New method bypass client error 28_3 and 31_0, shorter :D
This bypass is the shortest, i think 
Bypass 28_3:
Bypass 31_0:
Have fun!
Thanks if i helped!

Bypass 28_3:
Code:
Pattern: 83 F8 FF 0F 84 ?? ?? ?? ?? 56 50 E8 105D1C2A | 83 F8 FF | cmp eax,-01 | 105D1C2D | C7 44 24 14 00 00 00 00 | je 105D1E2A | 105D1C33 | 56 | push esi | 105D1C34 | 50 | push eax | 105D1C35 | E8 86 CD DB FF | call 1038E9C0 | -> function called to check 105D1C3A | 8B F0 | mov esi,eax | 105D1C3C | 83 C4 04 | add esp,04 | 105D1C3F | 85 F6 | test esi,esi | 105D1C41 | 0F 84 E2 01 00 00 | je 105D1E29 | He's here, now change je -> jmp 105D1C4D | D9 86 58 10 00 00 | fld dword ptr [esi+00001058] | 105D1C54 | 0F B6 86 BC 0B 00 00 | movzx eax,byte ptr [esi+00000BBC] |
Code:
Pattern: 53 50 8B 42 2C FF D0 105D261E | 83 C4 08 | add esp,08 | 105D2621 | 85 C0 | test eax,eax | 105D2623 | 74 48 | je 105D266D | He's here, change into "jmp 105D2637 + 4F" 105D2625 | 8B 0D A4 4F C0 10 | mov ecx,[10C04FA4] | 105D262D | 8B 11 | mov edx,[ecx] | 105D2631 | 8D 5C 24 10 | lea ebx,[esp+10] | 105D2636 | 05 70 17 00 00 | add eax,00001770 | 105D2637 | 53 | push ebx | -> Search return here. Value=105D2637+4F 105D2638 | 50 | push eax | 105D1C54 | 8B 42 2C | mov eax,[edx+2C] | .....////.... | | | 105D2637 + 4F | 5F | pop edi |
Thanks if i helped!



