[Release] XTrap Bypass

[michox]

doesnt work after maintance

[D3v1n3r]

Originally Posted by michox

doesnt work after maintance

After little patch today it works for me already perfectly (CE)

[michox]

Ok now it works ty

[DeDeXuke]

With WPE PRO its doesnt work. win7 x64

[rizkopf]

work win 7 64x bit nice work!

[cheyester10]

So the user that coded this... There first name it seems to appear to be.... Kezi?



Look at it, you will understand.

[Akius]

Originally Posted by cheyester10

So the user that coded this... There first name it seems to appear to be.... Kezi?



Look at it, you will understand.

It's just the user name ...

[Kishgal]

Welp. Happened with the DLL just being injected on a freshly made account.

Originally Posted by cheyester10

So the user that coded this... There first name it seems to appear to be.... Kezi?
Look at it, you will understand.

That's gotta be the shittiest way to try and brag about decompiling this.

[cheyester10]

I actually didn't decompile it, ever thought that you can view something that's injected into memory? Inject it into S4, go to the region of the .DLL and view it and viola.(It was injected into S4 when I was viewing that way.) I'm learning reverse engineering, so why not try more? Just something I can do.

[PlayerOne10]

Win7 Home Premium 64-Bit doesen't work or i must do something?

[Amazin_]

Slicktor ! It work's fine on Win8

Gj and Thanks

[MadOtaku]

Originally Posted by Slicktor

works only on 64 bit!
don't work on win8!

Have fun

You said doesn't work on Windows 8 but it works perfectly .
Praise Slicktor-sama

[REDAPRO]

when i make it then open s4 it closes at the moment then nothing apears i need answer please iam win 7 64 bit

Originally Posted by cheyester10

So the user that coded this... There first name it seems to appear to be.... Kezi?



Look at it, you will understand.

this not apear to me i open the byppass then s4 then at the moment haack close then i dont see any thing apear of this please answer me iam win 7 64 bit please please

[cheyester10]

Originally Posted by REDAPRO

when i make it then open s4 it closes at the moment then nothing apears i need answer please iam win 7 64 bit



this not apear to me i open the byppass then s4 then at the moment haack close then i dont see any thing apear of this please answer me iam win 7 64 bit please please

That is not supposed to appear when you inject the bypass. Xtrap Bypass only makes memory detection and other things from xtrap useless(mainly process detection). I was just viewing the .DLL when it was injected in S4. Kind of useless but yea.

int BYPASS::ProcessDetection();
int BYPASS::Driver64();
};



int BYPASS::ProcessDetection()
{
    
    DWORD K32EnumAddr = (DWORD)GetProcAddress(LoadLibraryA("Kernel32.dll"),"K32EnumProcesses");
    DWORD EnumAddr = (DWORD)GetProcAddress(LoadLibraryA("Psapi.dll"),"EnumProcesses");
    DWORD old;
    VirtualProtect((LPVOID)K32EnumAddr,sizeof(K32EnumAddr),PAGE_EXECUTE_READWRITE,&old);
    VirtualProtect((LPVOID)EnumAddr,sizeof(EnumAddr),PAGE_EXECUTE_READWRITE,&old);
    memcpy((LPVOID)K32EnumAddr,(LPVOID)"\xC2\x0C\x00",3);
    memcpy((LPVOID)EnumAddr,(LPVOID)"\xC2\x0C\x00",3);
    return 0;
}




int BYPASS::Driver64()
{
    wmemcpy((wchar_t*)0x4055DEF4,(const wchar_t*)"X6va01",6);
    return 0;
}

Not mine either, but that still is the main point of a 64 bit method.

HGWC is the similiar idea but disabling bans from using hacks when logging in with other stuff. Just simply to get rid of HGWC functions that deal with what is normally does such as..

int HGWC::FileDetection(int);
int HGWC::KeepAlive(int);
int HGWC::Bann(int);
int HGWC::Thread(int);

Not mine either. No method is shown there how it does it. It's just creating the possibly to do it.

[Dark Ghost]

 Spoiler

Originally Posted by Slicktor

Yo, today i want to release my xcrap bypass.
a >><< can be found here



[Screen]

 Spoiler

[How to?]

-Download and unpack the zip-archive
-Start "Injector.exe" as administrator
-Start S4League

[Main-Functions]

-process detection
-64 bit driver bypass

[Download & VT]

You can download it by clicking the attachment.
VT - Bypass.dll:
VT - Injector:

src:

 Spoiler

main.cpp

PHP Code:

#include "Bypass.h"

DWORD WINAPI InitializeXTrapBypass() { 

    DWORD nBase;
    while(1)
    {
        
        nBase = (DWORD)GetModuleHandleA("XTrapVa.dll");

        if(nBase){
        Sleep(500);
        BYPASS bypass;
        bypass.Driver64();
        bypass.ProcessDetection();
        break;
        }

    }
    return 0;

}

BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
    DisableThreadLibraryCalls(hDll);
    if( dwReason == DLL_PROCESS_ATTACH)

    {

          _beginthread((void(*)(void*))InitializeXTrapBypass,sizeof(&InitializeXTrapBypass),0);
    }
    
    
    return TRUE;
} 


Bypass.h

PHP Code:

#include <Windows.h>
#include <tlhelp32.h>
#include <process.h> 
#include <wchar.h>





class BYPASS
{

public:
int BYPASS::ProcessDetection();
int BYPASS::Driver64();
};



int BYPASS::ProcessDetection()
{
    
    DWORD K32EnumAddr = (DWORD)GetProcAddress(LoadLibraryA("Kernel32.dll"),"K32EnumProcesses");
    DWORD EnumAddr = (DWORD)GetProcAddress(LoadLibraryA("Psapi.dll"),"EnumProcesses");
    DWORD old;
    VirtualProtect((LPVOID)K32EnumAddr,sizeof(K32EnumAddr),PAGE_EXECUTE_READWRITE,&old);
    VirtualProtect((LPVOID)EnumAddr,sizeof(EnumAddr),PAGE_EXECUTE_READWRITE,&old);
    memcpy((LPVOID)K32EnumAddr,(LPVOID)"\xC2\x0C\x00",3);
    memcpy((LPVOID)EnumAddr,(LPVOID)"\xC2\x0C\x00",3);
    return 0;
}




int BYPASS::Driver64()
{
    wmemcpy((wchar_t*)0x4055DEF4,(const wchar_t*)"X6va01",6);
    return 0;
} 


works only on 64 bit!
don't work on win8!

Have fun

Still work thanks