memory check bypass !!!memory check bypass !!!
Hey so I am playing ca eu and today I was looking for the memory checks they do since a few patches ago... soooo the are NOT in EHSvc.dll as I read in some posts, they are located in the CShell.dll, its quite easy to find... the following source is working for CA EU only but it should be easy to understand what it does... the end of the function where the bytes are checked is hooked and some values are changed in the registers (eax, ecx and edi) I am not sure if you are needing all of these registers but it is working 
have fun 
And yeah it is written in nasm because in my opinion hooking is easier and when you are using c++ most of the parts are asm too so there is no big difference...
have fun And yeah it is written in nasm because in my opinion hooking is easier and when you are using c++ most of the parts are asm too so there is no big difference...
Code:
%include 'C:\Programme\asm\inc\nasmx.inc'
IMPORT VirtualProtect, 16
IMPORT CreateThread, 24
IMPORT GetModuleHandleA, 4
extern Sleep
entry DllEntry
[section .text]
checkhook:
mov eax, 0x1
mov ecx, 0x1
mov edi, 0x5
add esp, 4
jmp [memhookback]
proc attachmem
locals none
mov eax, 0x379C21D0
mov dword [memhookback], eax
add dword [memhookback], 6
invoke VirtualProtect, 0x379C21D0, 10, 40h, oldprotect
mov ecx, 0x379C21D0
mov byte [ecx], 0xE9
mov eax, checkhook
sub eax, 0x379C21D0
sub eax, 5
mov dword [ecx+1], eax
endproc
proc getmodule
locals none
loopcshell:
push 100
call Sleep
invoke GetModuleHandleA, szCshell
cmp eax, 0
je loopcshell
invoke CreateThread, 0, 0, attachmem, 0, 0, 0
endproc
proc DllEntry, ptrdiff_t hinst, size_t reason, size_t reserved
locals none
mov ecx, 1
cmp [ebp+0Ch], ecx
jne goon
invoke CreateThread, 0, 0, getmodule, 0, 0, 0
goon:
mov eax, 1
endproc
[section .data]
szCshell: declare(NASMX_TCHAR) NASMX_TEXT('CShell.dll'), 0x0
[section .bss]
modulecshell : resd 2
memhookback : resd 2
oldprotect : resd 2
Originally Posted by CoderNever
