HackShield Bypass v5.6.34.449 and v5.7.6.502

WRYYYYYYYYYYYYYYYYYYYーッ
x64環境でのみきちんと動作します
x86環境で使う場合はMemory Protectionを無効にしないと
OpenProcessをドライバロード後に行うとBSODします
by AIRRIDE (リレミト)
SkypeID:C20400
http://otthts.blog.fc2.com/

//v5.6.34.449
DWORD HS_Memory, HS_Memory_Start, HS_Memory_End;
DWORD HSCRC1_Ret, HSCRC2_Ret, HSCRC3_Ret, HSCRC4_Ret;

void _declspec(naked) HSCRC1_Hook(){
    _asm{
        cmp ecx,[HS_Memory_Start]
        jb Ending_HSCRC1
        cmp ecx,[HS_Memory_End]
        ja Ending_HSCRC1
        sub ecx,[HS_Memory_Start]
        add ecx,[HS_Memory]
Ending_HSCRC1:
        mov dl,[ecx]
        xor eax,edx
        mov ecx,[ebp+0x10]
        jmp dword ptr [HSCRC1_Ret]
    }
}

void _declspec(naked) HSCRC2_Hook(){
    _asm{
        cmp ebx,[HS_Memory_Start]
        jb Ending_HSCRC2
        cmp ebx,[HS_Memory_End]
        ja Ending_HSCRC2
        sub ebx,[HS_Memory_Start]
        add ebx,[HS_Memory]
Ending_HSCRC2:
        add al,[ebx]
        pop ebx
        push edx
        mov dh,-0x78
        jmp dword ptr [HSCRC2_Ret]
    }
}

void _declspec(naked) HSCRC3_Hook(){
    _asm{
        cmp edx,[HS_Memory_Start]
        jb Ending_HSCRC3
        cmp edx,[HS_Memory_End]
        ja Ending_HSCRC3
        push edx
        sub edx,[HS_Memory_Start]
        cmp edx,0x902A2 - 0x100
        jb Ending_HSCRC3_2
        cmp edx,0x35DBB9 + 0x100
        ja Ending_HSCRC3_2
        cmp edx,0x902A2 + 0x100
        jb Ending_HSCRC3_1
        cmp edx,0x35DBB9 - 0x100
        ja Ending_HSCRC3_1
        jmp Ending_HSCRC3_2
Ending_HSCRC3_1:
        add edx,[HS_Memory]
        mov edx,[edx]
        mov dword ptr [esp+0x04],edx
Ending_HSCRC3_2:
        pop edx
Ending_HSCRC3:
        jmp dword ptr [HSCRC3_Ret]
    }
}

void _declspec(naked) HSCRC4_Hook(){
    _asm{
        push esi
        cmp esi,[Memory_Start]
        jb Ending_
        cmp esi,[Memory_End]
        ja Ending_
        sub esi,[Memory_Start]
        add esi,[Memory]
Ending_:
        lea edi,[ebp-0x1228]
        repe movsd
        pop esi
        jmp dword ptr [HSCRC4_Ret]
    }
}

void HSCRC5_TableHack(DWORD dwHSCRC5_Table){
    int i;
    for(i=0; i<3; i++){
        *(DWORD *)(dwHSCRC5_Table + i*8) = ((*(DWORD *)(dwHSCRC5_Table + i*8)^*(DWORD *)(dwHSCRC5_Table + 0x18)) - HS_Memory_Start + HS_Memory)^(*(DWORD *)(dwHSCRC5_Table + 0x18));
    }
}

void HackShieldBypass(){

    while(!GetModuleHandleA("EHSvc.dll")){
        Sleep(100);
    }

    DWORD EHSvc = (DWORD)GetModuleHandleA("EHSvc.dll");

    Air::CreateMemoryDump(&HS_Memory, &HS_Memory_Start, &HS_Memory_End, "EHSvc.dll");

    Air::WriteJumpAtModule("EHSvc.dll", 0x902A2, (DWORD)HSCRC1_Hook, &HSCRC1_Ret, 2);//HSCRC1
    Air::WriteJumpAtModule("EHSvc.dll", 0x35DBB9, (DWORD)HSCRC2_Hook, &HSCRC2_Ret, 1);//HSCRC2
    Air::WriteJumpAtModule("EHSvc.dll", 0x2578AE, (DWORD)HSCRC3_Hook);//HSCRC3
    HSCRC3_Ret = EHSvc + 0x24FAD3;
    Air::WriteJumpAtModule("EHSvc.dll", 0x38A37, (DWORD)HSCRC4_Hook, &HSCRC4_Ret, 3);//HSCRC4
    HSCRC5_TableHack(EHSvc + 0x153040);
    Air::WriteCodeAtModule("EHSvc.dll", 0x4DB20, "31 C0 C2 04 00");//Process Scanner
    Air::WriteCodeAtModule("EHSvc.dll", 0x548F0, "31 C0 C2 04 00");//Module Scanner
    Air::WriteCodeAtModule("EHSvc.dll", 0x10AE0, "31 C0 C3");//HardwareBreakPoint Detection(Main)
    Air::WriteCodeAtModule("EHSvc.dll", 0xF240, "31 C0 C3");//HardwareBreakPoint Detection2
    Air::WriteCodeAtModule("EHSvc.dll", 0xF430, "31 C0 C3");//HardwareBreakPoint Detection3
    Air::WriteCodeAtModule("EHSvc.dll", 0xFBC0, "31 C0 C2 18 00");//HardwareBreakPoint Detection4
    Air::WriteCodeAtModule("EHSvc.dll", 0x6DCB0, "31 C0 C3");//SoftwareBreakPoint Detection
    Air::WriteCodeAtModule("EHSvc.dll", 0xCA642, "B8 00 00 00 00");//Memory Protection

}

//v5.7.6.502
DWORD HS_Memory, HS_Memory_Start, HS_Memory_End;
DWORD HSCRC1_Ret, HSCRC2_Ret, HSCRC3_Ret, HSCRC4_Ret;

void _declspec(naked) HSCRC1_Hook(){
    _asm{
        cmp ecx,[HS_Memory_Start]
        jb Ending_HSCRC1
        cmp ecx,[HS_Memory_End]
        ja Ending_HSCRC1
        sub ecx,[HS_Memory_Start]
        add ecx,[HS_Memory]
Ending_HSCRC1:
        mov dl,[ecx]
        xor eax,edx
        mov ecx,[ebp+0x10]
        jmp dword ptr [HSCRC1_Ret]
    }
}

void _declspec(naked) HSCRC2_Hook(){
    _asm{
        cmp ebx,[HS_Memory_Start]
        jb Ending_HSCRC2
        cmp ebx,[HS_Memory_End]
        ja Ending_HSCRC2
        sub ebx,[HS_Memory_Start]
        add ebx,[HS_Memory]
Ending_HSCRC2:
        add al,[ebx]
        mov ebx,[esp]
        jmp dword ptr [HSCRC2_Ret]
    }
}

void _declspec(naked) HSCRC3_Hook(){
    _asm{
        cmp edx,[HS_Memory_Start]
        jb Ending_HSCRC3
        cmp edx,[HS_Memory_End]
        ja Ending_HSCRC3
        push edx
        sub edx,[HS_Memory_Start]
        cmp edx,0x92812 - 0x100
        jb Ending_HSCRC3_2
        cmp edx,0x360040 + 0x100
        ja Ending_HSCRC3_2
        cmp edx,0x92812 + 0x100
        jb Ending_HSCRC3_1
        cmp edx,0x360040 - 0x100
        ja Ending_HSCRC3_1
        jmp Ending_HSCRC3_2
Ending_HSCRC3_1:
        add edx,[HS_Memory]
        mov edx,[edx]
        mov dword ptr [esp+0x04],edx
Ending_HSCRC3_2:
        pop edx
Ending_HSCRC3:
        jmp dword ptr [HSCRC3_Ret]
    }
}

void _declspec(naked) HSCRC4_Hook(){
    _asm{
        push esi
        cmp esi,[Memory_Start]
        jb Ending_
        cmp esi,[Memory_End]
        ja Ending_
        sub esi,[Memory_Start]
        add esi,[Memory]
Ending_:
        lea edi,[ebp-0x1228]
        repe movsd
        pop esi
        jmp dword ptr [HSCRC4_Ret]
    }
}

void HSCRC5_TableHack(DWORD dwHSCRC5_Table){
    int i;
    for(i=0; i<4; i++){
        *(DWORD *)(dwHSCRC5_Table + i*8) = ((*(DWORD *)(dwHSCRC5_Table + i*8)^*(DWORD *)(dwHSCRC5_Table + 0x24)) - HS_Memory_Start + HS_Memory)^(*(DWORD *)(dwHSCRC5_Table + 0x24));
    }
}

void HackShieldBypass(){

    while(!GetModuleHandleA("EHSvc.dll")){
        Sleep(100);
    }

    DWORD EHSvc = (DWORD)GetModuleHandleA("EHSvc.dll");

    Air::CreateMemoryDump(&HS_Memory, &HS_Memory_Start, &HS_Memory_End, "EHSvc.dll");

    Air::WriteJumpAtModule("EHSvc.dll", 0x92812, (DWORD)HSCRC1_Hook, &HSCRC1_Ret, 2);//HSCRC1
    Air::WriteJumpAtModule("EHSvc.dll", 0x360040, (DWORD)HSCRC2_Hook, &HSCRC2_Ret);//HSCRC2
    Air::WriteJumpAtModule("EHSvc.dll", 0x26005E+2, (DWORD)HSCRC3_Hook);//HSCRC3
    HSCRC3_Ret = EHSvc + 0x2528EB;
    Air::WriteJumpAtModule("EHSvc.dll", 0x39ED7, (DWORD)HSCRC4_Hook, &HSCRC4_Ret, 3);//HSCRC4
    HSCRC5_TableHack(EHSvc + 0x157048);
    Air::WriteCodeAtModule("EHSvc.dll", 0x4F5B0, "31 C0 C2 04 00");//Process Scanner
    Air::WriteCodeAtModule("EHSvc.dll", 0x56380, "31 C0 C2 04 00");//Module Scanner
    Air::WriteCodeAtModule("EHSvc.dll", 0x10E20, "31 C0 C3");//HardwareBreakPoint Detection(Main)
    Air::WriteCodeAtModule("EHSvc.dll", 0xF550, "31 C0 C3");//HardwareBreakPoint Detection2
    Air::WriteCodeAtModule("EHSvc.dll", 0xF740, "31 C0 C3");//HardwareBreakPoint Detection3
    Air::WriteCodeAtModule("EHSvc.dll", 0xFED0, "31 C0 C2 18 00");//HardwareBreakPoint Detection4

    Air::WriteCodeAtModule("EHSvc.dll", 0x70140, "31 C0 C3");//SoftwareBreakPoint Detection
    Air::WriteCodeAtModule("EHSvc.dll", 0xCEB67, "B8 00 00 00 00");//Memory Protection
}


すまん　同じの2つ今書いてた
編集しといたですたい