Bypass (suspender) src

gawron25 · 10/28/2012, 22:56

Code:

#include <NomadMemory.au3>
#include <Array.au3>
#include <Memory.au3>
#include <File.au3>


Call("monster2")

Func monster2()
   
    $list1 = ProcessList()
    $msg1 = _arrayfindall($list1, "Dekaron.exe", 1, $list1[0][0])
    If @error = 6 Then
        Call("monster")
    EndIf
    For $z = 1 To 1
        $listdone1 = _arraycombinations($msg1, $z, "")
    Next
    While 1
        $list = ProcessList()
        $msg = _arrayfindall($list, "Dekaron.exe", 1, $list[0][0])
        For $i = 1 To 1
            $listdone = _arraycombinations($msg, $i, "")
        Next
        If $listdone[0] > $listdone1[0] Then
            $x = $list[$listdone[$listdone[0]]][1]
            While 1
                $handle = _memoryopen($x)
                $test = _memoryread(0x009807AE, $handle, "byte")
                If $test = 204 Then
                    _processsuspend($x)
                    _processsuspend("xxd.xem")
                    _processsuspend("x3.xem")
                    _processsuspend("xmag.xem")
                    _processsuspend("vtany.sys")
                    _memoryclose($handle)
                    Sleep(10)
                    _filewritetoline("PID.txt", 4, $x, 0)
                    MSGBOX ( 44096 , "DEKARON" , "ACTIVE HACKS THEN PRESS OK" ) 
                    _processresume($x)
                    _processresume("xxd.xem")
                    _processresume("x3.xem")
                    _processresume("xnag.xem")
                    Exit 
                EndIf
            WEnd
        EndIf
    WEnd
EndFunc

Func monster()
    While 1
       sleep(100)
        If ProcessExists("Dekaron.exe") Then
            $proces_id = ProcessExists("Dekaron.exe")
            $handle = _memoryopen($proces_id)
            $test = _memoryread(0x009807AE, $handle, "byte")
            If $test = 204 Then
                _processsuspend($proces_id)
                _processsuspend("xxd.xem")
                _processsuspend("x3.xem")
                _processsuspend("xmag.xem")
                _processsuspend("vtany.sys")
                _memoryclose($handle)
                Sleep(10)
                _filewritetoline("PID.txt", 4, $proces_id, 0)
                MSGBOX ( 44096 , "DEKARON" , "ACTIVE HACKS THEN PRESS OK" ) 
                _processresume($proces_id)
                _processresume("xxd.xem")
                _processresume("x3.xem")
                _processresume("xnag.xem")
                Exit 
            EndIf
        EndIf
    WEnd
EndFunc

Func _memorywritemod($adress, $handle, $data)
    $count = StringSplit($data, " ")
    For $i = 0 To Binary($count[0] - 1) Step 1
        $hexcount = "0x" & $count[$i + 1]
        _memorywrite($adress + $i, $handle, Binary($hexcount), "byte")
    Next
EndFunc

Func _processsuspend($processid)
    If $processid Then
        $ai_handle = DllCall("kernel32.dll", "int", "OpenProcess", "int", 2035711, "int", False, "int", $processid)
        $i_sucess = DllCall("ntdll.dll", "int", "NtSuspendProcess", "int", $ai_handle[0])
        DllCall("kernel32.dll", "ptr", "CloseHandle", "ptr", $ai_handle)
        If IsArray($i_sucess) Then
            Return 1
        Else
            SetError(1)
            Return 0
        EndIf
    Else
        SetError(2)
        Return 0
    EndIf
EndFunc

Func _processresume($processid)
    If $processid Then
        $ai_handle = DllCall("kernel32.dll", "int", "OpenProcess", "int", 2035711, "int", False, "int", $processid)
        $i_sucess = DllCall("ntdll.dll", "int", "NtResumeProcess", "int", $ai_handle[0])
        DllCall("kernel32.dll", "ptr", "CloseHandle", "ptr", $ai_handle)
        If IsArray($i_sucess) Then
            Return 1
        Else
            SetError(1)
            Return 0
        EndIf
    Else
        SetError(2)
        Return 0
    EndIf
EndFunc

Flaws · 10/29/2012, 00:13

Sorry for not having any brain.exe about this one. Is this something like process suspender/hacker? Or should it be inserted in CE? Cause I'm having a problem with my process suspender, when i am trying to suspend dekaron.exe and xigncode.exe, it always says that the program is unable to suspend.

Thanks

gawron25 · 10/29/2012, 00:35

Depending on which method you use, when you want to suspend applications, if you do it too late and xigncode turns on (which loads the DLL causing block exe) you can't do anything.

redplague · 10/29/2012, 02:15

what program is used to make this script?

gawron25 · 10/29/2012, 02:29

AutoIt

roma089 · 10/29/2012, 12:08

Hey,
How to use this script?

Naniooooo · 10/29/2012, 12:39

maybe use auto it ?

roma089 · 10/29/2012, 16:15

Quote:

Originally Posted by Naniooooo

maybe use auto it ?

I have searched for it and couldn't find it, is there a link?

b0n3z · 10/29/2012, 22:13

Quote:

Originally Posted by roma089

I have searched for it and couldn't find it, is there a link?

guesswho-.- · 10/29/2012, 22:15

Quote:

Originally Posted by roma089

I have searched for it and couldn't find it, is there a link?

you clearly havent searched at all.

Brutalon · 10/30/2012, 15:44

Suspending **** is still working O.o

0wnU · 10/30/2012, 18:02

yep

good stuff

nemesisysf · 10/30/2012, 18:49

no we need new scripts...

roma089 · 10/30/2012, 19:31

Can someone explain how to get it work/ how to use it?

guesswho-.- · 10/30/2012, 19:33

of course it still works, why wouldnt it.
use autoit to run it