HackShield Bypass v5.7.20.616 JMS

/*
    HackShield Bypass for v5.7.20.616 JMS v342.1
    by Riremito (AIRRIDE)
*/
#include"HackShield.h"
#include"MapleStory.h"
#include"gui.h"


DWORD EHSvc_MemoryDump, EHSvc_Start, EHSvc_End;

DWORD HSCRC1_Ret, HSCRC2_Ret, HSCRC3_Ret, HSCRC4_Ret, HSCRC_Client_Ret;

void _declspec(naked) HSCRC1_Hook(){
    _asm{
        cmp ecx,[EHSvc_Start]
        jb Ending_HSCRC1
        cmp ecx,[EHSvc_End]
        ja Ending_HSCRC1
        sub ecx,[EHSvc_Start]
        add ecx,[EHSvc_MemoryDump]
Ending_HSCRC1:
        mov dl,[ecx]
        xor eax,edx
        mov ecx,[ebp+0x10]
        jmp dword ptr [HSCRC1_Ret]
    }
}

void _declspec(naked) HSCRC2_Hook(){
    _asm{
        cmp ebx,[EHSvc_Start]
        jb Ending_HSCRC2
        cmp ebx,[EHSvc_End]
        ja Ending_HSCRC2
        sub ebx,[EHSvc_Start]
        add ebx,[EHSvc_MemoryDump]
Ending_HSCRC2:
        add al,[ebx]
        pop ebx
        push 0x00007827
        jmp dword ptr [HSCRC2_Ret]
    }
}

void _declspec(naked) HSCRC3_Hook(){
    _asm{
        cmp edi,[EHSvc_Start]
        jb Ending_HSCRC3
        cmp edi,[EHSvc_End]
        ja Ending_HSCRC3
        push eax
        mov eax,edi
        sub eax,[EHSvc_Start]
        cmp eax,0x100000
        jb Ending_HSCRC3_2
        /*cmp eax,0x9C852 - 0x10
        jb Ending_HSCRC3_1
        cmp eax,0x9C852 + 0x10
        jb Ending_HSCRC3_2
        */
        cmp eax,0x4AAE69 - 0x10
        jb Ending_HSCRC3_1
        cmp eax,0x4AAE69 + 0x10
        ja Ending_HSCRC3_1
Ending_HSCRC3_2:
        sub edi,[EHSvc_Start]
        add edi,[EHSvc_MemoryDump]
Ending_HSCRC3_1:
        pop eax
Ending_HSCRC3:
        mov edi,[edi]
        movzx edx,word ptr [edx]
        jmp dword ptr [HSCRC3_Ret]
    }
}

void _declspec(naked) HSCRC4_Hook(){
    _asm{
        cmp esi,[EHSvc_Start]
        jb Ending_HSCRC4
        cmp esi,[EHSvc_End]
        ja Ending_HSCRC4
        push eax
        mov eax,esi
        sub eax,[EHSvc_Start]
        cmp eax,0x100000
        jb Ending_HSCRC4_2
        /*
        cmp eax,0x9C852 - 0x10
        jb Ending_HSCRC4_1
        cmp eax,0x9C852 + 0x10
        jb Ending_HSCRC4_2
        */
        cmp eax,0x4AAE69 - 0x10
        jb Ending_HSCRC4_1
        cmp eax,0x4AAE69 + 0x10
        ja Ending_HSCRC4_1
Ending_HSCRC4_2:
        sub esi,[EHSvc_Start]
        add esi,[EHSvc_MemoryDump]
Ending_HSCRC4_1:
        pop eax
Ending_HSCRC4:
        mov esi,[esi]
        add [edi],esi
        pushfd
        jmp dword ptr [HSCRC4_Ret]
    }
}


void _declspec(naked) HSCRC_Client_Hook(){
    _asm{
        push esi
        cmp esi,[Memory_Start]
        jb Ending_
        cmp esi,[Memory_End]
        ja Ending_
        sub esi,[Memory_Start]
        add esi,[Memory]
Ending_:
        lea edi,[ebp-0x1228]
        repe movsd
        pop esi
        jmp dword ptr [HSCRC_Client_Ret]
    }
}

void _declspec(naked) HSCRC_Dynamic1_Hook(){
    _asm{
        //+0x186
        xor ebx,ebx
        push eax
        mov eax,ecx
        cmp eax,[EHSvc_Start]
        jb HDH1_End
        cmp eax,[EHSvc_End]
        ja HDH1_End
        sub eax,[EHSvc_Start]
        add eax,[EHSvc_MemoryDump]
HDH1_End:
        mov bl,[eax]
        pop eax
        xor edx,ebx
        ret
    }
}

void _declspec(naked) HSCRC_Dynamic2_Hook(){
    _asm{
        //+0x15A
        push ecx
        mov ecx,eax
        cmp ecx,[EHSvc_Start]
        jb HDH2_End
        cmp ecx,[EHSvc_End]
        ja HDH2_End
        sub ecx,[EHSvc_Start]
        add ecx,[EHSvc_MemoryDump]
HDH2_End:
        mov dl,[ecx]
        pop ecx
        add [ebp-0x28],edx
        ret
    }
}

void _declspec(naked) HSCRC_Dynamic3_Hook(){
    _asm{
        //+0x15A
        push ecx
        mov ecx,eax
        cmp ecx,[EHSvc_Start]
        jb HDH3_End
        cmp ecx,[EHSvc_End]
        ja HDH3_End
        sub ecx,[EHSvc_Start]
        add ecx,[EHSvc_MemoryDump]
HDH3_End:
        mov dl,[ecx]
        pop ecx
        add dword ptr [ebp-0x24],edx
        ret
    }
}

void _declspec(naked) HSCRC_Dynamic4_Hook(){
    _asm{
        push ecx
        mov ecx,eax
        cmp ecx,[EHSvc_Start]
        jb HDH4_End
        cmp ecx,[EHSvc_End]
        ja HDH4_End
        sub ecx,[EHSvc_Start]
        add ecx,[EHSvc_MemoryDump]
HDH4_End:
        mov dl,[ecx]
        pop ecx
        xor dword ptr [ebp-0x24],edx
        ret
    }
}


void _declspec(naked) Hidden_Call_Hook(){
    _asm{
        pop eax
        popfd
        push eax
        mov eax,[esp+0x04]
        cmp dword ptr [eax+0x33],0x0FFFFFFF
        je Justin
        cmp dword ptr [eax+0x3F],0xF88B0A74
        je Bieber
        cmp dword ptr [eax+0x32],0x83AB3FD1
        je Taylor
        jmp HCH_Ending
Justin:
        /*
        mov byte ptr [eax+0x60],0xEB//short jmp
        mov byte ptr [eax+0x88],0xEB//short jmp
        mov byte ptr [eax+0xB0],0xEB//short jmp
        mov byte ptr [eax+0xD8],0xEB//short jmp
        mov byte ptr [eax+0x100],0xEB//short jmp
        mov word ptr [eax+0x135],0x9090//nop
        mov byte ptr [eax+0x139],0xEB//short jmp
        */
        mov byte ptr [eax+0x186],0xE8//call
        push ebx
        mov ebx,HSCRC_Dynamic1_Hook
        mov dword ptr [eax+0x187],ebx
        pop ebx
        sub dword ptr [eax+0x187],eax
        sub dword ptr [eax+0x187],0x186
        sub dword ptr [eax+0x187],0x05
        mov byte ptr [eax+0x18B],0x90
        jmp HCH_Ending
Bieber:
        /*
        mov byte ptr [eax+0x55],0xEB//short jmp
        mov byte ptr [eax+0x7C],0xEB//short jmp
        mov byte ptr [eax+0xA4],0xEB//short jmp
        mov byte ptr [eax+0xCC],0xEB//short jmp
        mov byte ptr [eax+0xF3],0xEB//short jmp
        mov word ptr [eax+0x120],0x9090//nop
        mov byte ptr [eax+0x125],0xEB//short jmp
        */
        mov byte ptr [eax+0x15A],0xE8//call
        push ebx
        mov ebx,HSCRC_Dynamic2_Hook
        mov dword ptr [eax+0x15B],ebx
        pop ebx
        sub dword ptr [eax+0x15B],eax
        sub dword ptr [eax+0x15B],0x15A
        sub dword ptr [eax+0x15B],0x05
        jmp HCH_Ending
Taylor:
        mov byte ptr [eax+0x169],0xE8//call
        push ebx
        mov ebx,HSCRC_Dynamic3_Hook
        mov dword ptr [eax+0x16A],ebx
        pop ebx
        sub dword ptr [eax+0x16A],eax
        sub dword ptr [eax+0x16A],0x169
        sub dword ptr [eax+0x16A],0x05
        mov byte ptr [eax+0x176],0xE8//call
        push ebx
        mov ebx,HSCRC_Dynamic4_Hook
        mov dword ptr [eax+0x177],ebx
        pop ebx
        sub dword ptr [eax+0x177],eax
        sub dword ptr [eax+0x177],0x176
        sub dword ptr [eax+0x177],0x05
        jmp HCH_Ending
HCH_Ending:
        pop eax
        ret 0x0000
    }
}


void HackShieldBypass(){
    char TargetLibFileName[] = "HShield/EHSvc.dll";
    HMODULE hDLL = LoadLibraryA(TargetLibFileName);

    if(hDLL){
        AW.AddFormatString(EDIT_LOG, "%sは%dに読み込まれました\r\n", TargetLibFileName, hDLL);
    }
    else{
        AW.AddFormatString(EDIT_LOG, "%sの読み込みに失敗しました\r\n", TargetLibFileName);
        return;
    }

    AirMemory EHSvc;

    EHSvc.Init("EHSvc.dll");
    EHSvc.CreateMemoryDump();
    EHSvc.GetDumpInfo(&EHSvc_Start, &EHSvc_End, &EHSvc_MemoryDump);
    AW.AddFormatString(EDIT_LOG, "メモリダンプを%dに生成しました\r\n", EHSvc_MemoryDump);

    EHSvc.WriteHook(0x9C852, JMP, HSCRC1_Hook, &HSCRC1_Ret, 2);//HSCRC1
    EHSvc.WriteHook(0x4AAE69, JMP, HSCRC2_Hook, &HSCRC2_Ret, 3);//HSCRC2

    EHSvc.WriteHook(0x26F0C7, JMP, HSCRC3_Hook, &HSCRC3_Ret);//HSCRC3
    EHSvc.WriteHook(0x36FB0C, JMP, HSCRC4_Hook, &HSCRC4_Ret);//HSCRC4
    EHSvc.MemoryWriter(0x31FE71, "39 C0");//HSCRC5

    EHSvc.WriteHook(0x41617, JMP, HSCRC_Client_Hook, &HSCRC_Client_Ret, 3);//HSCRC_Client

    //HSCRC5_Dynamic
    DWORD HiddenCall;
    do{
        HiddenCall = EHSvc.AobScan("58 9D C2 00 00");
        if(HiddenCall){
            EHSvc.WriteHook(HiddenCall, JMP, Hidden_Call_Hook);
        }
    }while(HiddenCall);


    EHSvc.MemoryWriter(0x579B0, "31 C0 C2 04 00");//Process Scanner
    EHSvc.MemoryWriter(0x5E670, "31 C0 C2 04 00");//Module Scanner

    EHSvc.MemoryWriter(0x11C00, "31 C0 C3");//HardwareBreakPoint Detection(Main)
    EHSvc.MemoryWriter(0x101C0, "31 C0 C3");//HardwareBreakPoint Detection2
    EHSvc.MemoryWriter(0x103B0, "31 C0 C3");//HardwareBreakPoint Detection3
    EHSvc.MemoryWriter(0x10B70, "31 C0 C2 18 00");//HardwareBreakPoint Detection4

    EHSvc.MemoryWriter(0x788F0, "31 C0 C3");//SoftwareBreakPoint Detection

    EHSvc.MemoryWriter(0xDBF9D, "B8 00 00 00 00");//Memory Protection

    AW.AddString(EDIT_LOG, "HackShield 回避コードを書き込みました\r\n");
}