Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /*
- Themidas hidden call fucker
- created by Riremito
- */
- [Enable]
- Alloc(Themida_Fucker, 1024)
- Label(Hook_Hidden_Call)
- Label(HHC_C1)
- Label(HHC_Next)
- Label(HHC_Exit)
- Label(Hidden_Call_Hook)
- Label(BreakPoint)
- RegisterSymbol(BreakPoint)
- CreateThread(Hook_Hidden_Call)
- Themida_Fucker:
- Hook_Hidden_Call:
- mov ecx,EHSvc.dll//address start
- HHC_C1:
- cmp ecx,EHSvc.dll+3AC05E//address end
- ja HHC_Exit
- cmp byte ptr [ecx],58//pop eax
- jne HHC_Next
- cmp [ecx+1],0000C29D//popfd ret 0000
- jne HHC_Next
- mov [ecx],E9//jmp
- mov eax,Hidden_Call_Hook
- sub eax,ecx
- sub eax,5
- mov [ecx+1],eax//FunctionAddress - HookAddress - 5
- HHC_Next:
- inc ecx
- jmp HHC_C1
- HHC_Exit:
- ret
- Hidden_Call_Hook://write hook code here
- pop eax
- popfd
- push eax
- mov eax,[esp+4]//function address
- cmp [eax+33],0FFFFFFF
- pop eax
- je BreakPoint
- ret 0000
- BreakPoint:
- nop
- nop
- nop
- nop
- nop
- ret 0000
- [Disable]
- UnRegisterSymbol(BreakPoint)
- DeAlloc(Themida_Fucker)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement