I've taken a quick look to kill some time.
"CoServer.dll" is protected by themida 3.xx I unpacked it with:
[Only registered and activated users can see links. Click Here To Register...]
Opened it in IDA freeware..
With my limited knowledge in reverse engineering i've found that their anti cheat measures all result in Function 6660B430 being called.
Quote:
BOOL terminateCurrentProcess()
{
if (hasHardwareBreakpoints())
__debugbreak();
HANDLE currentProcess = GetCurrentProcess();
return TerminateProcess(currentProcess, 0);
}
|
If you want to bypass it you can start from here and work your way back.
-Edit (BTW i would suggest to only work on this in a VM)
CoServer.dll
- Log keystrokes via application hook
- Enumerate gui resources
- Get session user name
- Enumerate processes
- Enumerate process modules
- Enumerate threads
- Check OS version
- Get disk information
- Get MAC address on Windows
- Get file size