Hello guys, eu estava pesquisando mais sobre hacks para ver quais funções(ou métodos) da WinApi aprender e me deparei com esse código, apenas gostaria de saber se é dessa forma que se faz um bypass.
Eu apenas dei uma organizada(pesquisem) estava tudo muito bagunçado é confuso(coloque em uma font mono espaçada).
Code:
/*********************************************************************
** XTrap Bypass Vitrix Maggot ~ Revised: StroopeR[MPGH] 4/9d/2015 **
**********************************************************************
** Hacking Detected **
** ---------------------------------------------------------------- **
** 00435FA6 EB 35 All referenced text string, 'Hacking detected' **
** One line, up, change JNZ to JMP **
** 0043CE36 EB 35 All referenced text string, 'Hacking detected' **
** One line, up, change JNZ to JMP **
** 0043DCF0 EB 35 All referenced text string, 'Hacking detected' **
** One line, up, change JNZ to JMP **
** 0043DCD1 EB 1F All referenced text string, 'Hacking detected' **
** Jump #1 change JNZ to JMP **
** 0043DCE9 EB 07 All referenced text string, 'Hacking detected' **
** Jump #2 change JNZ to JMP **
**********************************************************************
** IsDebuggerPresent **
** ---------------------------------------------------------------- **
** 00499517 90 Go to IsDebuggerPresent, do down and NOP first JNZ **
**********************************************************************
** ZCheckHackProcess **
** ---------------------------------------------------------------- **
** 00441E35 EB 34 All referenced text string, 'Hacking Detected' **
** go up till start of function (PUSH -1), **
** go to the local call, under it theres a **
** TEST AL,AL, go down one more line, (JNZ) change **
** it to JMP (Do this for all 3 'Hacking Detected' **
** 00441E62 EB 2C **
** 00441EBD EB 09 **
**********************************************************************
** Abnormal Behavior **
** ---------------------------------------------------------------- **
** 00440353 E9 8A 00 00 00 All referenced text strings, **
** 'An abnormal behavior is detected.', **
** go up 2 lines, change the JE to JMP **
*********************************************************************/
#include <windows.h>
/* Andress for functions */
#define HACKDETECT_1 0x00435FA6
#define HACKDETECT_2 0x0043CE36
#define HACKDETECT_3 0x0043DCF0
#define HACKDETECT_4 0x0043DCD1
#define HACKDETECT_5 0x0043DCE9
#define DEBUGPRESENT 0x00499517
#define HACKPROCESS1 0x00441E35
#define HACKPROCESS2 0x00441E62
#define HACKPROCESS3 0x00441EBD
#define ABNORMALBEHA 0x00440353
/* Modifications */
BYTE HackDetect_1[] = {0xEB, 0x35}; //JMP 35 jump end comand + 35 bytes
BYTE HackDetect_2[] = {0xEB, 0x35}; //JMP 35 jump end comand + 35 bytes
BYTE HackDetect_3[] = {0xEB, 0x35}; //JMP 35 jump end comand + 35 bytes
BYTE HackDetect_4[] = {0xEB, 0x1F}; //JMP 1F jump end comand + 1F bytes
BYTE HackDetect_5[] = {0xEB, 0x07}; //JMP 07 jump end comand + 07 bytes
BYTE DebugPresent[] = {0x90}; //NOP -- No operation
BYTE HackProcess1[] = {0xEB, 0x34}; //JMP 34 jump end comand + 34 bytes
BYTE HackProcess2[] = {0xEB, 0x2C}; //JMP 2C jump end comand + 2C bytes
BYTE HackProcess3[] = {0xEB, 0x09}; //JMP 09 jump end comand + 09 bytes
BYTE AbnormalBeha[] = {0xE9, 0x8A, //JMP 0x8A000000
0x00, 0x00, 0x00};
//Write To Memory
void WriteToMemory(DWORD Offset, DWORD Pointer, DWORD Length) {
DWORD OldProtection;
VirtualProtect((void *)Offset, Length, PAGE_EXECUTE_READWRITE, &OldProtection);
RtlMoveMemory( (void *)Offset, (const void*)Pointer, Length);
VirtualProtect((void *)Offset, Length, OldProtection, &OldProtection);
}
void ModifyMemory(BYTE *Offset, BYTE *ByteArray, DWORD Length) {
for(DWORD i = 0; i < Length; i++)
WriteToMemory((DWORD)Offset + i, (DWORD)ByteArray + i, 1);
}
void Bypass() {
/* OfssSet, VectorModifications, LenghtVector */
ModifyMemory((BYTE *)HACKDETECT_1, HackDetect_1, sizeof(HackDetect_1) );
ModifyMemory((BYTE *)HACKDETECT_2, HackDetect_2, sizeof(HackDetect_2) );
ModifyMemory((BYTE *)HACKDETECT_3, HackDetect_3, sizeof(HackDetect_3) );
ModifyMemory((BYTE *)HACKDETECT_4, HackDetect_4, sizeof(HackDetect_4) );
ModifyMemory((BYTE *)HACKDETECT_5, HackDetect_5, sizeof(HackDetect_5) );
ModifyMemory((BYTE *)DEBUGPRESENT, DebugPresent, sizeof(DebugPresent) );
ModifyMemory((BYTE *)HACKPROCESS1, HackProcess1, sizeof(HackProcess1) );
ModifyMemory((BYTE *)HACKPROCESS2, HackProcess2, sizeof(HackProcess2) );
ModifyMemory((BYTE *)HACKPROCESS3, HackProcess3, sizeof(HackProcess3) );
ModifyMemory((BYTE *)ABNORMALBEHA, AbnormalBeha, sizeof(AbnormalBeha) );
}
bool APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved) {
if(dwReason == DLL_PROCESS_ATTACH) {
DisableThreadLibraryCalls(hModule);
Bypass();
return true;
}
return true;
}