[TUT] Create your own bypass!

[iCraziE]

EDIT :: *This method has been patched by the new "codemon6" update, and is no longer working.*

So out of sheer boredom, I decided to make this little tutorial for you guys.

Probably useless to most, but I figured I could help the little people

Anyway lets get down to it....

So we are going to start a New Project in C#, and create a Console Application.

Call it what ever you like. For this example i named mine, BluEPassv2.

Once you have started your new project, in the Solution Explorer, right click the project name and click add > Add New Item.

Select the class file, and label it : Proc.cs.. then paste in the following code.

Proc.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;

namespace BluEPassv2
{
    public class ProcessSuspender
    {
        /// <summary>
        /// Suspend or resume a process with ease.
        /// </summary>
        /// <param name="ProcessName">The name of the process.</param>
        /// <param name="SuspendOrResume">An option to suspend or resume.</param>
        public static void DoProcess(string ProcessName, SUSPEND_RESUME SuspendOrResume)
        {
            foreach (System.Diagnostics.Process Proc in System.Diagnostics.Process.GetProcessesByName(ProcessName))
            {
                foreach (System.Diagnostics.ProcessThread ProcThrd in Proc.Threads)
                {
                    if (SuspendOrResume == SUSPEND_RESUME.Suspend)
                    {
                        SuspendThread(OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)ProcThrd.Id));
                    }
                    else
                    {
                        ResumeThread(OpenThread(ThreadAccess.SUSPEND_RESUME, false, (uint)ProcThrd.Id));
                    }
                }
            }
        }

        public enum SUSPEND_RESUME { Suspend, Resume }

        #region "Imports and stuff"
        [DllImport("kernel32.dll")]
        static extern uint SuspendThread(IntPtr hThread);
        [DllImport("kernel32.dll")]
        static extern int ResumeThread(IntPtr hThread);
        [DllImport("kernel32.dll")]
        static extern IntPtr OpenThread(ThreadAccess dwDesiredAccess, bool bInheritHandle, uint dwThreadId);

        private enum ThreadAccess : int
        {
            TERMINATE = (0x0001),
            SUSPEND_RESUME = (0x0002),
            GET_CONTEXT = (0x0008),
            SET_CONTEXT = (0x0010),
            SET_INFORMATION = (0x0020),
            QUERY_INFORMATION = (0x0040),
            SET_THREAD_TOKEN = (0x0080),
            IMPERSONATE = (0x0100),
            DIRECT_IMPERSONATION = (0x0200)
        }
        #endregion
    }
}

Now, back to the solution explorer. Right click Refrences > Add > New Refrence.

Click the .NET tab, and scroll down to Windows.System.Forms

Choose that file and hit OK.

This will allow us to use the 'MessageBox'.

Next, go into your Program.cs and replace the code with the following:

Program.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Windows.Forms;

namespace BluEPassv2
{
    class Program
    {
        static void Main(string[] args)
        {
            Console.Title = "BluE-Pass v2";
            MessageBox.Show("Please press 'Thanks' on epvp, if you enjoy my release.");
            ConsoleKeyInfo cki;
            Console.WriteLine("Welcome!");
            Console.WriteLine("");
            Console.WriteLine("The system is ready to suspend Dekaron. Press any key to continue....");
            Console.ReadKey();
            Console.Clear();

            #region Bypass
            ProcessSuspender.DoProcess("dekaron", ProcessSuspender.SUSPEND_RESUME.Suspend);
            ProcessSuspender.DoProcess("xxd.xem", ProcessSuspender.SUSPEND_RESUME.Suspend);
            ProcessSuspender.DoProcess("xsherlock.xem", ProcessSuspender.SUSPEND_RESUME.Suspend);
            ProcessSuspender.DoProcess("x3.xem", ProcessSuspender.SUSPEND_RESUME.Suspend);
            ProcessSuspender.DoProcess("xmag.xem", ProcessSuspender.SUSPEND_RESUME.Suspend);
            ProcessSuspender.DoProcess("vtany.sys", ProcessSuspender.SUSPEND_RESUME.Suspend);
            MessageBox.Show("Please load your hacks now. Press 'OK' when you are finished", "Completed!");
            ProcessSuspender.DoProcess("dekaron", ProcessSuspender.SUSPEND_RESUME.Resume);
            ProcessSuspender.DoProcess("xxd.xem", ProcessSuspender.SUSPEND_RESUME.Resume);
            ProcessSuspender.DoProcess("x3.xem", ProcessSuspender.SUSPEND_RESUME.Resume);
            ProcessSuspender.DoProcess("xmag.xem", ProcessSuspender.SUSPEND_RESUME.Resume);
            ProcessSuspender.DoProcess("xsherlock.xem", ProcessSuspender.SUSPEND_RESUME.Resume);
            #endregion

            Console.WriteLine("Completed!");
            Console.WriteLine("");
            Console.WriteLine("");
            Console.WriteLine("");
            Console.WriteLine("Thank you for using BluE-Pass v2");
            Console.WriteLine("");
            Console.WriteLine("Press {ESC} to close...");
            do 
            {
                cki = Console.ReadKey();
            }
            while (cki.Key != ConsoleKey.Escape);
        }
    }
}

Now you are done! Simply go to Build, and hit Build, then maybe rebuild just because lol.

Go into your projects folder find the Project then go into (".../obj/x86/Release") and grab your new .exe from there.

*NOTES*
If you don't see the exe in the Release folder try the Debug folder.

Make sure the namespace on both .cs files are the same.

Press Thanks if I helped!

[MrWubs]

Im sorry, but what exactly are we suspending? I see dekaron process but the others I don't understand. Nice tutorial any way!

[iCraziE]

the xigncode processes. These files run when you start dekaron.. if you go your Nexon folder and go into GlobalDK/bin/xigncode/ you will see these files in there.

The main 2 files are xxd.xem and xsherlock.xem since those are the only ones that actually are shown running on the system.

But similar to other bypasses, the other files were added, such as in gawrons bypass src..

since im not an expert on xigncode i figure the extra suspended files cant hurt.

[MrWubs]

Thanks I was wondering, I currently play Dekaron Core, and tried many methods to hack it. The old CSV way (I know doesn´t work anymore...), Editing pak.d00 (data.pak) with winhex,also seems to do nothing and I was trying to use cheat engine but it seems they also have a protection program that closes CE. It says "Core Guard", but I think it's also XIGNCODE, beacuse when I was playing around with the .exe file it mentioned that.Do you know it their protection is only XIGNCODE?

[guesswho-.-]

no, core's protection is not xigncode lol.

[MrWubs]

Strange.
On my /bin/ I found xfix.exe
So I opened it with Resource Hacker:

{
BLOCK "StringFileInfo"
{
	BLOCK "041204b0"
	{
		VALUE "Comments", "XIGNCODE FIX UTILITY"
		VALUE "CompanyName", "Wellbia.com"
		VALUE "FileDescription", "XIGNCODE FIX UTILITY"
		VALUE "FileVersion", "3, 0, 0, 2"
		VALUE "InternalName", "xfix"
		VALUE "LegalCopyright", "Copyright (C) 2010 Wellbia.com Co., Ltd."
		VALUE "OriginalFilename", "xfix.exe"
		VALUE "ProductName", "XIGNCODE FIX UTILITY"
		VALUE "ProductVersion", "3, 0, 0, 1"
	}
}

BLOCK "VarFileInfo"
{
	VALUE "Translation", 0x0412 0x04B0
}
}

This may sound stupid, but isn´t this fix utility related to xigncode?

[Naniooooo]

jsut change the name of the cheat engine and u will bypass core ^^
if not work download any uce from google.bg

[lietus3]

what program can be used to compile all this?

[HellSpider]

Originally Posted by MrWubs

Thanks I was wondering, I currently play Dekaron Core, and tried many methods to hack it. The old CSV way (I know doesn´t work anymore...), Editing pak.d00 (data.pak) with winhex,also seems to do nothing and I was trying to use cheat engine but it seems they also have a protection program that closes CE. It says "Core Guard", but I think it's also XIGNCODE, beacuse when I was playing around with the .exe file it mentioned that.Do you know it their protection is only XIGNCODE?

Core uses a modified version of the anticheat I coded for my private server in 2010.

Originally Posted by MrWubs

Strange.
On my /bin/ I found xfix.exe
So I opened it with Resource Hacker:

{
BLOCK "StringFileInfo"
{
	BLOCK "041204b0"
	{
		VALUE "Comments", "XIGNCODE FIX UTILITY"
		VALUE "CompanyName", "Wellbia.com"
		VALUE "FileDescription", "XIGNCODE FIX UTILITY"
		VALUE "FileVersion", "3, 0, 0, 2"
		VALUE "InternalName", "xfix"
		VALUE "LegalCopyright", "Copyright (C) 2010 Wellbia.com Co., Ltd."
		VALUE "OriginalFilename", "xfix.exe"
		VALUE "ProductName", "XIGNCODE FIX UTILITY"
		VALUE "ProductVersion", "3, 0, 0, 1"
	}
}

BLOCK "VarFileInfo"
{
	VALUE "Translation", 0x0412 0x04B0
}
}

This may sound stupid, but isn´t this fix utility related to xigncode?

It's a fix program to sort out XignCode related persistent errors, though I think it was used only in XignCode2 (XignCode3 currently).

If someone knows better feel free to correct.

[fatnub]

soooo does this work or not???

[iCraziE]

Originally Posted by lietus3

what program can be used to compile all this?

Visual Studio

[PureEnergy3]

It works.
just thought i would add to this to make life easier

Just add

using System.Diagnostics;
using System.Threading;

at the top of program.cs

then add

while (Process.GetProcessesByName("dekaron").Length == 0)
{
Thread.Sleep(100);
}

just after #region Bypass

It makes it wait for dekaron.exe to open before trying to pause

[iCraziE]

Ah that works too. For those who want to use it before loading the game. I mainly use it when I am in the game already.

[PureEnergy3]

Originally Posted by iCraziE

Ah that works too. For those who want to use it before loading the game. I mainly use it when I am in the game already.

nope it doesn't
Noone try that it won't let your hacks inject
i think maybe it paused it too fast? tbh idk :L

and i didn't notice it worked in game. i'm so used to starting it 1st xD

[fatnub]

so it works right? anyone have an updated CE script? oO