| BOOL MemoryEdit (VOID *lpMem,VOID *lpSrc,DWORD len)// { DWORD lpflOldProtect, flNewProtect = PAGE_READWRITE; unsigned char * pDst = (unsigned char *)lpMem, *pSrc = (unsigned char *)lpSrc; if (VirtualProtect(lpMem,len,flNewProtect,&lpflOldPro tect)) { while(len-- > 0) *pDst++ = *pSrc++; return (0); } return (1); } void CombatArms_Bypass(void) { DWORD dwEhSvc; do { dwEhSvc = (DWORD)GetModuleHandleA("Ehsvc.dll"); Sleep(30); } while (!dwEhSvc); MemoryEdit((void *)(dwEhSvc + 0x9BC8), (void *)"\x74",1);//HSCallBack2 MemoryEdit((void *)(dwEhSvc + 0x737DA), (void *)"\xC3", 1);//HSCallBack1 MemoryEdit((void *)(dwEhSvc + 0x8FCF8), (void *)"\xD2", 1);//HSNanoScan MemoryEdit((void *)(dwEhSvc + 0x72E3C), (void *)"\xC2\x04\x00",3);//EhsvcSelfCrC MemoryEdit((void *)(dwEhSvc + 0x09B30), (void *)"\xC2\x04\x00",3);//Detection } |
| ADR_HS_CALLBACK1 0x737DA ADR_HS_CALLBACK2 0x09BC8 ADR_HS_NANOSCAN 0x8FCF7 ADR_HS_EHSVCSELFCRC 0x72E3C ADR_HS_DETECTION 0x09B30 ADR_HS_NANOCHECK1 0x368BE ADR_HS_NANOCHECK2 0x33D5F ADR_HS_HSANTICRASH 0x36934 ADR_HS_ASMDETECRION 0x26D6B ADR_HS_NANOCHECK3 0x35DE6 |
INT EditMemory(VOID *lpMem, VOID *lpSrc, size_t len)
{
DWORD flNewProtect = PAGE_READWRITE, lpflOldProtect;
unsigned char *pDst = (unsigned char *)lpMem, *pSrc = (unsigned char *)lpSrc;
if(VirtualProtect(lpMem, len, flNewProtect, &lpflOldProtect))
{
while(len-- > 0) *pDst++ = *pSrc++;
return 0;
}
return 1;
}
DWORD WINAPI BypassThread(LPVOID)
{
DWORD dwHackshield = 0;
do
{
Sleep(100);
dwHackshield = (DWORD)GetModuleHandle("EhSvc.dll");
} while(!dwHackshield);
BYTE HSB1[1] = {0x74};
BYTE HSB2[1] = {0xD2};
BYTE HSB3[3] = {0xC2, 0x04, 0x00};
BYTE HSB4[1] = {0x31};
BYTE HSB5[2] = {0x90, 0x90};
EditMemory((VOID *)(dwHackshield + EhsvcSelfCrC), HSB4, 1);
EditMemory((VOID *)(dwHackshield + Detection), HSB3, 3);
EditMemory((VOID *)(dwHackshield + HSAntiCrash), HSB4, 1);
EditMemory((VOID *)(dwHackshield + Asm_Detection), HSB2, 1);
EditMemory((VOID *)(dwHackshield + NanoCheck3), HSB5, 2);
EditMemory((VOID *)(dwHackshield + NanoCheck1 ), HSB1, 1);
EditMemory((VOID *)(dwHackshield + NanoCheck2), HSB3, 3);
EditMemory((VOID *)(dwHackshield + HShield_Bypass5), HSB4, 1);
return NULL;
}