Results 1 to 6 of 6
  1. #1
    BadBurrito's Avatar
    Join Date
    Jan 2012
    Gender
    male
    Posts
    32
    Reputation
    21
    Thanks
    225

    Cool memory check bypass !!!

    Hey so I am playing ca eu and today I was looking for the memory checks they do since a few patches ago... soooo the are NOT in EHSvc.dll as I read in some posts, they are located in the CShell.dll, its quite easy to find... the following source is working for CA EU only but it should be easy to understand what it does... the end of the function where the bytes are checked is hooked and some values are changed in the registers (eax, ecx and edi) I am not sure if you are needing all of these registers but it is working have fun

    And yeah it is written in nasm because in my opinion hooking is easier and when you are using c++ most of the parts are asm too so there is no big difference...

    Code:
    %include 'C:\Programme\asm\inc\nasmx.inc'
    
    IMPORT VirtualProtect, 16
    IMPORT CreateThread, 24
    IMPORT GetModuleHandleA, 4
    
    extern Sleep
    
    entry	DllEntry
    
    [section .text]
    
    checkhook:
    mov eax, 0x1
    mov ecx, 0x1
    mov edi, 0x5
    add esp, 4
    jmp [memhookback]
    
    
    
    proc attachmem
    locals none
    	mov eax, 0x379C21D0	
    	mov dword [memhookback], eax
    	add dword [memhookback], 6
    
    	invoke VirtualProtect, 0x379C21D0, 10, 40h, oldprotect
    
    	mov ecx, 0x379C21D0
    	mov byte [ecx], 0xE9	
    	mov eax, checkhook
    	sub eax, 0x379C21D0
    	sub eax, 5
    	mov dword [ecx+1], eax
    
    endproc
    
    
    proc getmodule
    locals none
    
    	loopcshell:
    	push 100
    	call Sleep
    	invoke GetModuleHandleA, szCshell
    	cmp eax, 0
    	je loopcshell
    
    invoke	CreateThread, 0, 0, attachmem, 0, 0, 0
    endproc
    
    
    
    proc   DllEntry, ptrdiff_t hinst, size_t reason, size_t reserved
    locals none
    	mov	ecx, 1
    	cmp	[ebp+0Ch], ecx 
    	jne	goon
    	invoke	CreateThread, 0, 0, getmodule, 0, 0, 0
    	goon:
    	mov	eax, 1
    endproc
    
    
    
    
    [section .data]
    
        szCshell:    declare(NASMX_TCHAR) NASMX_TEXT('CShell.dll'), 0x0
    
    
    [section .bss]
    	
    	modulecshell : resd 2
    	memhookback : resd 2
    	oldprotect : resd 2

  2. The Following 2 Users Say Thank You to BadBurrito For This Useful Post:

    Ch40zz-C0d3r (10-20-2012),[MPGH]Flengo (10-19-2012)

  3. #2
    nigger's Avatar
    Join Date
    Nov 2009
    Gender
    male
    Posts
    224
    Reputation
    36
    Thanks
    89
    Too bad half the section doesn't even know assembly. You and Schim are the only people I know that post things in assembly. You sir have my respect.

  4. #3
    CoderNever's Avatar
    Join Date
    Feb 2009
    Gender
    female
    Location
    http://mpgh.net MPGHCash: $700,458,011
    Posts
    1,196
    Reputation
    131
    Thanks
    2,233
    My Mood
    Buzzed
    Lol, If you don't know any ASM and you are in the combat arms source code section it is almost implied that you're a leacher...
    I Apologize for my latest release "CN Hack 7-11-11" I assure you it is not up to "CN Standard", and I feel bad due to all its flaws. I'm working hard, and steadily to remake it for I can bring everyone a hack they will really like!


    Support NSY Inject

    CoderNever
    GameArena
    _Fk127_
    ViSiON
    -Lunar_
    Bubbles Kittys

    Code:
    ¢N Mike says
    Cyber Bulling is bad
    J Whit says
    Yea bob wants to fuck my pussy
    ¢N Mike says
    Whit
    dont be a cyber bully
    J Whit says
    FUCK YOU
    ¢N Mike says
    Words hurt
    ѱ NOOB says
    whit gets bullied in school so he goes online and bullies kids online
    J Whit says
    DUH
    Stress relieve
    relieving
    The kintergarden kids beat my ass
    ¢N Mike says
    Thats just sad

  5. The Following 2 Users Say Thank You to CoderNever For This Useful Post:

    [MPGH]Flengo (10-20-2012),nigger (10-20-2012)

  6. #4
    nigger's Avatar
    Join Date
    Nov 2009
    Gender
    male
    Posts
    224
    Reputation
    36
    Thanks
    89
    Quote Originally Posted by CoderNever View Post
    Lol, If you don't know any ASM and you are in the combat arms source code section it is almost implied that you're a leacher...
    You just summed up this section.

  7. #5
    Ch40zz-C0d3r's Avatar
    Join Date
    Apr 2011
    Gender
    male
    Posts
    839
    Reputation
    44
    Thanks
    400
    My Mood
    Twisted
    My question is:
    Why you not simply hooked here?
    Code:
    379C218F   /.  55                            PUSH EBP
    ANd never call the original one?

    Progress with my game - "Disbanded"
    • Fixed FPS lag on spawning entities due to the ent_preload buffer!
    • Edit the AI code to get some better pathfinding
    • Fixed the view bug within the sniper scope view. The mirror entity is invisible now!
    • Added a new silencer for ALL weapons. Also fixed the rotation bugs
    • Added a ton of new weapons and the choice to choose a silencer for every weapon
    • Created a simple AntiCheat, noobs will cry like hell xD
    • The name will be Disbanded, the alpha starts on the 18th august 2014



    Some new physics fun (Serversided, works on every client)



    My new AI
    http://www.youtube.com/watch?v=EMSB1GbBVl8

    And for sure my 8 months old gameplay with 2 friends
    http://www.youtube.com/watch?v=Na2kUdu4d_k

  8. #6
    //\\//etwork3r's Avatar
    Join Date
    May 2012
    Gender
    male
    Posts
    141
    Reputation
    48
    Thanks
    310
    My Mood
    Psychedelic
    Good job im just waiting to sombody relase hack with this function Revarse life taker will back hi hi ^^

Similar Threads

  1. [Release] File Check Bypass (maybe)
    By Qix in forum Continent of the Ninth (C9) Hacks / Bots
    Replies: 14
    Last Post: 01-13-2013, 10:26 PM
  2. [Help] Steam check bypass?
    By naimc in forum Call of Duty Modern Warfare 3 Private Server Hacks
    Replies: 8
    Last Post: 08-19-2012, 09:58 AM
  3. [Preview] Black Lung Map Check Bypass Rez Zombie Spawn location rez OPK
    By supercarz1991 in forum Combat Arms Mod Discussion
    Replies: 18
    Last Post: 10-10-2011, 11:19 AM
  4. Bypass 1.0.182 class checking?
    By HACKINGPIE in forum Call of Duty Modern Warfare 2 Help
    Replies: 8
    Last Post: 02-08-2010, 03:12 PM
  5. [RELEASE] 2 UCEs AND 2 BYPASSES AND 2 TRAINERS, CHECK EM OUT
    By domin8666 in forum WarRock - International Hacks
    Replies: 1
    Last Post: 04-29-2007, 05:49 PM