Bypass ASM Memory

**Coder.Anonymous** · 05-19-2014

All hacks ASM memory back to work again. Super Bullets, Unlimited Ammo, Remote Kill, Weapon Range, Rapid Fire, Name Tags, Remote Kill, No Recoil ...

Code:

0052D3B9     0F84 B4000000       JE Engine_2.0052D473
0052D3BF   . 3D 03010000         CMP EAX,103
0052D3C4   . 75 0D               JNZ SHORT Engine_2.0052D3D3
0052D3C6   . 53                  PUSH EBX
0052D3C7   . 68 882A7300         PUSH Engine_2.00732A88              ;  ASCII "CombatArms"
0052D3CC   . 68 A8297300         PUSH Engine_2.007329A8              ;  ASCII "Another instance of this game is running.  
The program is shutting down."
0052D3D1   . EB 75               JMP SHORT Engine_2.0052D448
0052D3D3   > 3D 01010000         CMP EAX,101
0052D3D8   . 75 0D               JNZ SHORT Engine_2.0052D3E7
0052D3DA   . 53                  PUSH EBX
0052D3DB   . 68 882A7300         PUSH Engine_2.00732A88              ;  ASCII "CombatArms"
0052D3E0   . 68 60297300         PUSH Engine_2.00732960              ;  ASCII "An invalid file has been installed.  
Please reinstall the file."
0052D3E5   . EB 61               JMP SHORT Engine_2.0052D448
0052D3E7   > 3D 05010000         CMP EAX,105
0052D3EC   . 75 0D               JNZ SHORT Engine_2.0052D3FB
0052D3EE   . 53                  PUSH EBX
0052D3EF   . 68 882A7300         PUSH Engine_2.00732A88              ;  ASCII "CombatArms"
0052D3F4   . 68 00297300         PUSH Engine_2.00732900              ;  ASCII "Debugger activity has been detected.  
Close the debugger first, then run the program again."
0052D3F9   . EB 4D               JMP SHORT Engine_2.0052D448
0052D3FB   > 3D 07010000         CMP EAX,107
0052D400   . 75 0D               JNZ SHORT Engine_2.0052D40F
0052D402   . 53                  PUSH EBX
0052D403   . 68 882A7300         PUSH Engine_2.00732A88              ;  ASCII "CombatArms"
0052D408   . 68 B0287300         PUSH Engine_2.007328B0              ;  ASCII "You need Administrative authority to run this.  
The program is shutting down."
0052D40D   . EB 39               JMP SHORT Engine_2.0052D448
0052D40F   > 83F8 04             CMP EAX,4
0052D412   . 75 0D               JNZ SHORT Engine_2.0052D421
0052D414   . 53                  PUSH EBX
0052D415   . 68 882A7300         PUSH Engine_2.00732A88              ;  ASCII "CombatArms"
0052D41A   . 68 60287300         PUSH Engine_2.00732860              ;  ASCII "The program is running on compatibility mode.  
The program is shutting down."
0052D41F   . EB 27               JMP SHORT Engine_2.0052D448
0052D421   > 8BD0                MOV EDX,EAX
0052D423   . 52                  PUSH EDX
0052D424   . 8D8424 20030000     LEA EAX,DWORD PTR SS:[ESP+320]
0052D42B   . 68 F0277300         PUSH Engine_2.007327F0              ;  ASCII "An error has occurred with the hack prevention function.  (Error Code = %x)
The program is shutting down."
0052D430   . 50                  PUSH EAX
0052D431   . FF15 D8347200       CALL DWORD PTR DS:[7234D8]          ;  Engine_2.00B3DFB1
0052D437   . 83C4 0C             ADD ESP,0C
0052D43A   . 53                  PUSH EBX
0052D43B   . 68 882A7300         PUSH Engine_2.00732A88              ;  ASCII "CombatArms"
0052D440   . 8D8C24 24030000     LEA ECX,DWORD PTR SS:[ESP+324]
0052D447   . 51                  PUSH ECX
0052D448   > 53                  PUSH EBX
0052D449   . FF15 A4347200       CALL DWORD PTR DS:[7234A4]
0052D44F   . 8B15 34C77C00       MOV EDX,DWORD PTR DS:[7CC734]
0052D455   . 8B42 04             MOV EAX,DWORD PTR DS:[EDX+4]
0052D458   . 50                  PUSH EAX
0052D459   . 68 CC277300         PUSH Engine_2.007327CC              ;  ASCII "Failed to _AhnHS_Initialize [%d]"
0052D45E   . E8 2DAC1600         CALL Engine_2.00698090
0052D463   . 50                  PUSH EAX
0052D464   . E8 17AD1600         CALL Engine_2.00698180
0052D469   . 83C4 0C             ADD ESP,0C
0052D46C   . 32C0                XOR AL,AL
0052D46E   . E9 85000000         JMP Engine_2.0052D4F8
0052D473   > E8 5ABC1A00         CALL Engine_2.006D90D2
0052D478   . 8B0D 34C77C00       MOV ECX,DWORD PTR DS:[7CC734]
0052D47E   . 8941 04             MOV DWORD PTR DS:[ECX+4],EAX
0052D481   . A1 34C77C00         MOV EAX,DWORD PTR DS:[7CC734]
0052D486   . 3958 04             CMP DWORD PTR DS:[EAX+4],EBX
0052D489   . 74 4C               JE SHORT Engine_2.0052D4D7
0052D48B   . 8B50 04             MOV EDX,DWORD PTR DS:[EAX+4]
0052D48E   . 52                  PUSH EDX
0052D48F   . 68 A8277300         PUSH Engine_2.007327A8              ;  ASCII "Failed to _AhnHS_StartService [%d]"
0052D494   . E8 F7AB1600         CALL Engine_2.00698090
0052D499   . 50                  PUSH EAX
0052D49A   . E8 E1AC1600         CALL Engine_2.00698180
0052D49F   . A1 34C77C00         MOV EAX,DWORD PTR DS:[7CC734]
0052D4A4   . 8B48 04             MOV ECX,DWORD PTR DS:[EAX+4]
0052D4A7   . 51                  PUSH ECX
0052D4A8   . 8D9424 2C030000     LEA EDX,DWORD PTR SS:[ESP+32C]
0052D4AF   . 68 F0277300         PUSH Engine_2.007327F0              ;  ASCII "An error has occurred with the hack prevention function.  (Error Code = %x)
The program is shutting down."
0052D4B4   . 52                  PUSH EDX
0052D4B5   . FF15 D8347200       CALL DWORD PTR DS:[7234D8]          ;  Engine_2.00B3DFB1
0052D4BB   . 83C4 18             ADD ESP,18
0052D4BE   . 53                  PUSH EBX
0052D4BF   . 68 882A7300         PUSH Engine_2.00732A88              ;  ASCII "CombatArms"

Code:

#define ADDR_BYPASS        0x52D3B9 //ANDRESS ONLY CABR

DWORD WINAPI Bypass( LPVOID lpArgs ) 
{ 
    while( memcmp( ( CONST VOID * )ADDR_BYPASS, ( CONST VOID * )"\x0F\x84\xB4\x00\x00\x00", 6 ) != 0 ) 
        Sleep(100); 

    MEMCPY( ( LPVOID )ADDR_BYPASS, "\xE9\x19\x01\x00\x00\x90", 6 ); 

    // Start here your hook or hack thread 

    return 0; 
} 

BOOL APIENTRY DllMain( HMODULE hModule, 
                       DWORD  ul_reason_for_call, 
                       LPVOID lpReserved 
                     ) 
{ 
    switch( ul_reason_for_call ) 
    { 
    case DLL_PROCESS_ATTACH: 
        CreateThread( 0, 0, ( LPTHREAD_START_ROUTINE )Bypass, 0, 0, 0 );         
        break; 
    case DLL_THREAD_ATTACH: 
        break; 
    case DLL_THREAD_DETACH: 
        break; 
    case DLL_PROCESS_DETACH: 
        break; 
    } 
    return TRUE; 
}

Credit to :
@WE11ington
@luizimloko > had spread

**Fєηix** · 05-19-2014

Good Job

**diegosarria12** · 05-19-2014

Good Job

**Coder.DiasII** · 05-20-2014

Lol Good Job!

**Megaloco** · 05-20-2014

É possível criar uma dll separada do hack para usar esse ByPass ?

**DAGER-05** · 05-21-2014

crash for CAEU

**Ch40zz-C0d3r** · 05-21-2014

THis has been posted before, credits are wrong xD
Patched on NA and hopefully EU, will work on BR shit since they wont patch a shit lol...
BTW: Its a full bypss since you stop the driver from running. They fucked up something on their servers so the driver heartbeat didnt work.

_PuRe.LucK* · 05-21-2014

how did you get at this place in the debugger/disassembler?

**6ixth** · 05-21-2014

Leeched has been succeeded!

**Ch40zz-C0d3r** · 05-21-2014

Originally Posted by *ZeoN*

how did you get at this place in the debugger/disassembler?

The hell? xD
Open a protected (via plugins) olly, start directly engine.exe wait till the unpacking process is ended. It will load a new module, press ok and pause the process fast.
An error will occur but simply ignore it. Now search for strings and be happy

**Coder.Anonymous** · 05-21-2014

Originally Posted by ForeverRed

Leeched has been succeeded!

[20/05/2014 00:13:11] luizimloko: ajuda a espalhar [helps spread]

**Coder.DiasII** · 05-21-2014

Originally Posted by Coder.Anonymous

[20/05/2014 00:13:11] luizimloko: ajuda a espalhar [helps spread]

when he said helps spread bet it was somewhere else
not in a place that already has

**XarutoUsoCrack** · 05-21-2014

Originally Posted by Ch40zz-C0d3r

THis has been posted before, credits are wrong xD
Patched on NA and hopefully EU, will work on BR shit since they wont patch a shit lol...
BTW: Its a full bypss since you stop the driver from running. They fucked up something on their servers so the driver heartbeat didnt work.

Client-Sided connect to Server-Sided and give a request, maybe they just removed the MakeRequest, RecieveRequest from client network & server network, there's a bug from .HSB generator, if you create a .HSB whit more than 3MB, the HSB will bug and server always will return a MakeRequest CRC File Attack error, idk why this happens, i just looked at HackShield SDK, i know a lot about him, is better learn...

**Coder.Anonymous** · 05-21-2014

Originally Posted by Coder.DiasII

when he said helps spread bet it was somewhere else
not in a place that already has

I do not care, I want this game go to *****.

**arun823** · 05-21-2014

Originally Posted by Coder.Anonymous

I do not care, I want this game go to *****.

That happened years ago.

Thread: Bypass ASM Memory

Thread Tools

Display

Bypass ASM Memory

The Following 4 Users Say Thank You to Coder.Anonymous For This Useful Post:

The Following User Says Thank You to 6ixth For This Useful Post:

The Following User Says Thank You to Ch40zz-C0d3r For This Useful Post:

Similar Threads

[Help] Memory vs ASM?

[Source Code] [ASM BYPASS][02.09.11]Made by SK1LL0R.

[Help] asm memory hacking

[Help] Please help me with ASM bypass

ASM bypass??