First one. (# 1)
Version 1, a simple gm detect + tele to 0:0
Code:
[ENABLE]
alloc(DetectGM,512)
label(ReturnName)
label(PassCheck)
label(Tele)
label(Elusive)
registersymbol(DetectGM)
DetectGM:
cmp [eax+70],5D4D475B
jnz PassCheck
push ebx
mov ebx,Elusive
mov byte ptr [ebx],B9
mov dword ptr [ebx+1],Tele
mov dword ptr [ebx+5],5B90E1FF
pop ebx
PassCheck:
mov [esi+0c],00000000
jmp ReturnName
Tele:
push ebx
mov [eax],0
mov [eax+4],0
mov dword ptr [esp+20],0
mov ebx,Elusive
add ebx,8
jmp ebx
[COLOR="Red"]00553F63[/COLOR]: //Update: C7 46 0C 00 00 00 00 89 47 04
jmp DetectGM
nop
nop
ReturnName:
[COLOR="Red"]00603E3B[/COLOR]: //Update: 8B 08 8B 50 04 89 4C 24 20
Elusive:
[DISABLE]
dealloc(DetectGM)
unregistersymbol(DetectGM)
[COLOR="Red"]00553F63[/COLOR]: //Update: C7 46 0C 00 00 00 00 89 47 04
mov [esi+0c],00000000
[COLOR="Red"]00603E3B[/COLOR]: //Update: 8B 08 8B 50 04 89 4C 24 20
mov ecx,[eax]
mov edx,[eax+04]
mov dword ptr [esp+20],ecx
Update all the offsets in RED