Quote:
Originally Posted by Cyno™
You should unlink your DLL from the Process Environment Block.
Just try it on google with "Unlink Module from PEB", because Hackshield is scanning it do detect mapped modules.
|
Hey thanks for your help but I still don't get exactly what you said.I mean that,you said that you need to (like hide the code) to be undetected by the hackshield but I don't know how to do that or what to add to the code that I already did.Any help is appreciated.On google I found information which is unrelated with a warrock hack...
Thanks
Aerrow107.
UPDATE but still the same...Found this PEB on the net:
//Coded by Aerrow107
//Welcome to a WarRock PowerLeveling Bot
//~~~~~~~~~~Functions~~~~~~~~~~//
//~~~Auto Start/Rdy [32 + 64]~~~// Ready
//~~~Auto Enter [32 + 64]~~~// Ready
//~~~Auto C4/Nipper~~~// Ready
//~~~Plant/Defuse Anywhere~~~// Ready
//~~~Quick Plant/Defuse~~~// Ready
//~~~Auto Plant/Defuse~~~// Ready
//~~~No Spawn Wait~~~// Ready
//~~~Gm Warning~~~// Ready
//~~~~~~~End of Functions~~~~~~//
#include <windows.h>
#include <stdio.h>
#define ADR_PlayerPointer 0xA5348C
#define ADR_ServerPointer 0xA5341C
#define ADR_PlantAnywhere 0xA5302E
#define ADR_DefuseAnywhere 0x91BDA4
#define ADR_NoSpawnWait 0xB9D220
#pragma message("Credits : -[---------------------------]-")
#pragma message("Credits : -[By-------(Aerrow107)--------]-")
#pragma message("Credits : -[---------------------------]-")
/* Hotkeys */
/*F9 = On */
/*F10 = Off */
// End of Hotkeys
void HideDLL(HINSTANCE hModule)
{
DWORD dwPEB_LDR_DATA = 0;
_asm
{
pushad;
pushfd;
mov eax, fs:[30h]
mov eax, [eax+0Ch]
mov dwPEB_LDR_DATA, eax
InLoadOrderModuleList:
mov esi, [eax+0Ch]
mov edx, [eax+10h]
LoopInLoadOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+18h]
cmp ecx, hModule
jne SkipA
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp InMemoryOrderModuleList
SkipA:
cmp edx, esi
jne LoopInLoadOrderModuleList
InMemoryOrderModuleList:
mov eax, dwPEB_LDR_DATA
mov esi, [eax+14h]
mov edx, [eax+18h]
LoopInMemoryOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+10h]
cmp ecx, hModule
jne SkipB
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp InInitializationOrderModuleList
SkipB:
cmp edx, esi
jne LoopInMemoryOrderModuleList
InInitializationOrderModuleList:
mov eax, dwPEB_LDR_DATA
mov esi, [eax+1Ch]
mov edx, [eax+20h]
LoopInInitializationOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+08h]
cmp ecx, hModule
jne SkipC
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp Finished
SkipC:
cmp edx, esi
jne LoopInInitializationOrderModuleList
Finished:
popfd;
popad;
}
}
//-----------------------------------------------------------------------------
// Name: Defines()
//-----------------------------------------------------------------------------
int RL_DefuseAnyWhere = 0; // 1 = AutoOn / 0 = Off
int RL_PlantAnyWhere = 0; // 1 = AutoOn / 0 = Off
int RL_NoSpawnWait = 0; // 1 = AutoOn / 0 = Off
//~~~~~~~~~~~~~~~~Hack Start~~~~~~~~~~~~~~~~
void PlayerAndServer() // My Thread that i will add hacks on
{
DWORD dwPlayerPointer = *(DWORD*) ADR_PlayerPointer ; // Define DwPlayerPointer = Bla bla bla
DWORD dwServerPointer = *(DWORD*) ADR_ServerPointer ; // Definde dwServerPoint = Bla bla bla
if(dwPlayerPointer && dwServerPointer !=0)
{
if(GetAsyncKeyState(VK_F9)&1) //On Hotkey
{
RL_PlantAnyWhere = 1;
RL_DefuseAnyWhere = 1;
RL_NoSpawnWait = 1;
}
if(GetAsyncKeyState(VK_F10)&1) //Off Hotkey
{
RL_PlantAnyWhere = 0;
RL_DefuseAnyWhere = 0;
RL_NoSpawnWait = 0;
}
if(RL_PlantAnyWhere == 1) //Plant Anywhere
{
*(BYTE*)(ADR_PlantAnywhere) = 0x1;
}
if(RL_DefuseAnyWhere == 1) //Defuse Anywhere
{
*(WORD*)(ADR_DefuseAnywhere) = 1;
}
if(RL_NoSpawnWait == 1) //No Spawn
{
*(int*)(ADR_NoSpawnWait) = 0;
}
}
}
//~~~~~~~~~~~~~~~~~~~~~~~~~Hack Ends~~~~~~~~~~~~~~~~~~~~~~~~~~~//
//-------------------------HackThread--------------------------//
DWORD __stdcall HacksLoading(LPVOID param)
{
while (1)
{
PlayerAndServer();
Sleep(100);
}
}
//--------------------------End HackThread---------------------//
//--------------------------End-------------------------------//
BOOL WINAPI DllMain(HMODULE hDll, DWORD dwReason, LPVOID lpReserved)
{
DisableThreadLibraryCalls(hDll);
if (dwReason == DLL_PROCESS_ATTACH)
{
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)HacksLoading , NULL, NULL, NULL);
}
return TRUE;
}
//--------------------------End------------------------------//
