Currently updating a Script Detection Bypass!
Code:
#include "Bypass.h"
// Signatures - Arma2OA.exe
// 00489CB3 B8 483DDD00 MOV EAX,00DD3D48
// RVA: Arma2OA.exe + 0x89cb3
MAKE_SIG(MainPtr_Pattern, "\xB2\x00\x00\x00\xE3\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\x53\x8B\x5C\x24\x08");
MAKE_MASK(MainPtr_Mask, "x????xx????xx????xx????xx????xx????xx????xx????xx????xxxxxx");
// Signatures - BEClient.dll
// 1747455D A3 2C9F4817 MOV [17489F2C],EAX
// RVA: BEClient.dll" + 0x455d
MAKE_SIG(BE_ptrCallFunc_Pattern, "\xA9\x00\x40\x00\x00\xE8\x00\x00\x00\x59\x83\xC4\x0C\x68\x00\x00\x00\x00\xFF\x15\x00\x00\x00\x00");
MAKE_MASK(BE_ptrCallFunc_Mask, "x????x????xxxx????xx????");
DWORD MainPtr = 0;
DWORD BE_ptrCallFunc = 0;
DWORD Remmote_ptrCallFunc = 0;
int Bypass_InitSigScans1(const char* GameExe)
{
int Result = 0;
int mArma_BaseAddr, mArma_BaseSize;
MapData Arma2Map = {0};
if (GameExe)
{
mArma_BaseAddr = (int)MapFile(GameExe, &Arma2Map);
if (mArma_BaseAddr){
mArma_BaseSize = Arma2Map.MapSize;
MainPtr = FindPattern(mArma_BaseAddr, mArma_BaseSize, MainPtr_Pattern, MainPtr_Mask);
if (MainPtr){
// Read the Static Address
MainPtr = (*(DWORD*)MainPtr+1) >> 8;
Result = 1;
}
else{
Result = SIGSCAN1_ERROR_1;
}
}
else{
Result = SIGSCAN1_FILEMAP_ERROR_1;
}
}
return Result;
}
int Bypass_InitSigScans2(const char* BEDll, DWORD BEBase)
{
int Result = 0;
int mBE_BaseAddr, mBE_BaseSize;
MapData BEClientMap = {0};
if (BEDll)
{
mBE_BaseAddr = (int)MapFile(BEDll, &BEClientMap);
if (mBE_BaseAddr){
mBE_BaseSize = BEClientMap.MapSize;
BE_ptrCallFunc = FindPattern(mBE_BaseAddr, mBE_BaseSize, BE_ptrCallFunc_Pattern, BE_ptrCallFunc_Mask);
if (BE_ptrCallFunc){
BE_ptrCallFunc = (*(DWORD *)BE_ptrCallFunc+1) >> 8;
BE_ptrCallFunc = BEBase + BE_ptrCallFunc;
Result = 1;
}
else{
Result = SIGSCAN2_ERROR_1;
}
UnmapFile(&BEClientMap);
}
else{
Result = SIGSCAN2_FILEMAP_ERROR_1;
}
}
return Result;
}
// MHS Exp: [[0x00DD3D48+0x24]+0x198+0x68]
long BypassIt(DWORD GamePID)
{
long Result = 0;
DWORD thisPtr = 0, ptr1 = 0, BE_CallBackFunc = 0, dummy = 0, dummy2 = 0;
if (GamePID)
{
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,0,GamePID);
if (hProc)
{
if (!Remmote_ptrCallFunc){
Remmote_ptrCallFunc = (DWORD)RemoteAllocate(hProc, 4);
if (!Remmote_ptrCallFunc){
CloseHandle(hProc);
return BYPASSIT_ERROR_8;
}
}
#if DEBUG_VALS
printf("\n --- DEBUG VALS ---\nMainPtr: 0x%X\n",MainPtr);
#endif
if (ReadProcessMemory(hProc, (void*)(MainPtr + 0x24), &thisPtr, 4, 0)){
#if DEBUG_VALS
printf("thisPtr: 0x%X\n",thisPtr);
#endif
if (thisPtr){
thisPtr += 0x198 + 0x68;
if (ReadProcessMemory(hProc, (void*)thisPtr, &ptr1, 4, 0)){
BE_CallBackFunc = ptr1;
#if DEBUG_VALS
printf("BE_CallBackFunc: 0x%X\n",BE_CallBackFunc);
#endif
if (BE_CallBackFunc){
if (WriteProcessMemory(hProc, (void*)Remmote_ptrCallFunc, &BE_CallBackFunc, 4, 0) &&
WriteProcessMemory(hProc, (void*)thisPtr, &dummy2, 4, 0))
{
#if DEBUG_VALS
printf("Remmote_ptrCallFunc: 0x%X\n", Remmote_ptrCallFunc);
printf("BE_ptrCallFunc: 0x%X\n\n", BE_ptrCallFunc);
#endif
dummy = Remmote_ptrCallFunc;
if (WriteProcessMemory(hProc, (void*)BE_ptrCallFunc, &dummy, 4, 0)){
Result = 1;
}
else{
Result = BYPASSIT_ERROR_7;
}
}
else{
Result = BYPASSIT_ERROR_6;
}
}
else{
Result = BYPASSIT_ERROR_5;
}
}
else{
Result = BYPASSIT_ERROR_4;
}
}
else{
Result = BYPASSIT_ERROR_3;
}
}
else{
Result = BYPASSIT_ERROR_2;
}
CloseHandle(hProc);
}
else{
Result = BYPASSIT_ERROR_1;
}
}
return Result;
}
---------- Post added at 12:40 AM ---------- Previous post was at 12:19 AM ----------
Oops, nvm. I did it!!!! FINALLY!

