WarRock EAC BYPASS LOL!

08/02/2017 16:41 MRx86™#1
edit
08/02/2017 17:18 eCyler#2
ok bro
08/02/2017 18:22 ~ExoduS~*#3
thx but this is a bad way xD. Its easy to fixx it without bypass ;)
08/02/2017 23:26 +Yazzn#4
Nice London
08/06/2017 12:48 Alliance™#5
There are other easy usermode exploit to get handle of the process for inject DLL
08/08/2017 02:04 sokter1#6
Quote:
Originally Posted by Alliance™ View Post
There are other easy usermode exploit to get handle of the process for inject DLL
you think clientlessbot will back to work agian ?;)
08/09/2017 11:25 Alliance™#7
Quote:
Originally Posted by sokter1 View Post
you think clientlessbot will back to work agian ?;)
Reversing the new packet encryption i dont think is hard, the problem is the heartbeat, i will check it in the next days!
08/15/2017 12:57 Willi35#8
Quote:
Originally Posted by GHTheBoss View Post
Whats this doing ? force to load eac.exe and instead of closeup all handle it dosen't.! P.S eac driver is still running but handled closeup get dafuqed!

hope for fasting patcher! already reported to EAC :| enjoy it untill its patched ...


how to use it ? open cheats engines Runs warrock launcher. attach cheats engine there and then look the patch above.. Enjoy! dafuq.!!!!!!!!!!!!!!!!

00415115 A1 E8D15200 mov eax, dword ptr [52D1E8]
0041511A 83F8 05 cmp eax, 5
0041511D 74 4A je short 00415169

Everything is Inside WRUpdater.exe LOL
i learned alot from EAC ... they are professional retarder in KerneLand u.u

Code:
[COLOR="Red"][B]here how to use this trash codenz![/B][/COLOR]

//00415115    A1 E8D15200     mov     eax, dword ptr [52D1E8]
*(DWORD*) 0x52D1E8 = 5;


//0041511D    74 4A           je      short 00415169
memcpy((void*)0x41511D,(void*)"\x90\x90",2);
Heartbeat still working ... by doing this job. so you don't need any sheet more.
thx to me :P :D :mofo:


i'm still looking for better way i don't want to apply any patch to code i still prefer 1338 method to become stealther!


i already know nobody will credit for it, but you must remember always NO GHTheBoss No Party,



Codenzzzzzzzzzzzzzzzz!


Thx to MZ'4D5A for sarscam and patience. love u man!
Bullshit.

Quote:
Originally Posted by Alliance™ View Post
There are other easy usermode exploit to get handle of the process for inject DLL
PsLookupProcessByProcessId... For the Handle ObOpenObjectByPointer
08/17/2017 18:32 Alliance™#9
Quote:
Originally Posted by Willi35 View Post
PsLookupProcessByProcessId... For the Handle ObOpenObjectByPointer
This function are used in Kernel mode, i said there are other user mode exploit XD
08/19/2017 01:32 sirosix#10
Quote:
Originally Posted by Alliance™ View Post
This function are used in Kernel mode, i said there are other user mode exploit XD
nearly every known user mode exploit is patched for EAC/BE. when a methode goes public it dosent take much time until its patched. for Rust i had 5 injecting methodes now i only got two. they are patching one after the other.

and yes the "bypass" from King7 is bullshit. Heartbeat will only work once because a false Heartbeat will be ignored one time but the second Heartbeat will make you disconnect. it dosen't completly disable EAC but EAC will still know that it wasn't started properly.
08/19/2017 03:43 Willi35#11
Quote:
Originally Posted by sirosix View Post
nearly every known user mode exploit is patched for EAC/BE. when a methode goes public it dosent take much time until its patched. for Rust i had 5 injecting methodes now i only got two. they are patching one after the other.

and yes the "bypass" from King7 is bullshit. Heartbeat will only work once because a false Heartbeat will be ignored one time but the second Heartbeat will make you disconnect. it dosen't completly disable EAC but EAC will still know that it wasn't started properly.
The problem is these companies are learning from Public Sourcecodes. It will be much harder, when the people stop to share everything public. Also, the workers of these companies are basically skilled from university.

To beat a System is always to think different.

Also the most of the "Cheat Loaders" needs more Innovations and new Ideas to increase their protection against reverse engineering.
08/19/2017 13:26 Alliance™#12
Quote:
Originally Posted by sirosix View Post
nearly every known user mode exploit is patched for EAC/BE. when a methode goes public it dosent take much time until its patched. for Rust i had 5 injecting methodes now i only got two. they are patching one after the other.

and yes the "bypass" from King7 is bullshit. Heartbeat will only work once because a false Heartbeat will be ignored one time but the second Heartbeat will make you disconnect. it dosen't completly disable EAC but EAC will still know that it wasn't started properly.
Not all, for example a stupid example is force a process to load a dll like system dll and hide this from PEB.
I dont use it but is a noob method in usermode XD
08/19/2017 23:36 sirosix#13
Quote:
Originally Posted by Willi35 View Post
The problem is these companies are learning from Public Sourcecodes. It will be much harder, when the people stop to share everything public. Also, the workers of these companies are basically skilled from university.

To beat a System is always to think different.

Also the most of the "Cheat Loaders" needs more Innovations and new Ideas to increase their protection against reverse engineering.
yep exactly, they are very active @[Only registered and activated users can see links. Click Here To Register...] like *************, looking for the newest methodes and simply patching them, even methode where you think that they might be unpatchable, they find ways arround to detect those.
08/22/2017 13:12 MRx86™#14
Well i were in vocation just back today.

Bypass was working about 15 day's ago for sure.

usermode way which i tryed and working perfectly..
setglobalhook...
APPINT...
08/23/2017 19:03 Willi35#15
Quote:
Originally Posted by GHTheBoss View Post
Well i were in vocation just back today.

Bypass was working about 15 day's ago for sure.

usermode way which i tryed and working perfectly..
setglobalhook...
APPINT...
I would you like inform that App_init can be blocked by some Anti-Virus Companys, because some malware was using that way.

This way i can not recommend it.