webviewer bypass method

//HOW2DEMOLISH THE WEBVIEWER INSTALLER FROM ROBLOZ 🤩
//by 74235#5450
//this tutorial isnt pretty much done though
//btw the webviewer archive is coming at 00559844 data segment

//converting webview pointers into void data segment

00559844  void* data_559844 = 0x650057
00559848  void* data_559848 = 0x560062
0055984c  void* data_55984c = 0x650069
00559850  void* data_559850 = 0x320077
00559854  void* data_559854 = 0x7a002e
00559858  void* data_559858 = 0x700069

//make function at 0x650057 segment Default (windows-x86) P
//the result must look like or atleast be simillar to this:

00559844  char* __convention("regparm") sub_559844(int32_t* arg1, char* arg2, char* arg3, char* arg4 @ ebp,
00559844      uint8_t* arg5 @ esi, char* arg6 @ edi, char* arg7, char* arg8, int32_t arg9)

//remove converted void data segments from function cuz they're letters of download string (00559844,
00559848( this nigga is caller of eax "__bound_gprv_mema32(eax, [eax].q) , 0055984a,
0055984b, 0055984e, 00559852, 00559854, 00559858(this nigga gets 0x70 so demolish him)
// remove last pushers from function
// the pushers are
   9 @ 0055985e  [eax].b = [eax].b + al
  10 @ 00559860  push(edi)  // esp after: StackFrameOffset: -0xc
  11 @ 00559861  [ebp].b = [ebp].b + ah

//we affected readable data segment but we gonna fix it through calling our data segment in debugger
//if debugger gives no error log then you're fine because data segment isnt corrupted

//save the database and re-open it
//check if your void webviewer data segments has different data number segment
//for me its - 00559284, 0055928c, 00559290, 00559294, 00559298, 0055929c, 005592a0, 005592a4,
005592a8, 005592ac, 005592b0
//they all refer either to empty segments or undefined/nonreadable seggs
00559284  void* data_559284 = 0x650057
//for example this void data refers to undefined segment which is 0x650057 (empty segment)

// the StackFrameOffset: 0x18 block entry has data pushers of webviewer
// so we also demolish the pushers because they gonna restore data incase
  27 @ 00559893  [edi].b = [edi].b + dl
// this pusher refers to webviewerruntime.zip so we must delete it
// after deleting this pusher the WebView2Runtime.zip dissapears from disassembled strings

//Next we disable isWebView2InstallEnabled
data_562558
//this is iswebview2installenabled data segment
//we must change data type to [0x0] to remove string
//undefine variable and convert it to void data segment

0x65577369, 0x65695662, 0x6e493277, 0x6c617473, 0x616e456c,
0x616e456c, 0x64656c62, 0x0

//those are AES codes of each part of our segment converted to void data
//change type of void datas above 0x0 to Pointer (everything except 0x0 because its nil)
//select our data segments and make a windowsx86 function

00562574  temp2.d = [ebx + 0x57 {0x57}].d //thus segment cannot generate IL flag so terminate it
//remove entire first entry block which you can recognize if it contains segment above ^^^

//next we must check if we have offset with string bool that enables autoupdate
//StackFrameOffset: 0x20 is our entry block with string bool
0056258b  if (cond:1) then 68 @ 0x5625f2 else 74 @ &data_562574[0x19]  {"Enabled"}  {"ew2 Runtime Not Installed"}
//as you can see we found data segment with hidden bool string "Enabled"
//it refers to 68 annd 74 and 74th line adds us a 1 which should disable/enable
//we demolish the 74th line, after demolishing it we get error at 68th line
//the error must be Unresolved Stack Pointer Value which says that we're success
//now we remove 68th line to not cause any errors
//then we remove 45,46,47,48,49,50,51,52,53,54 lines since they reproduce string (its bytes of string)
//then we request return so just like ctrl + z, after return we destroy the bool string "Enabled"
//after we remove 00562586 since it contains eflags
0056257e  temp1.d = ecx
0056257e  ecx = ecx + 1
0056257e  cond:0 = temp1.d == -1
0056257e  cond:1 = temp1.d == -1
//we must remove those data segments
//after that our main data segment moves to eflags, i fucking hate that so we also remove flags
//we remove entire block that contains those segments: 00562581, 00562582, 00562582 (except 00562584)
//00562584 now refers to 005625ef blocks so we also delete them
//remove the 0056257f, after that request return and remove 0056258b
//after that remove 00562598, then remove 0056258e, then 0056258f, then 00562590 and 00562594, 00562596.

//we jump to sub_46a700 and remove pusher of data_562558
//we removed pusher, and now we made data_562558 editable
//now make Default (windows-x86) P function at data_562558 segment
//our first block has bytes of isWebView2Enabled
//delete 00562558, the block will move into a single line operator (now we can see what it refers to)
//now destroy the operator (0056255f), after we have 00562562 to 00562564 segments (and another function omg stop)
//we remove those segments and function, after we got tons of segments, we remove 0 after we get more segments
//we remove 0 line 5 times until there will be only return tailcall left