Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #define check1 0x??????
- #define check2 0x??????
- #define check3 0x??????
- #define check4 0x??????
- #define check5 0x??????
- #define check6 0x??????
- #define hackDetect_1 0x??????
- #define hackDetect_2 0x??????
- #define hackDetect_3 0x??????
- #define hackDetect_4 0x??????
- #define hackDetect_5 0x??????
- #define hackDetect_6 0x??????
- void WINAPIV DisconectFromServer()
- {
- __asm
- {
- MOV ECX, DWORD PTR DS:[ ESP + 0x4 ]
- XOR EAX, EAX
- CMP [ ESP + 0x8 ], EAX
- JMP RET_JE
- RET_JNZ: MOVZX EDX, BYTE PTR DS:[ ECX ]
- DEC [ ESP + 0x8 ]
- XOR EDX, EAX
- AND EDX, 0x0FF
- SHR EAX, 0x8
- XOR EAX, DWORD PTR DS:[ EDX*4 + 0x?????? ]
- INC ECX
- CMP [ ESP + 0x8 ], 0x0
- JNZ RET_JNZ
- RET_JE: NOT EAX
- }
- }
- void DetourCreateE8( BYTE *src, DWORD dst, DWORD len )
- {
- DWORD OldProtection, RealAddress;
- VirtualProtect( src, len, PAGE_EXECUTE_READWRITE, &OldProtection );
- RealAddress = ( DWORD ) ( ( dst + 1 ) - ( DWORD ) src ) - 5;
- *src = 0xE8;
- *( DWORD * ) ( src + 0x01 ) = RealAddress;
- VirtualProtect( src, len, OldProtection, 0 );
- return;
- }
- void check ()
- {
- DWORD Engine = (DWORD)GetModuleHandleA("crossfire.exe");
- memcpy((VOID*)( Engine + check1 ), "\xEB", 1);
- memcpy((VOID*)( Engine + check2 ), "\xEB", 1);
- memcpy((VOID*)( Engine + check3 ), "\xEB", 1);
- memcpy((VOID*)( Engine + check4 ), "\xEB", 1);
- memcpy((VOID*)( Engine + check5 ), "\xEB", 1);
- memcpy((VOID*)( Engine + check6 ), "\xEB", 1);
- }
- void CALLBypass ( )
- {
- check();
- DWORD Engine = (DWORD)GetModuleHandleA("crossfire.exe");
- DetourCreateE8( ( PBYTE ) ( Engine + hackDetect_1 ), ( DWORD ) DisconectFromServer, 5 );
- DetourCreateE8( ( PBYTE ) ( Engine + hackDetect_2 ), ( DWORD ) DisconectFromServer, 5 );
- DetourCreateE8( ( PBYTE ) ( Engine + hackDetect_3 ), ( DWORD ) DisconectFromServer, 5 );
- DetourCreateE8( ( PBYTE ) ( Engine + hackDetect_4 ), ( DWORD ) DisconectFromServer, 5 );
- DetourCreateE8( ( PBYTE ) ( Engine + hackDetect_5 ), ( DWORD ) DisconectFromServer, 5 );
- DetourCreateE8( ( PBYTE ) ( Engine + hackDetect_6 ), ( DWORD ) DisconectFromServer, 5 );
- }
- -----------------------------------------------------------------------------------------------------------
- attach crossfire.exe and right click change search for Comand paste this
- DEC [ ESP + 0x8 ]
- XOR EDX, EAX
- AND EDX, 0x0FF
- SHR EAX, 0x8
- u wiil get addres
- DEC [ ESP + 0x8 ]
- XOR EDX, EAX
- AND EDX, 0x0FF
- SHR EAX, 0x8
- XOR EAX, DWORD PTR DS:[ EDX*4 +0x??????? ]
- ----------------------------------------------------------------------------------------------------------------------
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement