[QUESTION]About Bypass Programming

[likapielikapie]

Hello everybody,
I was working on xtrap bypass development. So I got some results for x64 xtrap bypassing.

I learnt that bypassing in x64 systems has 2 steps:
1-Terminate K32EnumProcesses in kernel32 (I can make it)
2-Change the name of "X6va016" service to "X6va01"

I need help for making the second step. How can I find the address of this service ? Or it has an other way ?

Thanks~

[SilverEmerald]

Use Cheat Engine to find X6va016's addy.

For 32 bit, you have to show xtrap that you're using 64 bit OS.

[Omdi]

You have to disable the memory detection as well

[K1ramoX]

isn't that hard or?

edit:

look at 40546390. you dont need to change the string:

push    0               ; _DWORD
push    80h             ; _DWORD
push    3               ; _DWORD
push    0               ; _DWORD
push    0               ; _DWORD
push    0C0000000h      ; _DWORD
push    offset a_X6va016 ; "\\\\.\\X6va016"
mov     [edi+0Ch], eax
call    dword_406448E0
cmp     eax, 0FFFFFFFFh
jnz     short loc_405463FA

just edit the code here. there is also the load of the second driver:

mov     edx, [esi]
push    edi
push    offset a_Xdva407 ; "\\\\.\\XDva407"
mov     ecx, esi
call    dword ptr [edx+60h]

just sayin

[onahoe]

Originally Posted by K1ramoX

you dont need to change the string:

but its easier ;o
---------------------

: Just look into ProcessHacker -> Services


u see the running driver (X6va017) << you have to search this string in cheatengine. you'll probably find 3/4 statics:



~this is done for microvolts, in s4 its the same.. (idk the current driver name ;O)

[likapielikapie]

Originally Posted by onomato

but its easier ;o
---------------------

: Just look into ProcessHacker -> Services


u see the running driver (X6va017) << you have to search this string in cheatengine. you'll probably find 3/4 statics:



~this is done for microvolts, in s4 its the same.. (idk the current driver name ;O)

By this way, X6va017 service will be still running. Doesn't it makes problem ?

[Forbidi]

Just search in memory x6va016 as string that's not that hard, maybe learn how to bypass memory scan after that ?

[onahoe]

Originally Posted by likapielikapie

By this way, X6va017 service will be still running. Doesn't it makes problem ?

No ;o Change it to X6va111 or something idk ^.^

[likapielikapie]

Originally Posted by onomato

No ;o Change it to X6va111 or something idk ^.^

When I do it, XTrap says "A program is effecting game client"
Help bro

[Slicktor]

 Spoiler

Originally Posted by likapielikapie

When I do it, XTrap says "A program is effecting game client"
Help bro

Scroll up.

 Spoiler

Originally Posted by K1ramoX

isn't that hard or?

edit:

look at 40546390. you dont need to change the string:

push    0               ; _DWORD
push    80h             ; _DWORD
push    3               ; _DWORD
push    0               ; _DWORD
push    0               ; _DWORD
push    0C0000000h      ; _DWORD
push    offset a_X6va016 ; "\\\\.\\X6va016"
mov     [edi+0Ch], eax
call    dword_406448E0
cmp     eax, 0FFFFFFFFh
jnz     short loc_405463FA

just edit the code here. there is also the load of the second driver:

mov     edx, [esi]
push    edi
push    offset a_Xdva407 ; "\\\\.\\XDva407"
mov     ecx, esi
call    dword ptr [edx+60h]

just sayin

(SC_HANDLE,LPCSTR lpServiceName,DWORD);
ERROR_INVALID_NAME
(LPCTSTR,LPCTSTR,DWORD dwDesiredAccess)
ERROR_ACCESS_DENIED

There are many methods to bypass the 64-bit driver :P

[bangjons]

Originally Posted by Slicktor

Scroll up.

 Spoiler

(SC_HANDLE,LPCSTR lpServiceName,DWORD);
ERROR_INVALID_NAME
(LPCTSTR,LPCTSTR,DWORD dwDesiredAccess)
ERROR_ACCESS_DENIED

There are many methods to bypass the 64-bit driver :P

Give me bro

[Forbidi]

Originally Posted by likapielikapie

When I do it, XTrap says "A program is effecting game client"
Help bro

You do it with wich language ?

[likapielikapie]

Originally Posted by Forbidi

You do it with wich language ?

Trying with AutoIT

[Hybrid~]

Originally Posted by likapielikapie

Trying with AutoIT

omg. Screw AutoIt.
Learn C++ Basics and code it in C++ ffs.
AutoIT is good for basic and easy ****.

[Forbidi]

Originally Posted by Hybrid~

omg. Screw AutoIt.
Learn C++ Basics and code it in C++ ffs.
AutoIT is good for basic and easy ****.

So this is a **** ?