#include "ASM.h"
//-----------------------------------------//
//------------------HSCRC------------------//
//-----------------------------------------//
DWORD HS_Memory, HS_Memory_Start, HS_Memory_End;
DWORD HS_CRC_One_Return_Point, HS_CRC_Two_Return_Point, HS_CRC_Three_Return_Point, HS_CRC_Four_Return_Point;
void _declspec(naked) HS_CRC_One_Hook()
{
_asm
{
cmp ecx,[HS_Memory_Start]
jb HS_CRC_One_Return
cmp ecx,[HS_Memory_End]
ja HS_CRC_One_Return
sub ecx,[HS_Memory_Start]
add ecx,[HS_Memory]
HS_CRC_One_Return:
mov dl,[ecx]
xor eax,edx
mov ecx,[ebp+0x10]
jmp dword ptr [HS_CRC_One_Return_Point]
}
}
void _declspec(naked) HS_CRC_Two_Hook()
{
_asm
{
cmp ecx,[HS_Memory_Start]
jb HS_CRC_Two_Return
cmp ecx,[HS_Memory_End]
ja HS_CRC_Two_Return
sub ecx,[HS_Memory_Start]
add ecx,[HS_Memory]
HS_CRC_Two_Return:
add al,[ecx]
pop ecx
push edx
mov dl,0x06
jmp dword ptr [HS_CRC_Two_Return_Point]
}
}
void _declspec(naked) HS_CRC_Three_Hook()
{
_asm
{
cmp edx,[HS_Memory_Start]
jb HS_CRC_Three_Return_Three
cmp edx,[HS_Memory_End]
ja HS_CRC_Three_Return_Three
push edx
sub edx,[HS_Memory_Start]
cmp edx,0x93982-0x100
jb HS_CRC_Three_Return_Two
cmp edx,0x3684AE+0x100
ja HS_CRC_Three_Return_Two
cmp edx,0x93982+0x100
jb HS_CRC_Three_Return_One
cmp edx,0x3684AE-0x100
ja HS_CRC_Three_Return_One
jmp HS_CRC_Three_Return_Two
HS_CRC_Three_Return_One:
add edx,[HS_Memory]
mov edx,[edx]
mov dword ptr [esp+0x04],edx
HS_CRC_Three_Return_Two:
pop edx
HS_CRC_Three_Return_Three:
jmp dword ptr [HS_CRC_Three_Return_Point]
}
}
void _declspec(naked) HS_CRC_Four_Hook()
{
_asm
{
push esi
cmp esi,[MS_Memory_Start]
jb HS_CRC_Four_Return
cmp esi,[MS_Memory_End]
ja HS_CRC_Four_Return
sub esi,[MS_Memory_Start]
add esi,[MS_Memory]
HS_CRC_Four_Return:
lea edi,[ebp-0x1228]
repe movsd
pop esi
jmp dword ptr [HS_CRC_Four_Return_Point]
}
}
//------------------SPOOF------------------//
void HS_Table_Spoof(DWORD dwHSCRC5_Table)
{
int i;
DWORD Spoof = dwHSCRC5_Table + 0x24;
for (i = 0; i < 4; i++)
{
*(DWORD *)(dwHSCRC5_Table + i * 8) = ((*(DWORD *)(dwHSCRC5_Table + i * 8) ^ *(DWORD *)(Spoof)) - HS_Memory_Start + HS_Memory) ^ (*(DWORD *)(Spoof));
}
}
//------------------HSCRCx64Bypass------------------//
void HSCRCx64Bypass()
{
while (!GetModuleHandleA("EHSvc.dll"))
{
Sleep(100);
}
DWORD EHSvc = (DWORD)GetModuleHandleA("EHSvc.dll");
CreateMemoryDump(&HS_Memory, &HS_Memory_Start, &HS_Memory_End, "EHSvc.dll");
WriteJumpAtModule("EHSvc.dll", 0x93982, (DWORD)HS_CRC_One_Hook, &HS_CRC_One_Return_Point, 2);
WriteJumpAtModule("EHSvc.dll", 0x3684AE, (DWORD)HS_CRC_Two_Hook, &HS_CRC_Two_Return_Point, 1);
WriteJumpAtModule("EHSvc.dll", 0x25DACE, (DWORD)HS_CRC_Three_Hook, 0, 0);
HS_CRC_Three_Return_Point = EHSvc + 0x256ACC;
WriteJumpAtModule("EHSvc.dll", 0x3AB67, (DWORD)HS_CRC_Four_Hook, &HS_CRC_Four_Return_Point, 3);
HS_Table_Spoof(EHSvc + 0x15A048);
WriteCodeAtModule("EHSvc.dll", 0x506E0, "31 C0 C2 04 00");
WriteCodeAtModule("EHSvc.dll", 0x574B0, "31 C0 C2 04 00");
WriteCodeAtModule("EHSvc.dll", 0xD0227, "B8 00 00 00 00");
}
Posting Komentar
Lorem ipsum dolor sit amet
Selamat berpuasa bagi yang menjalankannya :)