HShield Bypass Code

**snakebitshock** · 01-15-2015

Guys , I have found something who can bypass hshield but I dont know how to use it .
I need C++ ? I need to make an dll file with this code or edit something ?
I'm a begginer in this functions.

Code:

DWORD HS_Memory, HS_Memory_Start, HS_Memory_End;
DWORD HSCRC1_Ret, HSCRC2_Ret, HSCRC3_Ret, HSCRC4_Ret;
 
void _declspec(naked) HSCRC1_Hook(){
        _asm{
                cmp ecx,[HS_Memory_Start]
                jb Ending_HSCRC1
                cmp ecx,[HS_Memory_End]
                ja Ending_HSCRC1
                sub ecx,[HS_Memory_Start]
                add ecx,[HS_Memory]
Ending_HSCRC1:
                mov dl,[ecx]
                xor eax,edx
                mov ecx,[ebp+0x10]
                jmp dword ptr [HSCRC1_Ret]
        }
}
 
void _declspec(naked) HSCRC2_Hook(){
        _asm{
                cmp ebx,[HS_Memory_Start]
                jb Ending_HSCRC2
                cmp ebx,[HS_Memory_End]
                ja Ending_HSCRC2
                sub ebx,[HS_Memory_Start]
                add ebx,[HS_Memory]
Ending_HSCRC2:
                add al,[ebx]
                mov ebx,[esp]
                jmp dword ptr [HSCRC2_Ret]
        }
}
 
void _declspec(naked) HSCRC3_Hook(){
        _asm{
                cmp edx,[HS_Memory_Start]
                jb Ending_HSCRC3
                cmp edx,[HS_Memory_End]
                ja Ending_HSCRC3
                push edx
                sub edx,[HS_Memory_Start]
                cmp edx,0x92812 - 0x100
                jb Ending_HSCRC3_2
                cmp edx,0x360040 + 0x100
                ja Ending_HSCRC3_2
                cmp edx,0x92812 + 0x100
                jb Ending_HSCRC3_1
                cmp edx,0x360040 - 0x100
                ja Ending_HSCRC3_1
                jmp Ending_HSCRC3_2
Ending_HSCRC3_1:
                add edx,[HS_Memory]
                mov edx,[edx]
                mov dword ptr [esp+0x04],edx
Ending_HSCRC3_2:
                pop edx
Ending_HSCRC3:
                jmp dword ptr [HSCRC3_Ret]
        }
}
 
void _declspec(naked) HSCRC4_Hook(){
        _asm{
                push esi
                cmp esi,[Memory_Start]
                jb Ending_
                cmp esi,[Memory_End]
                ja Ending_
                sub esi,[Memory_Start]
                add esi,[Memory]
Ending_:
                lea edi,[ebp-0x1228]
                repe movsd
                pop esi
                jmp dword ptr [HSCRC4_Ret]
        }
}
 
void HSCRC5_TableHack(DWORD dwHSCRC5_Table){
        int i;
        for(i=0; i<4; i++){
                *(DWORD *)(dwHSCRC5_Table + i*8) = ((*(DWORD *)(dwHSCRC5_Table + i*8)^*(DWORD *)(dwHSCRC5_Table + 0x24)) - HS_Memory_Start + HS_Memory)^(*(DWORD *)(dwHSCRC5_Table + 0x24));
        }
}
 
void HackShieldBypass(){
 
        while(!GetModuleHandleA("EHSvc.dll")){
                Sleep(100);
        }
 
        DWORD EHSvc = (DWORD)GetModuleHandleA("EHSvc.dll");
 
        Air::CreateMemoryDump(&HS_Memory, &HS_Memory_Start, &HS_Memory_End, "EHSvc.dll");
       
        Air::WriteJumpAtModule("EHSvc.dll", 0x92812, (DWORD)HSCRC1_Hook, &HSCRC1_Ret, 2);//HSCRC1
        Air::WriteJumpAtModule("EHSvc.dll", 0x360040, (DWORD)HSCRC2_Hook, &HSCRC2_Ret);//HSCRC2
        Air::WriteJumpAtModule("EHSvc.dll", 0x26005E+2, (DWORD)HSCRC3_Hook);//HSCRC3
        HSCRC3_Ret = EHSvc + 0x2528EB;
        Air::WriteJumpAtModule("EHSvc.dll", 0x39ED7, (DWORD)HSCRC4_Hook, &HSCRC4_Ret, 3);//HSCRC4
        HSCRC5_TableHack(EHSvc + 0x157048);
        Air::WriteCodeAtModule("EHSvc.dll", 0x4F5B0, "31 C0 C2 04 00");//Process Scanner
        Air::WriteCodeAtModule("EHSvc.dll", 0x56380, "31 C0 C2 04 00");//Module Scanner
        Air::WriteCodeAtModule("EHSvc.dll", 0x10E20, "31 C0 C3");//HardwareBreakPoint Detection(Main)
        Air::WriteCodeAtModule("EHSvc.dll", 0xF550, "31 C0 C3");//HardwareBreakPoint Detection2
        Air::WriteCodeAtModule("EHSvc.dll", 0xF740, "31 C0 C3");//HardwareBreakPoint Detection3
        Air::WriteCodeAtModule("EHSvc.dll", 0xFED0, "31 C0 C2 18 00");//HardwareBreakPoint Detection4
 
        Air::WriteCodeAtModule("EHSvc.dll", 0x70140, "31 C0 C3");//SoftwareBreakPoint Detection
        Air::WriteCodeAtModule("EHSvc.dll", 0xCEB67, "B8 00 00 00 00");//Memory Protection
}

For more helping I have an ehsvc decrypted and unvirtualized .

**sd999444** · 01-28-2015

where is the Air namespace located? in what include? this is probably made by AIRRIDE, who most likely wrote the functions in the Air namespace himself so others couldn't copy it so easily (like what you're trying to do it seems). where did you find the code? message me if you dont want that information public