Currently ive only managed to do the coding section of changing the string of totalitem to totaliten.
but can anyone guide me on how to code the changing of opcode of the jne to je to bypass the file check?
this is my current code:
Code:
#include "stdafx.h"
#include <Windows.h>
#include <iostream>
#include <stdio.h>
DWORD WINAPI LoopFunction(LPVOID lpParam)
{
BYTE Bypass[9] = { 0x54, 0x6F, 0x74, 0x61, 0x6C, 0x49, 0x74, 0x65, 0x6E }; //Byte ON Bypass
BYTE Bypass2[9] = { 0x54, 0x6F, 0x74, 0x61, 0x6C, 0x49, 0x74, 0x65, 0x6D }; //Byte OFF Bypass
DWORD address = 0x874451; //BlackShot.exe+474451
bool BypassAddy = false;
HANDLE bs2015 = GetCurrentProcess();
while (1){
if (GetAsyncKeyState(VK_HOME)){
WriteProcessMemory(bs2015, (void*)(address), &Bypass2, 9, 0);
BypassAddy = false;
}
else if (BypassAddy == false){
WriteProcessMemory(bs2015, (void*)(address), &Bypass, 9, 0);
BypassAddy = true;
}
}
}
void Patch(void *adr, void *ptr, int size)
{
DWORD NewProtection;
VirtualProtect(adr, size, PAGE_EXECUTE_WRITECOPY, &NewProtection);
memcpy(adr, ptr, size);
VirtualProtect(adr, size, NewProtection, &NewProtection);
}
BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dwAttached, LPVOID lpvReserved)
{
if (dwAttached == DLL_PROCESS_ATTACH) {
CreateThread(NULL, 0, &LoopFunction, NULL, 0, NULL);
}
return 1;
}