODE
#endif
#include <Windows.h>
#include <TlHelp32.h>
#include <psapi.h>
#include <stdio.h>
#define callNT(name, params, args) ((long (__stdcall *)params)GetProcAddress(GetModuleHandleA("ntdll.dll"),name))args
#define ThreadQuerySetWin32StartAddress 9
#define WNDCLASS "D3D Window"
#define DLLNAME "GameGuard.dll"
bool isGameAlive()
{
return (FindWindowA(WNDCLASS, 0) != 0);
}
bool searchAndKillDllThreads()
{
long killCount = 0;
HANDLE hProcess;
HANDLE hSnap;
DWORD pid;
GetWindowThreadProcessId(FindWindowA(WNDCLASS, 0),&pid);
hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
if (hProcess == INVALID_HANDLE_VALUE)
{
printf("[error] OpenProcess has failed.\n");
return false;
}
if (callNT("NtSuspendProcess",(HANDLE),(hProcess)) == 0)
{
tagMODULEENTRY32 mEntry = { 0 };
tagTHREADENTRY32 tEntry = { 0 };
mEntry.dwSize = sizeof(mEntry);
hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pid);
if (Module32First(hSnap, &mEntry))
{
do
{
if (!lstrcmpiA(mEntry.szModule, DLLNAME))
{
printf("[info] Found Module: \"%s\" at 0x%08X, size: 0x%X\n", DLLNAME, mEntry.hModule, mEntry.modBaseSize);
break;
}
}
while (Module32Next(hSnap, &mEntry));
callNT("NtClose",(HANDLE),(hSnap));
}
if (!lstrcmpiA(mEntry.szModule, DLLNAME))
{
tEntry.dwSize = sizeof(tEntry);
hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
if (Thread32First(hSnap, &tEntry))
{
do
{
if (tEntry.th32OwnerProcessID == pid)
{
HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, false, tEntry.th32ThreadID);
unsigned long thStartAddress;
if (callNT("NtQueryInformationThread",(HANDLE, long, void*, long, void*),(hThread, ThreadQuerySetWin32StartAddress, &thStartAddress, sizeof(thStartAddress), 0)) == 0)
{
char* action = "ignored";
char address[255] = { 0 };
if ((thStartAddress >= (unsigned long)mEntry.hModule) && (thStartAddress <= ((unsigned long)mEntry.hModule + (unsigned long)mEntry.modBaseSize)))
{
if (callNT("NtTerminateThread",(HANDLE, long),(hThread, 0)) == 0)
{
killCount++;
action = "killed";
}
else
action = "failed";
sprintf(address, "\"%s\"+0x%X", DLLNAME, thStartAddress - (unsigned long)mEntry.hModule);
}
else
{
callNT("NtClose",(HANDLE),(hThread));
sprintf(address, "0x%08X", thStartAddress);
}
printf("[info] Thread address: %s, action: %s\n", address, action);
}
else
{
printf("[error] NtQueryInformationThread has failed, try opening me as admin.\n");
return false;
}
}
}
while (Thread32Next(hSnap, &tEntry));
callNT("NtClose",(HANDLE),(hSnap));
}
}
callNT("NtResumeProcess",(HANDLE),(hProcess));
}
else
{
printf("[error] NtSuspendProcess has failed, try opening me as admin.\n");
return false;
}
callNT("NtClose",(HANDLE),(hProcess));
return (killCount > 0);
}
void main()
{
char n;
SetConsoleTitleA("Cabal Pilipinas Bypass - by Matthew Dartz");
if (!isGameAlive())
printf("[info] Waiting for the game...\n");
while (!isGameAlive()) Sleep(100);
do
{
printf("[warn] Are you in the login screen (y/n)? ");
scanf("%c",&n);
fflush(stdin);
if (n != 'y')
printf("[warn] Ok, so wait until there.\n");
else
{
if (!isGameAlive())
{
n = 'n';
printf("[error] Why did you close the game? Start it again and wait.\n");
}
}
}
while (n != 'y');
if (searchAndKillDllThreads())
printf("[info] Sucessfully Bypassed.\n");
else
printf("[warn] Couldn't find any thread to bypass (it should be already bypassed, check the logs from above).\n");
printf("\n");
system("pause");
}
