BypassBypass
Thanks to:
Croner <- his orig, ported to CA hs.
BigBoy <- nanoscans.
I'm tired of getting private messages asking for stuff. CA is boring, make a menu hack, chams idc. I'm tired of all the noobs who are ungrateful and think just because CA is down for maintenance a hack is patched. If CShell.dll doesn't update and EhSvc.dll doesn't update then it isn't patched god damn it.
Croner <- his orig, ported to CA hs.
BigBoy <- nanoscans.
Code:
DWORD Protect;
void MEMCPY(void *adr, void *ptr, int size)
{
VirtualProtect(adr,size,PAGE_EXECUTE_READWRITE, &Protect);
memcpy(adr,ptr,size);
VirtualProtect(adr,size,OldProtection, &Protect);
}
void MCPY( void )
{
for(;;)
{
DWORD EhSvc = (DWORD)GetModuleHandle("EhSvc.dll");
if( EhSvc != NULL )
{
MEMCPY((void *)(EhSvc+0x5A74F), (void*)(PBYTE)"\xB8\x01\x00\x00\x00\xC3", 6);
MEMCPY((void *)(EhSvc+0x1CC0C), (void *)(PBYTE)"\x90\x90", 2);
MEMCPY((void *)(EhSvc+0x2541F), (void *)(PBYTE)"\x31", 1);
MEMCPY((void *)(EhSvc+0x27BFE), (void *)(PBYTE)"\x31", 1);
MEMCPY((void *)(EhSvc+0x63663), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x636F9), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x251DB), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x25325), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x2541F), (void *)(PBYTE)"\x31", 1);
MEMCPY((void *)(EhSvc+0x23616), (void *)(PBYTE)"\x31", 1);
MEMCPY((void *)(EhSvc+0x27321), (void *)(PBYTE)"\x31", 1);
MEMCPY((void *)(EhSvc+0x26708), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x26817), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x26C60), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x68ECD), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x68EF7), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x2990A), (void *)(PBYTE)"\x90\x90", 2);
MEMCPY((void *)(EhSvc+0x27321), (void *)(PBYTE)"\x31", 1);
MEMCPY((void *)(EhSvc+0x6A902), (void *)(PBYTE)"\xEB", 1);
MEMCPY((void *)(EhSvc+0x6A667), (void *)(PBYTE)"\xEB", 1);
}
}
}
In DLLMain
CreateThread( NULL, NULL, ( LPTHREAD_START_ROUTINE )MCPY, NULL, NULL, NULL );
Originally Posted by whit
