#include <windows.h>
#include <stdio.h>
#define LTClientEXE 0x48B6B0
#define GameStatus 0x37839E54
#define HShieldBypass_1 0x0000A048
#define HShieldBypass_2 0x0009A8C2
#define HShieldBypass_3 0x0007B7A0
#define HShieldBypass_4 0x00009FB0
#define HShieldBypass_5 0x0003CF8E
#define HShieldBypass_6 0x0003A39F
#define HShieldBypass_7 0x0003C446
#define HShieldBypass_8 0x0003D004
INT EditMemory(VOID *lpMem, VOID *lpSrc, size_t len)
{
DWORD flNewProtect = PAGE_READWRITE, lpflOldProtect;
unsigned char *pDst = (unsigned char *)lpMem, *pSrc = (unsigned char *)lpSrc;
if(VirtualProtect(lpMem, len, flNewProtect, &lpflOldProtect))
{
while(len-- > 0) *pDst++ = *pSrc++;
return 0;
}
return 1;
}
DWORD WINAPI BypassThread(LPVOID)
{
DWORD dwEhSvc = 0;
do
{
Sleep(100);
dwEhSvc = (DWORD)GetModuleHandleA("EhSvc.dll");
} while(!dwEhSvc);
BYTE HSB1[1] = {0x74};
BYTE HSB2[1] = {0xD2};
BYTE HSB3[3] = {0xC2, 0x04, 0x00};
BYTE HSB4[1] = {0x31};
BYTE HSB5[2] = {0x90, 0x90};
EditMemory((PVOID)(dwEhSvc + HShieldBypass_1), (PVOID)"\x74", 1);
EditMemory((PVOID)(dwEhSvc + HShieldBypass_2), (PVOID)"\xD2", 1);
EditMemory((PVOID)(dwEhSvc + HShieldBypass_3), (PVOID)"\xC2\x04\x00", 3);
EditMemory((PVOID)(dwEhSvc + HShieldBypass_4), (PVOID)"\xC2\x04\x00", 3);
EditMemory((PVOID)(dwEhSvc + HShieldBypass_5), (PVOID)"\x31", 1);
EditMemory((PVOID)(dwEhSvc + HShieldBypass_6), (PVOID)"\x31", 1);
EditMemory((PVOID)(dwEhSvc + HShieldBypass_7), (PVOID)"\x31", 1);
EditMemory((PVOID)(dwEhSvc + HShieldBypass_8), (PVOID)"\x90\x90", 2);
return NULL;
}
void _stdcall SetConsoleVariable(const char* Command)
{
__asm
{
push Command
mov eax, 0x485FF0
call eax
}
}
BOOL IsGameReadyForHook(void)
{
if(GetModuleHandleA("d3d9.dll") != NULL
&& GetModuleHandleA("ClientFX.fxd") != NULL
&& GetModuleHandleA("CShell.dll") != NULL)
return true;
return false;
}
void main()
{
while(true)
{
SetConsoleVariable("SkelModelStencil 1");
}
}
DWORD WINAPI HackThread(LPVOID)
{
while( !IsGameReadyForHook() )
Sleep(100);
main();
return 0;
}
BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
DisableThreadLibraryCalls(hDll);
if ( dwReason == DLL_PROCESS_ATTACH )
{
CreateThread(NULL, NULL, HackThread, NULL, NULL, NULL);
}
return TRUE;
}