Bypass

[Synns]

Thanks to:

Croner <- his orig, ported to CA hs.
BigBoy <- nanoscans.

DWORD Protect;
void MEMCPY(void *adr, void *ptr, int size)
{
	VirtualProtect(adr,size,PAGE_EXECUTE_READWRITE, &Protect);
	memcpy(adr,ptr,size);
	VirtualProtect(adr,size,OldProtection, &Protect);
}


void MCPY( void )
{
	for(;;)
	{
		DWORD EhSvc = (DWORD)GetModuleHandle("EhSvc.dll");
		if( EhSvc != NULL )
		{
			MEMCPY((void *)(EhSvc+0x5A74F), (void*)(PBYTE)"\xB8\x01\x00\x00\x00\xC3", 6);
			MEMCPY((void *)(EhSvc+0x1CC0C), (void *)(PBYTE)"\x90\x90", 2);
			MEMCPY((void *)(EhSvc+0x2541F), (void *)(PBYTE)"\x31", 1); 
			MEMCPY((void *)(EhSvc+0x27BFE), (void *)(PBYTE)"\x31", 1);
			MEMCPY((void *)(EhSvc+0x63663), (void *)(PBYTE)"\xEB", 1);
		    MEMCPY((void *)(EhSvc+0x636F9), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x251DB), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x25325), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x2541F), (void *)(PBYTE)"\x31", 1);
			MEMCPY((void *)(EhSvc+0x23616), (void *)(PBYTE)"\x31", 1);
			MEMCPY((void *)(EhSvc+0x27321), (void *)(PBYTE)"\x31", 1);
			MEMCPY((void *)(EhSvc+0x26708), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x26817), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x26C60), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x68ECD), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x68EF7), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x2990A), (void *)(PBYTE)"\x90\x90", 2);
			MEMCPY((void *)(EhSvc+0x27321), (void *)(PBYTE)"\x31", 1);
			MEMCPY((void *)(EhSvc+0x6A902), (void *)(PBYTE)"\xEB", 1);
			MEMCPY((void *)(EhSvc+0x6A667), (void *)(PBYTE)"\xEB", 1);
		}
	}
}

In DLLMain

CreateThread( NULL, NULL, ( LPTHREAD_START_ROUTINE )MCPY, NULL, NULL, NULL );

I'm tired of getting private messages asking for stuff. CA is boring, make a menu hack, chams idc. I'm tired of all the noobs who are ungrateful and think just because CA is down for maintenance a hack is patched. If CShell.dll doesn't update and EhSvc.dll doesn't update then it isn't patched god damn it.