Results 1 to 13 of 13

Threaded View

  1. #1
    HLBOT's Avatar
    Join Date
    May 2011
    Gender
    male
    Location
    HCM City
    Posts
    533
    Reputation
    36
    Thanks
    1,355
    My Mood
    Amazed

    How To Bypass File Changed at HGWC

    Hello. Long time I dont use it. Now I has re-debug and it's changed to new address.
    With this Tut, the HGWC.exe's not check your file has been chaged or fake
    Here is Address and String of It.

    ---------HGWC CFNA-----------
    Code:
    0040DDB3   68 988F4800      PUSH HGWC.00488F98                       ; UNICODE "Failed to get to file crc32 : file [%s] error [%d]"
    0040DDB8   E8 83C6FFFF      CALL HGWC.0040A440
    0040DDBD   8B4424 44        MOV EAX,DWORD PTR SS:[ESP+44]
    0040DDC1   8B4C24 3C        MOV ECX,DWORD PTR SS:[ESP+3C]
    0040DDC5   83C4 0C          ADD ESP,0C
    0040DDC8   50               PUSH EAX
    0040DDC9   51               PUSH ECX
    0040DDCA   E8 65790300      CALL HGWC.00445734
    0040DDCF   83C4 08          ADD ESP,8
    0040DDD2   85C0             TEST EAX,EAX
    0040DDD4   0F84 9D000000    JE HGWC.0040DE77 // Him here, Now change JE to JMP -> JMP HGWC.0040DE77
    0040DDDA   3B6B 08          CMP EBP,DWORD PTR DS:[EBX+8]
    0040DDDD   72 05            JB SHORT HGWC.0040DDE4
    0040DDDF   E8 60810300      CALL HGWC.00445F44
    0040DDE4   8B5424 38        MOV EDX,DWORD PTR SS:[ESP+38]
    0040DDE8   8B45 00          MOV EAX,DWORD PTR SS:[EBP]
    0040DDEB   8B08             MOV ECX,DWORD PTR DS:[EAX]
    0040DDED   52               PUSH EDX
    0040DDEE   51               PUSH ECX
    MyCpp.Cpp
    Code:
    /#include <windows.h>
    DWORD HGWC;	
    BYTE PatchHGWC[] = {0xE9,0x9E,0x00,0x00,0x00,0x90};
    void Mains()
    {
    	while(1)
    	{
    	    if(!HGWC)
    	    {
    	         HGWC	= (DWORD)GetModuleHandleA( "HGWC.exe" );
    	    }
        	    else
    	    {
                    WriteProcessMemory(GetCurrentProcess(),(LPVOID)(HGWC+0xDDD4),&PatchHGWC,6,0);
    	    }
    	    Sleep(10);
    	}
    }
    BOOL APIENTRY DllMain( HANDLE hModule,DWORD  ul_reason_for_call, LPVOID lpReserved)
    {
    	if (ul_reason_for_call == 1)
    	{
    	
    		CreateThread(0, 0, (LPTHREAD_START_ROUTINE)Mains, 0, 0, 0);
    			
    	}
        return TRUE;
    }
    Code:
    FindPattern = 83 C4 ?? 85 C0 ?? ?? ?? ?? ?? ?? 3B 6B ?? ?? ?? E8
    FindPattern + 0x5
    Good Luck
    It's finally Over!

  2. The Following 8 Users Say Thank You to HLBOT For This Useful Post:

    6ixth (03-19-2014),cmc5414 (03-19-2014),dreek1 (04-10-2015),giniyat101 (03-19-2014),kjbmarr (03-20-2014),mamo007 (03-20-2014),NIgga* (03-19-2014),ramo. (03-19-2014)

Similar Threads

  1. [Info] I already know now, how to bypass X-Trap and HGWC
    By Pronome191 in forum CrossFire Discussions
    Replies: 22
    Last Post: 01-11-2013, 11:24 AM
  2. [Solved] ./HGWC File Change Detected
    By Xayer in forum CrossFire Help
    Replies: 6
    Last Post: 10-12-2011, 07:18 PM
  3. [Solved] File Changed~/HGWC
    By ~dody~ in forum CrossFire Help
    Replies: 13
    Last Post: 10-01-2011, 05:05 PM
  4. [Help Request] HGWC File Changed [ while Playing Error ]
    By shefoalaao in forum CrossFire Help
    Replies: 12
    Last Post: 09-03-2011, 07:46 AM
  5. [Help Request] Detcting file-changeing .\HGWC
    By hitmix24 in forum CrossFire Help
    Replies: 2
    Last Post: 08-31-2011, 05:39 PM