What should I do? Can you elaborate?
"float4 main( VS_OUT input ) : SV_Target"
"{"
" float4 fake;"
" fake.a = 1.0;"
" fake.r = %f;"
" fake.g = %f;"
" fake.b = %f;"
" return fake;"
"}"
to
"float4 main( VS_OUT input ) : SV_Target"
"{"
" float4 fake;"
" fake.a = 1.0;"
" fake.b = %f;"
" fake.g = %f;"
" fake.r = %f;"
" return fake;"
"}"
use hex editor ..
or in ida
lea rcx, aStructVs_outFl ; "struct VS_OUT{ float4 Position : SV_Pos"...
mov rdi, rax
mov rsi, rcx
mov ecx, 0C0h
rep movsb
cvtss2sd xmm0, [rsp+568h+arg_20]
cvtss2sd xmm1, [rsp+568h+arg_18]
cvtss2sd xmm2, [rsp+568h+arg_10]
movsd [rsp+568h+var_548], xmm0
to
lea rcx, aStructVs_outFl ; "struct VS_OUT{ float4 Position : SV_Pos"...
mov rdi, rax
mov rsi, rcx
mov ecx, 0C0h
rep movsb
cvtss2sd xmm0, [rsp+568h+arg_10]
cvtss2sd xmm1, [rsp+568h+arg_18]
cvtss2sd xmm2, [rsp+568h+arg_20]
movsd [rsp+568h+var_548], xmm0
the battleye blocks injection
how it detect injection just 2bytes edited from original chams
or dll checks integrity itself ..?
I dont have idea why it detected just change 2bytes.
What should I do? Can you elaborate?
I mean I modify the chams dll by syruz only 2 bytes but BE detect it!
Last edited by wns25678; 11-05-2017 at 05:42 AM.
because it is detected to start off with, mate.
akart69 (11-06-2017)
Last edited by wns25678; 11-06-2017 at 09:42 PM.