ksophon Bypass

@echo off
title ToF ksphon_x64 Bypass

:: BatchGotAdmin
:-------------------------------------
REM  --> Check for permissions
    IF "%PROCESSOR_ARCHITECTURE%" EQU "amd64" (
>nul 2>&1 "%SYSTEMROOT%\SysWOW64\cacls.exe" "%SYSTEMROOT%\SysWOW64\config\system"
) ELSE (
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"
)

REM --> If error flag set, we do not have admin.
if '%errorlevel%' NEQ '0' (
    echo Requesting administrative privileges...
    goto UACPrompt
) else ( goto gotAdmin )

:UACPrompt
    echo Set UAC = CreateObject^("Shell.Application"^) > "%temp%\getadmin.vbs"
    set params= %*
    echo UAC.ShellExecute "cmd.exe", "/c ""%~s0"" %params:"=""%", "", "runas", 1 >> "%temp%\getadmin.vbs"

    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
    exit /B

:gotAdmin
    pushd "%CD%"
    CD /D "%~dp0"
:--------------------------------------

echo Select an action:
echo [1] Bypass ksphon_x64
echo [2] Restore ksphon_x64
set /p action="Input: "
echo.

if /I "%action%"=="1" goto bypass
goto restore

:bypass
    set "file=C:\Windows\System32\drivers\ksophon_x64.sys"
    FOR %%A IN (%file%) DO set size=%%~zA
    if %size% GTR 5000000 (
        echo Backing up original ksophon_x64.sys...
        copy C:\Windows\System32\drivers\ksophon_x64.sys C:\Windows\System32\drivers\ksophon_x64.sys.bak
        echo Deleting original ksophon_x64.sys...
        del C:\Windows\System32\drivers\ksophon_x64.sys
        echo Copying null.sys as new ksophon_x64.sys...
        copy C:\Windows\System32\drivers\null.sys C:\Windows\System32\drivers\ksophon_x64.sys
        echo Setting new ksophon_x64.sys to read only
        attrib +r C:\Windows\System32\drivers\ksophon_x64.sys
        echo Copying new ksophon_x64.sys to ToF Folder
        copy C:\Windows\System32\drivers\ksophon_x64.sys "E:\Games\Tower Of Fantasy\Hotta\Binaries\Win64\ksophon_x64.sys"
        attrib +r "E:\Games\Tower Of Fantasy\Hotta\Binaries\Win64\ksophon_x64.sys"
    )else (
        echo ksophon_x64.sys already bypassed...
    )
    goto close

:restore
    if exist C:\Windows\System32\drivers\ksophon_x64.sys.bak (
        echo Deleting bypassed ksophon_x64.sys...
        del /f C:\Windows\System32\drivers\ksophon_x64.sys
        del /f "E:\Games\Tower Of Fantasy\Hotta\Binaries\Win64\ksophon_x64.sys"
        echo Restoring backup...
        ren C:\Windows\System32\drivers\ksophon_x64.sys.bak ksophon_x64.sys
    ) else (
        echo ksophon_x64 was not previously bypassed...
    )
    goto close

:close
    echo.
    pause