Antimemhackthread

Hello every one,

Can some one maby help me to baypass the Anti mem hack thread.

Code:

06721F70  /$  53            PUSH EBX
06721F71  |.  56            PUSH ESI
06721F72  |.  E8 49050000   CALL 067224C0
06721F77  |.  68 1C010000   PUSH 11C
06721F7C  |.  E8 33522900   CALL 069B71B4
06721F81  |.  8BF0          MOV ESI,EAX
06721F83  |.  33DB          XOR EBX,EBX
06721F85  |.  83C4 04       ADD ESP,4
06721F88  |.  3BF3          CMP ESI,EBX
06721F8A  |.  74 0F         JE SHORT 06721F9B
06721F8C  |.  E8 6F0B0000   CALL 06722B00
06721F91  |.  C706 2856A106 MOV DWORD PTR DS:[ESI],06A15628
06721F97  |.  8BCE          MOV ECX,ESI
06721F99  |.  EB 02         JMP SHORT 06721F9D
06721F9B  |>  33C9          XOR ECX,ECX
06721F9D  |>  898F B8000000 MOV DWORD PTR DS:[EDI+B8],ECX
06721FA3  |.  8B01          MOV EAX,DWORD PTR DS:[ECX]
06721FA5  |.  8B50 08       MOV EDX,DWORD PTR DS:[EAX+8]
06721FA8  |.  68 E055A106   PUSH 06A155E0                            ;  AntiMemHackThread
06721FAD  |.  57            PUSH EDI
06721FAE  |.  FFD2          CALL EDX                                 ;  ntdll.DbgUiRemoteBreakin
06721FB0  |.  68 C8000000   PUSH 0C8                                 ; /Timeout = 200. ms
06721FB5  |.  899F 9C000000 MOV DWORD PTR DS:[EDI+9C],EBX            ; |
06721FBB  |.  899F A0000000 MOV DWORD PTR DS:[EDI+A0],EBX            ; |
06721FC1  |.  899F A4000000 MOV DWORD PTR DS:[EDI+A4],EBX            ; |
06721FC7  |.  899F A8000000 MOV DWORD PTR DS:[EDI+A8],EBX            ; |
06721FCD  |.  90            NOP                                      ; |
06721FCE  |.  E8 2CF10E6F   CALL kernel32.Sleep                      ; \Sleep
06721FD3  |.  5E            POP ESI                                  ;  ntdll.77B8F826
06721FD4  |.  5B            POP EBX                                  ;  ntdll.77B8F826
06721FD5  \.  C3            RET

I found it in cshell:

Code:

 Address=06721000
 Size=00C98000 (13205504.)
 Owner=cshell   06720000
 Section=.text
 Contains=code
 Type=Imag 01001004
 Access=RW
 Initialÿaccess=RWE

If the call on F72 is:

Code:

067224C0    F605 BC8F3B07 0>TEST BYTE PTR DS:[73B8FBC],1
067224C7    75 1E           JNZ SHORT 067224E7
067224C9    830D BC8F3B07 0>OR DWORD PTR DS:[73B8FBC],1
067224D0    68 50AB9C06     PUSH 069CAB50
067224D5    C705 B88F3B07 0>MOV DWORD PTR DS:[73B8FB8],0
067224DF    E8 C34D2900     CALL 069B72A7
067224E4    83C4 04         ADD ESP,4
067224E7    A1 B88F3B07     MOV EAX,DWORD PTR DS:[73B8FB8]
067224EC    85C0            TEST EAX,EAX
067224EE    74 13           JE SHORT 06722503
067224F0    6A 00           PUSH 0
067224F2    50              PUSH EAX
067224F3    90              NOP
067224F4    E8 2BBC3B6F     CALL ADVAPI32.CryptReleaseContext
067224F9    C705 B88F3B07 0>MOV DWORD PTR DS:[73B8FB8],0
06722503    68 000000F0     PUSH F0000000
06722508    6A 01           PUSH 1
0672250A    6A 00           PUSH 0
0672250C    6A 00           PUSH 0
0672250E    68 B88F3B07     PUSH 073B8FB8                            ; p^5
06722513    90              NOP
06722514    E8 C46C3B6F     CALL ADVAPI32.CryptAcquireContextA
06722519    85C0            TEST EAX,EAX
0672251B    75 03           JNZ SHORT 06722520
0672251D    32C0            XOR AL,AL
0672251F    C3              RET

I think that:

Code:

06722520    C705 6C8F3B07 B>MOV DWORD PTR DS:[73B8F6C],073B8FB8      ; p^5

073B8FB8 is the addie were stands if there is a memhack detected?

Becouse I'm not good in asm, never learnt it :$

I found also somting on 073B8FB8:

Code:

073B8FB0    E0 2E           LOOPDNE SHORT 073B8FE0
073B8FB2    65:42           INC EDX
073B8FB4    DB              ???                                      ; Unknown command
073B8FB5    0F493F          CMOVNS EDI,DWORD PTR DS:[EDI]
073B8FB8    8869 D1         MOV BYTE PTR DS:[ECX-2F],CH
073B8FBB    0001            ADD BYTE PTR DS:[ECX],AL
073B8FBD    0000            ADD BYTE PTR DS:[EAX],AL
073B8FBF    0000            ADD BYTE PTR DS:[EAX],AL
073B8FC1    0000            ADD BYTE PTR DS:[EAX],AL
073B8FC3    0002            ADD BYTE PTR DS:[EDX],AL
073B8FC5    0000            ADD BYTE PTR DS:[EAX],AL
073B8FC7    0000            ADD BYTE PTR DS:[EAX],AL
073B8FC9    0000            ADD BYTE PTR DS:[EAX],AL
073B8FCB    0001            ADD BYTE PTR DS:[ECX],AL
073B8FCD    0000            ADD BYTE PTR DS:[EAX],AL
073B8FCF    0000            ADD BYTE PTR DS:[EAX],AL
073B8FD1    0000            ADD BYTE PTR DS:[EAX],AL
073B8FD3    00E4            ADD AH,AH
073B8FD5    FA              CLI
073B8FD6  - 7C 58           JL SHORT 073B9030
073B8FD8    E4 FA           IN AL,0FA
073B8FDA    885A 00         MOV BYTE PTR DS:[EDX],BL
073B8FDD    0000            ADD BYTE PTR DS:[EAX],AL
073B8FDF    0000            ADD BYTE PTR DS:[EAX],AL
073B8FE1    0000            ADD BYTE PTR DS:[EAX],AL
073B8FE3    0000            ADD BYTE PTR DS:[EAX],AL
073B8FE5    0000            ADD BYTE PTR DS:[EAX],AL
073B8FE7    0000            ADD BYTE PTR DS:[EAX],AL
073B8FE9    0000            ADD BYTE PTR DS:[EAX],AL
073B8FEB    0000            ADD BYTE PTR DS:[EAX],AL
073B8FED    0000            ADD BYTE PTR DS:[EAX],AL
073B8FEF    0000            ADD BYTE PTR DS:[EAX],AL
073B8FF1    0000            ADD BYTE PTR DS:[EAX],AL
073B8FF3    0000            ADD BYTE PTR DS:[EAX],AL
073B8FF5    0000            ADD BYTE PTR DS:[EAX],AL
073B8FF7    0000            ADD BYTE PTR DS:[EAX],AL
073B8FF9    0000            ADD BYTE PTR DS:[EAX],AL
073B8FFB    0000            ADD BYTE PTR DS:[EAX],AL
073B8FFD    0000            ADD BYTE PTR DS:[EAX],AL
073B8FFF    00              ???                                      ; Command crosses end of memoryÿblock

So:

73B8FBC << does this needs to be 1? I think this is correct. Going to test it soon.

try posting it in the coding section of the website... the cf coding section is full of leechs.

Good Idee, ty

Find the entry point and jump to the exit or create a loop if exiting causes the program to close

Originally Posted by tdct

Find the entry point and jump to the exit or create a loop if exiting causes the program to close

I found the code what calls the anti meme hack:

Code:

066B1E00  /$  6A FF         PUSH -1
066B1E02  |.  68 118E9506   PUSH 06958E11
066B1E07  |.  64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
066B1E0D  |.  50            PUSH EAX
066B1E0E  |.  51            PUSH ECX
066B1E0F  |.  57            PUSH EDI
066B1E10  |.  A1 08FF9C06   MOV EAX,DWORD PTR DS:[69CFF08]
066B1E15  |.  33C4          XOR EAX,ESP
066B1E17  |.  50            PUSH EAX
066B1E18  |.  8D4424 0C     LEA EAX,DWORD PTR SS:[ESP+C]
066B1E1C  |.  64:A3 0000000>MOV DWORD PTR FS:[0],EAX
066B1E22  |.  8BF9          MOV EDI,ECX
066B1E24  |.  897C24 08     MOV DWORD PTR SS:[ESP+8],EDI
066B1E28  |.  8D47 04       LEA EAX,DWORD PTR DS:[EDI+4]
066B1E2B  |.  50            PUSH EAX
066B1E2C  |.  C707 10569A06 MOV DWORD PTR DS:[EDI],069A5610
066B1E32  |.  E8 69080000   CALL 066B26A0
066B1E37  |.  68 B01E6B06   PUSH 066B1EB0
066B1E3C  |.  68 A01E6B06   PUSH 066B1EA0
066B1E41  |.  6A 04         PUSH 4
066B1E43  |.  6A 1C         PUSH 1C
066B1E45  |.  8D4F 2C       LEA ECX,DWORD PTR DS:[EDI+2C]
066B1E48  |.  51            PUSH ECX
066B1E49  |.  C74424 28 000>MOV DWORD PTR SS:[ESP+28],0
066B1E51  |.  E8 6A552900   CALL 069473C0
066B1E56  |.  C64424 14 01  MOV BYTE PTR SS:[ESP+14],1
066B1E5B  |.  E8 10010000   CALL 066B1F70
066B1E60  |.  8BC7          MOV EAX,EDI
066B1E62  |.  8B4C24 0C     MOV ECX,DWORD PTR SS:[ESP+C]
066B1E66  |.  64:890D 00000>MOV DWORD PTR FS:[0],ECX
066B1E6D  |.  59            POP ECX                                  ;  ntdll.77C7F826
066B1E6E  |.  5F            POP EDI                                  ;  ntdll.77C7F826
066B1E6F  |.  83C4 10       ADD ESP,10
066B1E72  \.  C3            RET

I'm going to try to nop the call.

There might be a check for that, well then again crossfire's protection sucks

i was wanna bypass my d3d hack

go to coding section

What do you mean?

Lauwy i know somewhan who can help you?

Can you set breakpoint in crossfire,lauwy?
I can code Endscence midfunction hook undetect but hook for dip not work. i need a debugger can set breakpoint in crossfire to code mid function hook dip undetect.When i used ollydbg set breakpoint,crossfire terminated.Please help me.

Originally Posted by acquybietyeu

Can you set breakpoint in crossfire,lauwy?
I can code Endscence midfunction hook undetect but hook for dip not work. i need a debugger can set breakpoint in crossfire to code mid function hook dip undetect.When i used ollydbg set breakpoint,crossfire terminated.Please help me.

Ở đây bọn nó chỉ xài MEMHack thôi, không có trình như cậu về MidFunction cho D3D đâu, cho dù có thì cũng đi vào Staff MPGH hết rồi, họ không giúp bọn mình về mấy cái này đâu!

Originally Posted by *****

Ở đây bọn nó chỉ xài MEMHack thôi, không có trình như cậu về MidFunction cho D3D đâu, cho dù có thì cũng đi vào Staff MPGH hết rồi, họ không giúp bọn mình về mấy cái này đâu!

off: in any chance you know superkhung, that legendary Vietnam hacker? long time lost contact with him.

Originally Posted by Nissan

off: in any chance you know superkhung, that legendary Vietnam hacker? long time lost contact with him.

Him's me! But not a Hacker ..NoobHacker right man!

Originally Posted by *****

Him's me! But not a Hacker ..NoobHacker right man!

he made great hacks (almost like server sided) back in 2001-2005, i cant believe u never heard of him ^^

Anh ***** cho e cái ym , có gì a em mình cũng thảo luận về vấn đề này

Antimemhackthread

Post a Reply

Tags for this Thread