Code:
DWORD OldProtection;
void MEMwrite(void *adr, void *ptr, int size)
{
VirtualProtect(adr,size,PAGE_EXECUTE_READWRITE, &OldProtection);
memcpy(adr,ptr,size);
VirtualProtect(adr,size,OldProtection, &OldProtection);
}
void NewDetourhs(long Address,int Size,int Size2)
{
long EhSvc = (long)GetModuleHandleA("EhSvc.dll");
DWORD OldProtect;
VirtualProtect((void*)(EhSvc+Address),Size,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(EhSvc+Address) = Size2;
}
void CopyModules(void)
{
long EhSvc = (long)GetModuleHandleA("EhSvc.dll");
//self crc check
MEMwrite((void *)(EhSvc+0x2B59A),(void*)(PBYTE)"\x90\xE9",2);
//anti asm scan warrock.exe
MEMwrite((void *)(EhSvc+0x1D0DC),(void*)(PBYTE)"\x90\x90",2);
////unhook dip & sss
MEMwrite((void *)(EhSvc+0x6B2B6),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x6B2E0),(void*)(PBYTE)"\xEB",1);
//dll jump code check
MEMwrite((void *)(EhSvc+0x6CA97),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x6CD32),(void*)(PBYTE)"\xEB",1);
////anti restore page
MEMwrite((void *)(EhSvc+0x659F3),(void*)(PBYTE)"\xEB",1);
//cheat engine
MEMwrite((void *)(EhSvc+0x59794),(void*)(PBYTE)"\xE9\x7E\x0A\x00\x00",5);
// nano detect objects
MEMwrite((void *)(EhSvc+0x28408),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x2851C),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x29E2C),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x26EDB),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x27025),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x2900D),(void*)(PBYTE)"\x85\xED",2);
MEMwrite((void *)(EhSvc+0x2525B),(void*)(PBYTE)"\x3B\xDB",2);
MEMwrite((void *)(EhSvc+0x27107),(void*)(PBYTE)"\x85\xC0",2);
MEMwrite((void *)(EhSvc+0x298F8),(void*)(PBYTE)"\xB8\x00\x00\x00\x00\x90",6);
MEMwrite((void *)(EhSvc+0x5D02F),(void*)(PBYTE)"\xB8\x01\x00\x00\x00\xC3",6);
MEMwrite((void *)(EhSvc+0x65921),(void*)(PBYTE)"\xEB",1);
MEMwrite((void *)(EhSvc+0x65933),(void*)(PBYTE)"\xE9\x99\x01\x00\x00",5);
MEMwrite((void *)(EhSvc+0x298F8),(void*)(PBYTE)"\xB8\x00\x00\x00\x00\x90",6);
MEMwrite((void *)(EhSvc+0x2711F),(void*)(PBYTE)"\x31",1);
MEMwrite((void *)(EhSvc+0x2527F),(void*)(PBYTE)"\x31",1);
MEMwrite((void *)(EhSvc+0x29021),(void*)(PBYTE)"\x31",1);
MEMwrite((void *)(EhSvc+0x2B598),(void*)(PBYTE)"\x31",1);
}
void Antiban(void)
{
DWORD Old;
VirtualProtect((BYTE*)int(0x00587850),0x8,PAGE_EXECUTE_READWRITE,&Old);
*(int*) 0x00587850 = 2415922370;
}
void Loop(void)
{
for(;;)
{
long EhSvc = (long)GetModuleHandleA("EhSvc.dll");
if(EhSvc!=0)
{
Antiban();
CopyModules();
}
Sleep(20);
}
}