Question[HELP] Xtrap Bypass Code

Posts 13 of 3 · Page 1 of 1
[HELP] Xtrap Bypass Code
Hello guys, eu estava pesquisando mais sobre hacks para ver quais funções(ou métodos) da WinApi aprender e me deparei com esse código, apenas gostaria de saber se é dessa forma que se faz um bypass.
Créditos: Vitrix Maggot(Criação Total do source).
Eu apenas dei uma organizada(pesquisem) estava tudo muito bagunçado é confuso(coloque em uma font mono espaçada).
Code:

/*********************************************************************
**  XTrap Bypass Vitrix Maggot ~ Revised: StroopeR[MPGH] 4/9d/2015	**
**********************************************************************
** Hacking Detected                                                 **
** ---------------------------------------------------------------- **
** 00435FA6	EB 35 All referenced text string, 'Hacking detected'    **
**	One line, up, change JNZ to JMP                                 **
** 0043CE36	EB 35 All referenced text string, 'Hacking detected'    **
**	One line, up, change JNZ to JMP                                 **
** 0043DCF0	EB 35 All referenced text string, 'Hacking detected'    **
**	One line, up, change JNZ to JMP                                 **
** 0043DCD1	EB 1F All referenced text string, 'Hacking detected'    **
**	Jump #1 change JNZ to JMP                                       **
** 0043DCE9	EB 07 All referenced text string, 'Hacking detected'    **
**	Jump #2 change JNZ to JMP                                       **
**********************************************************************
** IsDebuggerPresent                                                **
** ---------------------------------------------------------------- **
** 00499517	90 Go to IsDebuggerPresent, do down and NOP first JNZ   **
**********************************************************************
** ZCheckHackProcess                                                **
** ---------------------------------------------------------------- **
** 00441E35 EB 34 All referenced text string, 'Hacking Detected'    **
**	go up till start of function (PUSH -1),                         **
**	go to the local call, under it theres a                         **
**	TEST AL,AL, go down one more line, (JNZ) change                 **
**	it to JMP	(Do this for all 3 'Hacking Detected'               **
** 00441E62 EB 2C                                                   **
** 00441EBD EB 09                                                   **
**********************************************************************
** Abnormal Behavior                                                **
** ---------------------------------------------------------------- **
** 00440353 E9 8A 00 00 00 All referenced text strings,             **
**	'An abnormal behavior is detected.',                            **
**	go up 2 lines, change the JE to JMP                             **
*********************************************************************/

#include <windows.h>

/* Andress for functions */
#define HACKDETECT_1	0x00435FA6
#define HACKDETECT_2	0x0043CE36
#define HACKDETECT_3	0x0043DCF0
#define HACKDETECT_4	0x0043DCD1
#define HACKDETECT_5	0x0043DCE9
#define DEBUGPRESENT	0x00499517
#define HACKPROCESS1	0x00441E35
#define HACKPROCESS2	0x00441E62
#define HACKPROCESS3	0x00441EBD
#define ABNORMALBEHA	0x00440353

/* Modifications */
BYTE HackDetect_1[] = {0xEB, 0x35}; //JMP 35  jump end comand + 35 bytes
BYTE HackDetect_2[] = {0xEB, 0x35}; //JMP 35  jump end comand + 35 bytes
BYTE HackDetect_3[] = {0xEB, 0x35}; //JMP 35  jump end comand + 35 bytes
BYTE HackDetect_4[] = {0xEB, 0x1F}; //JMP 1F  jump end comand + 1F bytes
BYTE HackDetect_5[] = {0xEB, 0x07}; //JMP 07  jump end comand + 07 bytes
BYTE DebugPresent[] = {0x90};       //NOP --				No operation
BYTE HackProcess1[] = {0xEB, 0x34}; //JMP 34  jump end comand + 34 bytes
BYTE HackProcess2[] = {0xEB, 0x2C}; //JMP 2C  jump end comand + 2C bytes
BYTE HackProcess3[] = {0xEB, 0x09}; //JMP 09  jump end comand + 09 bytes
BYTE AbnormalBeha[] = {0xE9, 0x8A,  //JMP 0x8A000000
                       0x00, 0x00, 0x00};	

//Write To Memory
void WriteToMemory(DWORD Offset, DWORD Pointer, DWORD Length) {
	DWORD OldProtection;
	VirtualProtect((void *)Offset, Length, PAGE_EXECUTE_READWRITE, &OldProtection);
	RtlMoveMemory( (void *)Offset, (const void*)Pointer, Length);
	VirtualProtect((void *)Offset, Length, OldProtection, &OldProtection);
}

void ModifyMemory(BYTE *Offset, BYTE *ByteArray, DWORD Length) {
	for(DWORD i = 0; i < Length; i++)
		WriteToMemory((DWORD)Offset + i, (DWORD)ByteArray + i, 1);
}

void Bypass() {
	/* OfssSet, VectorModifications, LenghtVector */
	ModifyMemory((BYTE *)HACKDETECT_1, HackDetect_1, sizeof(HackDetect_1) );
	ModifyMemory((BYTE *)HACKDETECT_2, HackDetect_2, sizeof(HackDetect_2) );
	ModifyMemory((BYTE *)HACKDETECT_3, HackDetect_3, sizeof(HackDetect_3) );
	ModifyMemory((BYTE *)HACKDETECT_4, HackDetect_4, sizeof(HackDetect_4) );
	ModifyMemory((BYTE *)HACKDETECT_5, HackDetect_5, sizeof(HackDetect_5) );
	ModifyMemory((BYTE *)DEBUGPRESENT, DebugPresent, sizeof(DebugPresent) );
	ModifyMemory((BYTE *)HACKPROCESS1, HackProcess1, sizeof(HackProcess1) );
	ModifyMemory((BYTE *)HACKPROCESS2, HackProcess2, sizeof(HackProcess2) );
	ModifyMemory((BYTE *)HACKPROCESS3, HackProcess3, sizeof(HackProcess3) );
	ModifyMemory((BYTE *)ABNORMALBEHA, AbnormalBeha, sizeof(AbnormalBeha) );
}

bool APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved) {
	if(dwReason == DLL_PROCESS_ATTACH) {
		DisableThreadLibraryCalls(hModule);
		Bypass();
		return true;
	}
	return true;
}
Nothing can help-me?
Posts 13 of 3 · Page 1 of 1

Post a Reply

Similar Threads

Tags for this Thread

None

Need help?