HelpDetected Memory Base

Posts 1–15 of 21 · Page 1 of 2

Detected Memory Base

Hi everyone im new in coding hack and I read some base here so i've made one myslef and it is detected and I have no ideal why...
PS : I know how to code .
My base :

Code:

#include <Windows.h>
#include "XOR.h"
// Encrypted Strings
#define eCShell	/*CShell.dll*/XorStr<0xA0,11,0x4013471B>("\xE3\xF2\xCA\xC6\xC8\xC9\x88\xC3\xC4\xC5"+0x4013471B).s
#define eCrossfire /*Crossfire.exe*/XorStr<0x1A,14,0x53CB51C3>("\x59\x69\x73\x6E\x6D\x79\x49\x53\x47\x0D\x41\x5D\x43"+0x53CB51C3).s


VOID Wall()
{ 
	while(1)
	{
		DWORD CShell = (DWORD)GetModuleHandleA(eCrossfire);
		if(!CShell)
		{
			memcpy((VOID*)0x70BD94, "\x00\x00\x00\x00\x00\x00", 6);
		}
		else 
		{
			memcpy((VOID*)0x70BD94, "\x01\x01\x01\x01\x01\x01", 6);

		}
	}
}

VOID Thread(HINSTANCE hDLL)
{
	
   DWORD CShell = (DWORD)GetModuleHandleA(eCrossfire);
   if(!CShell)
	   {
		Wall();
	   }
}

BOOL WINAPI DllMain(HMODULE hDll,DWORD dwReason,LPVOID lpReserved)
{
	  if(dwReason == DLL_PROCESS_ATTACH)
	{
		DisableThreadLibraryCalls(hDll);
		CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)Thread, hDll, NULL, NULL);
	}
	    return TRUE;
}

Anyone here can explain and help me with it?

First, CreateThread is patched for me!
Use Detours or PCeumels UD Methode

Originally Posted by CFHackerExtreme

First, CreateThread is patched for me!
Use Detours or PCeumels UD Methode

Detour for???? BeginThread is detected too...

Originally Posted by CFHackerExtreme

First, CreateThread is patched for me!
Use Detours or PCeumels UD Methode

memcpy((VOID*), "\x00\x00\x00\x00\x00\x00", 6);

Even if you use PCeumels UD Method that function is detected. Right?

Originally Posted by remzkee0903

memcpy((VOID*), "\x00\x00\x00\x00\x00\x00", 6);

Even if you use PCeumels UD Method that function is detected. Right?

No ^^ you can only use CreateThread/And CShell String not cryptet with PCe`s UD Methode

Originally Posted by DevTisy

Detour for???? BeginThread is detected too...

Detours aren`t for beginners

When you use PCeumels UD Methode, then you can use CreateThread!

Originally Posted by CFHackerExtreme

No ^^ you can only use CreateThread/And CShell String not cryptet with PCe`s UD Methode

I've recently tried using this function memcpy((VOID*), "\x00\x00\x00\x00\x00\x00", 6); and patch w/ PCeumels UD Methode but still it's detected.

Another question sir, How do I update this XOR addy 0x4013471B like DevTisy base?

Originally Posted by remzkee0903

You don`t must update these "Addy"!

If, these XorString don`t work, try these:
#define eCShell /*CShell.dll*/XorStr<0xA0,11,0x4013471B>("\xE3\xF2\xCA\xC6\xC8\x C9\x88\xC3\xC4\xC5"+0x4013471B).s

Wehn you make your Own XorStrings, google for XorGen