Disable (Hack tool detected)

Code:

BYTE nop = 0x90;
DWORD d, ds; 

VirtualProtect((LPVOID)(CShellBase+0x85723), 17, PAGE_EXECUTE_READWRITE, &d);

for (int i=0; i<17;i++)
    memcpy((LPVOID)(CShellBase+0x85723+i), &nop, 1);  

VirtualProtect((LPVOID)(CShellBase+0x85723), 17, d, &ds);

try it. it is better than setting CShellBase+0x3466AC to 22
it disables the msgbox. it will not appear!

leecher

Originally Posted by jpjb5138

leecher

iam not aleecher
you won't find it anywhere

i didnt leech it. i found it

see found = leechd

Originally Posted by jpjb5138

see found = leechd

i mean i found it myself

Originally Posted by jpjb5138

see found = leechd

stfu leecher

omg you are just leecher

Originally Posted by kmanev073

omg you are just leecher

i can make aguide to find it

Originally Posted by giniyat202

i can make aguide to find it

make it pls

but how we can set that code? ^_^

leeched ...

it doesn't matter that it's leeched, atleast we have it now.

Originally Posted by 258456

it doesn't matter that it's leeched, atleast we have it now.

you has a point :')

well i will release this tut only for noobs who dont belive i found it my self

open your unpacked cshell.dll with olly dbg

right click->search for->binary string and search for

Code:

51 57 68 C9 00 00 00 6A 1C E8 ?? ?? ?? ?? 83 C4 10

of course you are asking me how could i find this string
here it comes:

use a modified version of bypassxtrap to open the game in undetected ollydbg
(which i won't share here, use google)
btw special thanx to ***** for sharing his bypass source

now right click->view->module CShell
and right click->search for->text strings.

go to third location of "ButtonMissionInfo"
and go up and you will find something like this

Code:

CMP EAX, 1C

click on the call before it and press enter to see this

Code:

MOV EAX,DWORD PTR DS:[103466AC]

so we have found the HTR ptr now right click and select find refs->address constant

and select this one:

Code:

MOV DWORD PTR DS:[103466AC],EAX

now go to the top of the function then login
and press HWBP on function
when BP hits make sure that "Hack tool detected" string is in the stack
if not press F9

now right click on first address in stack and select "follow in dissambler"

you can find this code:

Code:

PUSH ECX
PUSH EDI
PUSH 0C9
PUSH 1C
CALL CShell.10076020
ADD ESP,10

highlight this piece of code and right click->binary->binary copy then paste it into afile
and you can see some thing like this:

Code:

51 57 68 C9 00 00 00 6A 1C E8 EF 08 FF FF 83 C4 10

now, as you see the E9 byte is call but called function will change every update
so we change the EF 08 FF FF to ?? ?? ?? ??

every thing we need now is to nop this bytes and the msgbox won't appear

you are happy now? press thanks

Disable (Hack tool detected)

Post a Reply

Similar Threads

Tags for this Thread