GetModuleHandle !!!!

[dakr54]

yup, definitely looks like C syntax

also pointless..

[Saedelaere*]

DWORD CShell = (DWORD)GetMouleHandleA("C""S""h""e""l""l"".""d""l" "l");

Looool. You know the precompiler is merging that to "CShell.dll" again?

yup, definitely looks like C syntax

It is valid C syntax, but it's very stupid.

[Pingo]

Definitely not GetModuleHandle thats detected.

	while (GetModuleHandle("CShell") == NULL)
		Sleep(10);
     char t1[64];
     sprintf(t1, "%p", GetModuleHandle("CShell"));
     MessageBox(0, t1, "Pointer value", MB_OK);

 

[IMG]https://i203.photobucke*****m/albums/aa29/Baxter_esa/xtrapbypassed_zps447e1894.png[/IMG]

I'll release the source after i test it more.
I used a different method for undetecting the base.