All of you will be thinking about why do I need a detected base , I released this base for new hack coder to analyse it .
Credits :
The people who posted XOR and Memory wall hack .
Main.cpp :
Code:
//Define
#include <Windows.h>
#include "define.h"
#include "main.h"
//Dllmain
BOOL WINAPI DllMain(HMODULE hDll,DWORD dwReason,LPVOID lpReserved)
{
if(dwReason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hDll);
CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)hookBase, hDll, NULL, NULL);
}
return TRUE;
}
Main.h :
Code:
//Define
#include <Windows.h>
#include "define.h"
#include "XOR.h"
VOID mainBase()
{
DWORD cshell;
cshell = (DWORD)GetModuleHandleA(eCrossfire);
while(1)
{
if(cshell)
{
memcpy((VOID*)0x70BD94, "\x90\x90\x90\x90\x90\x90", 6);
}
}
}
VOID hookBase(HINSTANCE hDLL)
{
DWORD cshell;
cshell = (DWORD)GetModuleHandleA(eCrossfire);
if(cshell)
{
mainBase();
}
}
Define.h :
Code:
// Strings //
#define eNtDll /*ntdll.dll*/XorStr<0xD1,10,0x11B15132>("\xBF\xA6\xB7\xB8\xB9\xF8\xB3\xB4\xB5"+0x11B15132).s
#define eNtTerminateThread /*NtTerminateThread*/XorStr<0xB4,18,0x947771C8>("\xFA\xC1\xE2\xD2\xCA\xD4\xD3\xD5\xDD\xC9\xDB\xEB\xA8\xB3\xA7\xA2\xA0"+0x947771C8).s
#define eCShell /*CShell.dll*/XorStr<0xA0,11,0x4013471B>("\xE3\xF2\xCA\xC6\xC8\xC9\x88\xC3\xC4\xC5"+0x4013471B).s
#define eClient /*ClientFx.fxd*/XorStr<0xA0,13,0x0132ECB5>("\xE3\xCD\xCB\xC6\xCA\xD1\xE0\xDF\x86\xCF\xD2\xCF"+0x0132ECB5).s
#define eCrossfire /*Crossfire.exe*/XorStr<0x1A,14,0x53CB51C3>("\x59\x69\x73\x6E\x6D\x79\x49\x53\x47\x0D\x41\x5D\x43"+0x53CB51C3).s
XOR.h :
Code:
#ifndef _XOR_H
#define _XOR_H
template <int XORSTART, int BUFLEN, int XREFKILLER>
class XorStr
{
private:
XorStr();
public:
char s[ BUFLEN ];
XorStr( const char * xs );
~XorStr()
{
for ( int i = 0; i < BUFLEN; i++ ) s[ i ]=0;
}
};
template <int XORSTART, int BUFLEN, int XREFKILLER>
XorStr<XORSTART,BUFLEN,XREFKILLER>::XorStr( const char * xs )
{
int xvalue = XORSTART;
int i = 0;
for ( ; i < ( BUFLEN - 1 ); i++ )
{
s[ i ] = xs[ i - XREFKILLER ] ^ xvalue;
xvalue += 1;
xvalue %= 256;
}
s[ BUFLEN - 1 ] = 0;
}
#endif