| #define HShieldBypass_1 0x0000A048 #define HShieldBypass_2 0x0009A8C2 #define HShieldBypass_3 0x0007B7A0 #define HShieldBypass_4 0x00009FB0 #define HShieldBypass_5 0x0003CF8E #define HShieldBypass_6 0x0003A39F #define HShieldBypass_7 0x0003C446 #define HShieldBypass_8 0x0003D004 |
INT EditMemory(VOID *lpMem, VOID *lpSrc, size_t len) { DWORD flNewProtect = PAGE_READWRITE, lpflOldProtect; unsigned char *pDst = (unsigned char *)lpMem, *pSrc = (unsigned char *)lpSrc; if(VirtualProtect(lpMem, len, flNewProtect, &lpflOldProtect)) { while(len-- > 0) *pDst++ = *pSrc++; return 0; } return 1; } DWORD WINAPI BypassThread(LPVOID) { DWORD dwEhSvc = 0; do { Sleep(100); dwEhSvc = (DWORD)GetModuleHandle("EhSvc.dll"); } while(!dwEhSvc); BYTE HSB1[1] = {0x74}; BYTE HSB2[1] = {0xD2}; BYTE HSB3[3] = {0xC2, 0x04, 0x00}; BYTE HSB4[1] = {0x31}; BYTE HSB5[2] = {0x90, 0x90}; EditMemory((PVOID)(dwEhSvc + HShieldBypass_1), (PVOID)"\x74", 1); EditMemory((PVOID)(dwEhSvc + HShieldBypass_2), (PVOID)"\xD2", 1); EditMemory((PVOID)(dwEhSvc + HShieldBypass_3), (PVOID)"\xC2\x04\x00", 3); EditMemory((PVOID)(dwEhSvc + HShieldBypass_4), (PVOID)"\xC2\x04\x00", 3); EditMemory((PVOID)(dwEhSvc + HShieldBypass_5), (PVOID)"\x31", 1); EditMemory((PVOID)(dwEhSvc + HShieldBypass_6), (PVOID)"\x31", 1); EditMemory((PVOID)(dwEhSvc + HShieldBypass_7), (PVOID)"\x31", 1); EditMemory((PVOID)(dwEhSvc + HShieldBypass_8), (PVOID)"\x90\x90", 2); return NULL; } CREDITS: BURO171 fernandotdb |
