XIGNCODE - Driver Bypass

[iMostLiked]

Since there weren't much releases in last time I decided to post my driver bypass for xigncode. If you use this and an undetected memory scanner like CrySearch, you'll be able to scan wolfteam's memory without any problems. Cheat Engine doesn't work, if you want to use this with Cheat Engine, you have to download , change a lot and compile it.

Note: This doesn't bypass the whole xigncode anti cheat system and you'll not be able to call d3d9 functions. It's only memory based. It does bypass Heartbeat. You won't get kicked after 5 minutes.

C++

bool DriverBypass(int pID) 
{
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pID);
	if (!hProcess) {
		return false;
	}

	HMODULE hMod = LoadLibrary("advapi32.dll");
	if (!hMod) {
		return false;
	}

	LPVOID dwSSA = (LPVOID)GetProcAddress(hMod, "StartServiceA");
	LPVOID dwOSW = (LPVOID)GetProcAddress(hMod, "OpenServiceW");
	if (!dwSSA || !dwOSW) {
		return false;
	}

	byte wByte[] = { 0xC2, 0x0C, 0x00 };
	if (!WriteProcessMemory(hProcess, dwSSA, &wByte, sizeof(wByte), NULL)) {
		return false;
	}
	if (!WriteProcessMemory(hProcess, dwOSW, &wByte, sizeof(wByte), NULL)) {
		return false;
	}

	return true;
}

// int pID = process id of "Wolfteam.bin"

Please don't ask me how to include this in your hack. I finished coding hacks for wolfteam 2 years ago, it's only a method I want to share with you. It does also work for other games that use xigncode.

-----

For the lazy ones:

Download: See attachment
VirusTotal:

Instructions:
1.) Start "drvbp.exe" as admin
2.) Start Wolfteam
3.) Wait until the window shows "Bypassed", like this:




4.) Enjoy

[PavexDesigns]

awesome work

thanks bro

[killzone]

Any way to update this to work with different binary, per se Blade & Soul?

[iMostLiked]

Originally Posted by killzone

Any way to update this to work with different binary, per se Blade & Soul?

I've posted the method I use above.

Originally Posted by iMostLiked

C++

bool DriverBypass(int pID) 
{
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pID);
	if (!hProcess) {
		return false;
	}

	HMODULE hMod = LoadLibrary("advapi32.dll");
	if (!hMod) {
		return false;
	}

	LPVOID dwSSA = (LPVOID)GetProcAddress(hMod, "StartServiceA");
	LPVOID dwOSW = (LPVOID)GetProcAddress(hMod, "OpenServiceW");
	if (!dwSSA || !dwOSW) {
		return false;
	}

	byte wByte[] = { 0xC2, 0x0C, 0x00 };
	if (!WriteProcessMemory(hProcess, dwSSA, &wByte, sizeof(wByte), NULL)) {
		return false;
	}
	if (!WriteProcessMemory(hProcess, dwOSW, &wByte, sizeof(wByte), NULL)) {
		return false;
	}

	return true;
}

// int pID = process id of "Wolfteam.bin"

There's no guarantee that this will work for all games using xigncode, but I think it should.

[sakiriye]

Can u share source code of drvbp.exe ?

[iMostLiked]

Originally Posted by sakiriye

Can u share source code of drvbp.exe ?

No, I posted 90% of the source already above.

Originally Posted by iMostLiked

C++

bool DriverBypass(int pID) 
{
	HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pID);
	if (!hProcess) {
		return false;
	}

	HMODULE hMod = LoadLibrary("advapi32.dll");
	if (!hMod) {
		return false;
	}

	LPVOID dwSSA = (LPVOID)GetProcAddress(hMod, "StartServiceA");
	LPVOID dwOSW = (LPVOID)GetProcAddress(hMod, "OpenServiceW");
	if (!dwSSA || !dwOSW) {
		return false;
	}

	byte wByte[] = { 0xC2, 0x0C, 0x00 };
	if (!WriteProcessMemory(hProcess, dwSSA, &wByte, sizeof(wByte), NULL)) {
		return false;
	}
	if (!WriteProcessMemory(hProcess, dwOSW, &wByte, sizeof(wByte), NULL)) {
		return false;
	}

	return true;
}

// int pID = process id of "Wolfteam.bin"

You only have to detect the process id and you're done.. if you are going to use it for wolfteam then use the .exe I already compiled, otherwise you have to make your own thoughts.

[leftspace]

its not bypass heartbeat dude (because xhunter1.sys not have heartbeat) its just disable xhunter1.sys start thats all.

xhunter1.sys using ObRegistercallback its Block your Process & Thread Access.

[iMostLiked]

Originally Posted by leftspace

its not bypass heartbeat dude (because xhunter1.sys not have heartbeat) its just disable xhunter1.sys start thats all.

xhunter1.sys using ObRegistercallback its Block your Process & Thread Access.

Whether it bypasses heartbeat or not, the fact that you'll not be kicked after 5, 30 or even 600 minutes is true, so there's nothing disturbing you in searching through wolfteam's or other games' memory.

[yowfurry]

Seems to be detected, or? I'm getting kicked from server for using an illegal program (not x3 message, but ingame message). Using CrySearch.

[iMostLiked]

Originally Posted by yowfurry

Seems to be detected, or? I'm getting kicked from server for using an illegal program (not x3 message, but ingame message). Using CrySearch.

There's a chance that this got detected, but I don't know to 100%.
You can try doing nothing for 5 minutes, if you get kicked this is probably detected.

[__chkstk]

Originally Posted by iMostLiked

There's a chance that this got detected, but I don't know to 100%.
You can try doing nothing for 5 minutes, if you get kicked this is probably detected.

It can not break xigncode heartbeat, probably he gonna get kick after 5 minutes. But it does not make it detected. You can do a lot of **** in 5 minutes