Currently updating a Script Detection Bypass!

Posts 1–7 of 7 · Page 1 of 1
Currently updating a Script Detection Bypass!
Code:
#include "Bypass.h"

// Signatures - Arma2OA.exe

// 00489CB3     B8 483DDD00             MOV EAX,00DD3D48
// RVA: Arma2OA.exe + 0x89cb3
MAKE_SIG(MainPtr_Pattern, "\xB2\x00\x00\x00\xE3\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\x53\x8B\x5C\x24\x08");
MAKE_MASK(MainPtr_Mask, "x????xx????xx????xx????xx????xx????xx????xx????xx????xxxxxx");

// Signatures - BEClient.dll

// 1747455D     A3 2C9F4817             MOV [17489F2C],EAX
// RVA: BEClient.dll" + 0x455d
MAKE_SIG(BE_ptrCallFunc_Pattern, "\xA9\x00\x40\x00\x00\xE8\x00\x00\x00\x59\x83\xC4\x0C\x68\x00\x00\x00\x00\xFF\x15\x00\x00\x00\x00");
MAKE_MASK(BE_ptrCallFunc_Mask, "x????x????xxxx????xx????");

DWORD MainPtr = 0;
DWORD BE_ptrCallFunc = 0;
DWORD Remmote_ptrCallFunc = 0;

int Bypass_InitSigScans1(const char* GameExe)
{
	int Result = 0;
	int mArma_BaseAddr, mArma_BaseSize;
	MapData Arma2Map = {0};

	if (GameExe)
	{
		mArma_BaseAddr = (int)MapFile(GameExe, &Arma2Map);
		if (mArma_BaseAddr){
			mArma_BaseSize = Arma2Map.MapSize;
			
			MainPtr = FindPattern(mArma_BaseAddr, mArma_BaseSize, MainPtr_Pattern, MainPtr_Mask);

			if (MainPtr){
				// Read the Static Address
				MainPtr = (*(DWORD*)MainPtr+1) >> 8;
				Result = 1;
			}
			else{
				Result = SIGSCAN1_ERROR_1;
			}
		}
		else{
			Result = SIGSCAN1_FILEMAP_ERROR_1;
		}
	}

	return Result;
}

int Bypass_InitSigScans2(const char* BEDll, DWORD BEBase)
{
	int Result = 0;
	int mBE_BaseAddr, mBE_BaseSize;

	MapData BEClientMap = {0};

	if (BEDll)
	{
		mBE_BaseAddr = (int)MapFile(BEDll, &BEClientMap);
		
		if (mBE_BaseAddr){
			mBE_BaseSize = BEClientMap.MapSize;

			BE_ptrCallFunc = FindPattern(mBE_BaseAddr, mBE_BaseSize, BE_ptrCallFunc_Pattern, BE_ptrCallFunc_Mask);

			if (BE_ptrCallFunc){
				BE_ptrCallFunc = (*(DWORD *)BE_ptrCallFunc+1) >> 8;
				BE_ptrCallFunc = BEBase + BE_ptrCallFunc;

				Result = 1;
			}
			else{
				Result = SIGSCAN2_ERROR_1;
			}
			UnmapFile(&BEClientMap);
		}
		else{
			Result = SIGSCAN2_FILEMAP_ERROR_1;
		}
	}

	return Result;
}

// MHS Exp: [[0x00DD3D48+0x24]+0x198+0x68]
long BypassIt(DWORD GamePID)
{
	long Result = 0;
	DWORD thisPtr = 0, ptr1 = 0, BE_CallBackFunc = 0, dummy = 0, dummy2 = 0;

	if (GamePID)
	{
		HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,0,GamePID);
		if (hProc)
		{

			if (!Remmote_ptrCallFunc){
				Remmote_ptrCallFunc = (DWORD)RemoteAllocate(hProc, 4);

				if (!Remmote_ptrCallFunc){
					CloseHandle(hProc);
					return BYPASSIT_ERROR_8;
				}
			}

			#if DEBUG_VALS
				printf("\n --- DEBUG VALS ---\nMainPtr: 0x%X\n",MainPtr);
			#endif

			if (ReadProcessMemory(hProc, (void*)(MainPtr + 0x24), &thisPtr, 4, 0)){
				#if DEBUG_VALS
					printf("thisPtr: 0x%X\n",thisPtr);
				#endif

				if (thisPtr){
					thisPtr += 0x198 + 0x68;
			
					if (ReadProcessMemory(hProc, (void*)thisPtr, &ptr1, 4, 0)){
	
						BE_CallBackFunc = ptr1;

						#if DEBUG_VALS
							printf("BE_CallBackFunc: 0x%X\n",BE_CallBackFunc);
						#endif
						
						if (BE_CallBackFunc){
							if (WriteProcessMemory(hProc, (void*)Remmote_ptrCallFunc, &BE_CallBackFunc, 4, 0) &&
								WriteProcessMemory(hProc, (void*)thisPtr, &dummy2, 4, 0))
							{
								
								#if DEBUG_VALS
									printf("Remmote_ptrCallFunc: 0x%X\n", Remmote_ptrCallFunc);
									printf("BE_ptrCallFunc: 0x%X\n\n", BE_ptrCallFunc);
								#endif
								
								dummy = Remmote_ptrCallFunc;

								if (WriteProcessMemory(hProc, (void*)BE_ptrCallFunc, &dummy, 4, 0)){
									Result = 1;
								}
								else{
									Result = BYPASSIT_ERROR_7;
								}
							}
							else{
								Result = BYPASSIT_ERROR_6;
							}
						}
						else{
							Result = BYPASSIT_ERROR_5;
						}
					}
					else{
						Result = BYPASSIT_ERROR_4;
					}
				}
				else{
					Result = BYPASSIT_ERROR_3;
				}
			}
			else{
				Result = BYPASSIT_ERROR_2;
			}

			CloseHandle(hProc);
		}
		else{
			Result = BYPASSIT_ERROR_1;
		}
	}
	return Result;
}
Could someone explain what is : [[0x00DD3D48+0x24]+0x198+0x68] and A3 2C9F4817 MOV [17489F2C],EAX.....and all that..

---------- Post added at 12:40 AM ---------- Previous post was at 12:19 AM ----------

Oops, nvm. I did it!!!! FINALLY!
Quote Originally Posted by Selcouther View Post
Code:
#include "Bypass.h"

// Signatures - Arma2OA.exe

// 00489CB3     B8 483DDD00             MOV EAX,00DD3D48
// RVA: Arma2OA.exe + 0x89cb3
MAKE_SIG(MainPtr_Pattern, "\xB2\x00\x00\x00\xE3\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\xB8\x00\x00\x00\x00\xC3\x53\x8B\x5C\x24\x08");
MAKE_MASK(MainPtr_Mask, "x????xx????xx????xx????xx????xx????xx????xx????xx????xxxxxx");

// Signatures - BEClient.dll

// 1747455D     A3 2C9F4817             MOV [17489F2C],EAX
// RVA: BEClient.dll" + 0x455d
MAKE_SIG(BE_ptrCallFunc_Pattern, "\xA9\x00\x40\x00\x00\xE8\x00\x00\x00\x59\x83\xC4\x0C\x68\x00\x00\x00\x00\xFF\x15\x00\x00\x00\x00");
MAKE_MASK(BE_ptrCallFunc_Mask, "x????x????xxxx????xx????");

DWORD MainPtr = 0;
DWORD BE_ptrCallFunc = 0;
DWORD Remmote_ptrCallFunc = 0;

int Bypass_InitSigScans1(const char* GameExe)
{
	int Result = 0;
	int mArma_BaseAddr, mArma_BaseSize;
	MapData Arma2Map = {0};

	if (GameExe)
	{
		mArma_BaseAddr = (int)MapFile(GameExe, &Arma2Map);
		if (mArma_BaseAddr){
			mArma_BaseSize = Arma2Map.MapSize;
			
			MainPtr = FindPattern(mArma_BaseAddr, mArma_BaseSize, MainPtr_Pattern, MainPtr_Mask);

			if (MainPtr){
				// Read the Static Address
				MainPtr = (*(DWORD*)MainPtr+1) >> 8;
				Result = 1;
			}
			else{
				Result = SIGSCAN1_ERROR_1;
			}
		}
		else{
			Result = SIGSCAN1_FILEMAP_ERROR_1;
		}
	}

	return Result;
}

int Bypass_InitSigScans2(const char* BEDll, DWORD BEBase)
{
	int Result = 0;
	int mBE_BaseAddr, mBE_BaseSize;

	MapData BEClientMap = {0};

	if (BEDll)
	{
		mBE_BaseAddr = (int)MapFile(BEDll, &BEClientMap);
		
		if (mBE_BaseAddr){
			mBE_BaseSize = BEClientMap.MapSize;

			BE_ptrCallFunc = FindPattern(mBE_BaseAddr, mBE_BaseSize, BE_ptrCallFunc_Pattern, BE_ptrCallFunc_Mask);

			if (BE_ptrCallFunc){
				BE_ptrCallFunc = (*(DWORD *)BE_ptrCallFunc+1) >> 8;
				BE_ptrCallFunc = BEBase + BE_ptrCallFunc;

				Result = 1;
			}
			else{
				Result = SIGSCAN2_ERROR_1;
			}
			UnmapFile(&BEClientMap);
		}
		else{
			Result = SIGSCAN2_FILEMAP_ERROR_1;
		}
	}

	return Result;
}

// MHS Exp: [[0x00DD3D48+0x24]+0x198+0x68]
long BypassIt(DWORD GamePID)
{
	long Result = 0;
	DWORD thisPtr = 0, ptr1 = 0, BE_CallBackFunc = 0, dummy = 0, dummy2 = 0;

	if (GamePID)
	{
		HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS,0,GamePID);
		if (hProc)
		{

			if (!Remmote_ptrCallFunc){
				Remmote_ptrCallFunc = (DWORD)RemoteAllocate(hProc, 4);

				if (!Remmote_ptrCallFunc){
					CloseHandle(hProc);
					return BYPASSIT_ERROR_8;
				}
			}

			#if DEBUG_VALS
				printf("\n --- DEBUG VALS ---\nMainPtr: 0x%X\n",MainPtr);
			#endif

			if (ReadProcessMemory(hProc, (void*)(MainPtr + 0x24), &thisPtr, 4, 0)){
				#if DEBUG_VALS
					printf("thisPtr: 0x%X\n",thisPtr);
				#endif

				if (thisPtr){
					thisPtr += 0x198 + 0x68;
			
					if (ReadProcessMemory(hProc, (void*)thisPtr, &ptr1, 4, 0)){
	
						BE_CallBackFunc = ptr1;

						#if DEBUG_VALS
							printf("BE_CallBackFunc: 0x%X\n",BE_CallBackFunc);
						#endif
						
						if (BE_CallBackFunc){
							if (WriteProcessMemory(hProc, (void*)Remmote_ptrCallFunc, &BE_CallBackFunc, 4, 0) &&
								WriteProcessMemory(hProc, (void*)thisPtr, &dummy2, 4, 0))
							{
								
								#if DEBUG_VALS
									printf("Remmote_ptrCallFunc: 0x%X\n", Remmote_ptrCallFunc);
									printf("BE_ptrCallFunc: 0x%X\n\n", BE_ptrCallFunc);
								#endif
								
								dummy = Remmote_ptrCallFunc;

								if (WriteProcessMemory(hProc, (void*)BE_ptrCallFunc, &dummy, 4, 0)){
									Result = 1;
								}
								else{
									Result = BYPASSIT_ERROR_7;
								}
							}
							else{
								Result = BYPASSIT_ERROR_6;
							}
						}
						else{
							Result = BYPASSIT_ERROR_5;
						}
					}
					else{
						Result = BYPASSIT_ERROR_4;
					}
				}
				else{
					Result = BYPASSIT_ERROR_3;
				}
			}
			else{
				Result = BYPASSIT_ERROR_2;
			}

			CloseHandle(hProc);
		}
		else{
			Result = BYPASSIT_ERROR_1;
		}
	}
	return Result;
}
Could someone explain what is : [[0x00DD3D48+0x24]+0x198+0x68] and A3 2C9F4817 MOV [17489F2C],EAX.....and all that..

---------- Post added at 12:40 AM ---------- Previous post was at 12:19 AM ----------

Oops, nvm. I did it!!!! FINALLY!
share it please!
Maybe you can share it?
Since you already gave out the code, share it with me please :3 I'm starving to try one of theese!
From what I can see it is a part of darkys bypass... I am quite sure that method doesn't work anymore...
Quote Originally Posted by sd333221 View Post
From what I can see it is a part of darkys bypass... I am quite sure that method doesn't work anymore...
Yes, correct it is from Darky's bypass.
Quote Originally Posted by Selcouther View Post
Yes, correct it is from Darky's bypass.
As I said all this source will do is getting you banned. You need a new/different method.
Posts 1–7 of 7 · Page 1 of 1

Post a Reply

Similar Threads

Tags for this Thread

None

Talk with us