anti-anti-serverplugin codens

/*
** Server plugin bypass, lol
*/

#include <stdio.h>
#include <windows.h>
#include <Tlhelp32.h>
#include <conio.h>

static DWORD dwHl2ProcessId = NULL;
static HANDLE hl2 = NULL;
static HMODULE engine = NULL;

typedef struct {
	UINT8 data[ 256 ];
	char* mask;
} codepattern_t;


codepattern_t pattern_pluginloadcheck = {
	{
		0x81, 0xEC, 0x00, 0x02, 0x00, 0x00,
		0x80, 0x3D, 0x1C, 0xD3, 0x36, 0x10, 0x00,
		0x56,
		0x8B, 0xB4, 0x24, 0x08, 0x02, 0x00, 0x00,
		0x74, 0x7E
	},
	"xxxxxx"
	"xx????x"
	"x"
	"xxxxxxx"
	"xx",
};

/****************************************************************
FindPattern bullshit. This has been C&P'd so many times that
crediting the author would be a pointless exersize.

I added a struct for this ok
****************************************************************/

BOOL DataCompare( PBYTE pbData, PBYTE pbMask, char * szMask ){
	for( ; *szMask; ++szMask, ++pbData, ++pbMask )
		if( *szMask == 'x' && *pbData != *pbMask )
			return FALSE;

	return ( *szMask == NULL );
}

DWORD FindPattern( DWORD dwAddress, DWORD dwLen, PBYTE pbMask, char * szMask ){
	for( DWORD i = 0; i < dwLen; i++ )
		if( DataCompare( (PBYTE)( dwAddress + i ), pbMask, szMask ) )
			return (DWORD)( dwAddress + i );

	return 0;
}

DWORD FindSignature(UINT8* buffer, codepattern_t* sig) {
	if (!sig) return NULL;
	if (!sig->data || !sig->mask) return NULL;

	return FindPattern((DWORD)buffer,0x58F820,sig->data,sig->mask);
}


HMODULE GetEngineBase() {
	//if (!hl2 || !dwHl2ProcessId) return NULL;

	HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwHl2ProcessId );

	if (!hSnapshot) {
			return NULL;
	}

	MODULEENTRY32 modentry;

	modentry.dwSize = sizeof(MODULEENTRY32);

	BOOL hasModule = Module32First( hSnapshot, &modentry );
	while (hasModule) {
		cprintf("Module %s\n", modentry.szModule);
		if (strstr(modentry.szModule,"engine")) {
				CloseHandle(hSnapshot);
				return (HMODULE)modentry.modBaseAddr;
		}

		hasModule = Module32Next( hSnapshot, &modentry);
	}
	CloseHandle(hSnapshot);

	return NULL;

}

HANDLE OpenHL2() {
	HANDLE procsnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );

	if (!procsnapshot) {
			return NULL;
	}

	PROCESSENTRY32 procentry;

	procentry.dwSize = sizeof(PROCESSENTRY32);

	BOOL hasProcess = Process32First( procsnapshot, &procentry );
	while (hasProcess) {
		if (strstr(procentry.szExeFile, "hl2.exe")) {
				CloseHandle(procsnapshot);
				dwHl2ProcessId = procentry.th32ProcessID;
				return OpenProcess( PROCESS_ALL_ACCESS, FALSE, procentry.th32ProcessID );
		}
		hasProcess = Process32Next( procsnapshot, &procentry);
	}
	CloseHandle(procsnapshot);

	return NULL;
}


BOOL runBypasser = FALSE;
DWORD writeaddr  = 0;
void BypasserThread( ) {
	UINT8 value_on  = 0x00; // fake insecure mode
	UINT8 value_off = 0x01; // fake insecure mode

	while (runBypasser) {
			WriteProcessMemory( hl2, (LPVOID)writeaddr, &value_on, 1, NULL);
	}
	WriteProcessMemory( hl2, (LPVOID)writeaddr, &value_off, 1, NULL);
}

int CALLBACK WinMain(__in  HINSTANCE hInstance, __in  HINSTANCE hPrevInstance,
  __in  LPSTR lpCmdLine, __in  int nCmdShow
) {
	AllocConsole();

	// Open HL2.exe up
	hl2 = OpenHL2();
	if (!hl2) {
		MessageBoxA(NULL,"Could not access hl2.exe. Make sure your game is running.","Error", MB_OK);
		return 0;
	}

	// Get the engine base now
	engine = GetEngineBase();
	cprintf("Engine base %p\n", engine);
	if (!engine) {
		MessageBoxA(NULL,"Could not access the engine.","Error", MB_OK);
		return 0;
	}

	// Now try reading the memory
	UINT8* buffer = new UINT8[ 0x002A353A ];
	BOOL memread = ReadProcessMemory( hl2, engine, buffer, 0x002A353A, NULL );

	if (!memread) {
			MessageBoxA(NULL,"Could not find the anti-serverplugin code.","Error", MB_OK);
			return 0;
	}

	DWORD ptr = FindSignature( buffer, &pattern_pluginloadcheck );
	if (!ptr) {
			MessageBoxA(NULL,"Could not find the anti-serverplugin code.","Error", MB_OK);
			return 0;
	}

	DWORD process_ptr = (ptr - (DWORD)buffer);

	cprintf("Pattern was found at %p. that's %p\n", process_ptr + engine, process_ptr);

	memcpy( &writeaddr, buffer + process_ptr + 8 , 4);
	cprintf("Writing to 0x%p\n", writeaddr);


	runBypasser = TRUE;
	CreateThread( NULL, 1000, (LPTHREAD_START_ROUTINE)BypasserThread, NULL, NULL, NULL);

	MessageBoxA(NULL,"The bypass is now active. Load your serverplugins and press OK to disable the bypass. It is important that you disable the bypass, otherwise VAC will detect changes to the engine.","Bypass Active",MB_OK);


	runBypasser = FALSE;

	MessageBoxA(NULL,"Bypass disabled. Happy hacking!", "Success",MB_OK);

	return 0;
}