XTrap and HGWC Bypass v2.

[ValidLeecher]

XTrap-Bypass Source v2 (32/64 bit)

#include <Windows.h>
#include <process.h>
#include <TlHelp32.h>
#include <Psapi.h>
#include "mHook.h"
  
#pragma comment(lib,"Psapi.lib")
  
// Module to exit
HMODULE hDLL;
  
/* Our hooked-function */
void DefineNothing_CC();
/* Our hooked-function */
void K32Enum_CC();
  
  
  
// Function to begin the hook
void _beginhook(void*){
  
        // our addresses
        DWORD dwAddy;
        DWORD dwDLL;
        DWORD dwXTrap;
        DWORD dwXTrapDriver;
  
  
        // wait for xtrap
        while(1){
                // break
                Sleep(500);
                // get xtrap base
                dwXTrap = (DWORD)GetModuleHandle("XTrapVa.dll");
                // check if it exists
                if(dwXTrap){
                        // leave
                        break;
                }
  
        }
        
  
        if(PSAPI_VERSION == 1){
        // get address
        dwDLL = (DWORD)GetModuleHandle("Psapi.dll");
        // get address
        dwAddy = (DWORD)GetProcAddress((HINSTANCE)dwDLL,"EnumProcesses");
        // Prevent that Xtrap scan processes
        mHook::DetourCodeCave(dwAddy,(DWORD)DefineNothing_CC,19);
  
        // get address
        dwDLL = (DWORD)GetModuleHandle("Kernel32.dll");
        // get address
        dwAddy = (DWORD)GetProcAddress((HINSTANCE)dwDLL,"ExitProcess");
        // Prevent exit then ollydbg was found
        mHook::DetourCodeCave(dwAddy,(DWORD)DefineNothing_CC,27);
        }
        else
        {
        // little break
        Sleep(500);
        // set new dll
        dwDLL = (DWORD)GetModuleHandle("Kernel32.dll");
        // get new addy
        dwAddy = (DWORD)GetProcAddress((HINSTANCE)dwDLL,"K32EnumProcesses");
        // Prevent that Xtrap scan processes
        mHook::DetourCodeCave(dwAddy,(DWORD)K32Enum_CC,3);
  
        // get address
        dwDLL = (DWORD)GetModuleHandle("Kernel32.dll");
        // get address
        dwAddy = (DWORD)GetProcAddress((HINSTANCE)dwDLL,"ExitProcess");
        // Prevent exit then ollydbg was found
        mHook::DetourCodeCave(dwAddy,(DWORD)DefineNothing_CC,27);
  
        }
  
        // Get driver Address
        dwXTrapDriver = 0x406668A0;
        // Change it
        wmemcpy((wchar_t*)dwXTrapDriver,L"X6va01",6);
  
        // Exit
        FreeLibraryAndExitThread(hDLL,8);
  
}
  
  
  
  
/* Main */
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved){
  
  
        if(fdwReason == DLL_PROCESS_ATTACH){
  
                
               
                // set our Module
                hDLL = hinstDLL;
                // begin
                _beginthread(_beginhook,0,0);
  
                // success
                return true;
        }
  
        // fail
        return false;
}
  
  
/* Our hooked-function */
__declspec( naked ) void K32Enum_CC(){
        __asm{
                ret 0x00C
        }
}
  
/* Our hooked-function */
__declspec( naked ) void DefineNothing_CC(){
        __asm{
                mov edi,edi
                push ebp
                mov ebp,esp
                pop ebp
                jmp orig
                nop
                nop
                nop
                nop
                nop
orig:
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
                nop
        }
}

HGWC Bypass Function Source Only (64 bit)

#define TRUE FALSE
class HGWC
{
 
public:
 
    int HGWC::FileDetection(int);
    int HGWC::KeepAlive(int);
    int HGWC::Bann(int);
    int HGWC::Thread(int);
}rect;
 
int HGWC::FileDetection(int LParam)
{
    memcpy((LPVOID)0x0040CAE1,(LPVOID)"\xEB",1);
    return 0;
}
 
int HGWC::KeepAlive(int LParam)
{
    memcpy((LPVOID)0x0040D5B7,(LPVOID)"\xEB",1);
    return 0;
}
 
int HGWC::Bann(int LParam)
{
    memcpy((LPVOID)0x0040F9FD,(LPVOID)"\xEB",1);
    memcpy((LPVOID)0x0040FA31,(LPVOID)"\xEB",1);
    memcpy((LPVOID)0x0040FB71,(LPVOID)"\xC2\x0C\x00\x90\x90",5);
    memcpy((LPVOID)0x00410270,(LPVOID)"\xC2\x0C\x00\x90\x90",5);
    return 0;
}
 
int HGWC::Thread(int LParam)
{
    memcpy((LPVOID)0x0040D4E3,(LPVOID)"\x6A\x7D",2);
    memcpy((LPVOID)0x00418F91,(LPVOID)"\xEB\x0A",2);
    memcpy((LPVOID)0x00464147,(LPVOID)"\x68\xFF\x08\x00\x00",5);
    memcpy((LPVOID)0x00410270,(LPVOID)"\xC2\x0C\x00\x90\x90",5);
    return 0;
}

Update some of it.
You need reverse engineering basics.
I accept thanks too.

Credits: Akira

[bandi12]

One thing i found very funny.

Now 1 week , you were begging for help , and now you say that "You need reverse engineering basics." I doubt that you learn'd reversing engineering in 1 week.
And you want thanks for what ? That you C+P HGWC Bypass from pastebin ??

[ValidLeecher]

I'm just trying to keep the crossfire section alive by feeding it with useful posts.
Okay if that is your opinion, Its okay.

[I2espect]

HGWC bypass credits to Slicktor.... [ For S4League Game ]

[Astr3Lune]

where i can find detourcodecave?

I need DetourCodeCaVe.

[ValidLeecher]

Google it,please.
You can also find a tutorial at youtube.

HGWC bypass credits to Slicktor.... [ For S4League Game ]

Adapt it to crossfire.

[jastre]

i cant build it pls help me

[Astr3Lune]

Google it,please.
You can also find a tutorial at youtube.

Not found detourcodecave .
Why must use detourcodecave?
Because i don,t have detourcodecave.
this bypass xtrap can use other detour?

Give me youtbe link for tutorial.
I wont to see.

[XarutoUsoCrack]

you post a really useless function, this is for S4League and you keep saying "you need assembly basic", "update it".

of course you want this, they will update for you can give you full code... but yeah, this will not happen this time bro sorry :c

[ValidLeecher]

you post a really useless function, this is for S4League and you keep saying "you need assembly basic", "update it".

of course you want this, they will update for you can give you full code... but yeah, this will not happen this time bro sorry :c

I got the xtrap bypass working.

[kmanev073]

your hgwc bypass is really complex mine is simpler

[ValidLeecher]

your hgwc bypass is really complex mine is simpler

nigga....share it.

[Astr3Lune]

what a call funtion for Bypass HGWC?

more question
How to get Xtrap Driver address?

and i need source DetourCodeCave.

[kanza224]

When I start crossfire I keep getting an xtrap error saying "Game cannot run properly", then after 5 secs the crossfire client shuts down. Is this what I use to prevent Xtrap from shutting the client down? If so, how do I use this?

[doodlemeat]

Still working?