HS Bypass

[jahwara 1]

Sorry if this is in wrong section, if so please TELL me so i can delete and put in new section.

 

Taken from **gh (with permission, view creditz) + (if i told you where it was leeched from it would be advertising... but i dont see any new Bypass codes, so i thought i'd post.)

Nothing has been changed.

Im trying to post this without getting to the point of advertising, but not giving credits.. i really need to put in the creditz.. so yeah. if this is advertising, il remove... but im telling anyone to go to the site.

Creditz:

99.99% credits to pr0h4x0r on **gh,

_________________________________________________________________

and 00.01% to me for posting.

_________________________________________________________________

used with permission.

#define "x_file.h" //Coded by pr0h4x0r on **gh.net (edited out "MP")

int EhSvc = (long)GetModuleHandleA("EhSvc.dll");
'if'(EhSvc !=0);{
DWORD OldProtect;

int EhPtr   = (0xD1E44);
int Memory1 =(EhSvc+0xD4328);//HS-Addy
int Memory2 =(EhSvc+0xD4334);//Hs-Addy-Jump
int Memory3 =(EhSvc+0xD5A88);//Hs-Addy-Jump
int Memory4 =(EhSvc+0xD5AD4);//Hs-Addy-Jump
int Memory5 =(EhSvc+0xD5B04);//Hs-Addy-Jump
int Memory6 =(EhSvc+0xCA2EC);//Hs-Addy-Jump
int Memory7 =(EhSvc+0xC92F8);//Hs-Addy-Jump
int Memory8 =(EhSvc+0xD0AC8);//Hs-Addy-Jump
int Memory9 = (EhSvc+0xCA2EC);//Hs-Addy-Jump
int Memory10 =(EhSvc+0xD5B04);//Hs-Addy-Jump
int Memory11 =(EhSvc+0xD5B0C);//Hs-Addy-Jump
int Memory12 =(EhSvc+0xC92FC);//Hs-Addy-Jump
int Memory13 =(EhSvc+0xC92F4);//Hs-Addy-Jump
int Memory14 =(EhSvc+0xD4340);//Hs-Addy-Jump
int Memory15 =(EhSvc+0xD0680);//Hs-Addy-Jump
int Memory16 =(EhSvc+0xD3E28);//Hs-Addy-Jump
int Memory17 =(EhSvc+0xD3E48);//Hs-Addy-Jump
int Memory18 =(EhSvc+0xD691C);//Hs-Addy-Jump
int Memory19 =(EhSvc+0xCA2EC);//Hs-Addy-Jump
int Memory20 =(EhSvc+0xD5ACC);//Hs-Addy-Jump
int Memory21 =(EhSvc+0xD43C4);//Hs-Addy-Jump
int Memory22 =(EhSvc+0xD4334);//Hs-Addy-Jump

VirtualProtect((void*)(Memory1),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory1) = 4;
VirtualProtect((void*)(Memory2),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory2) = 4;
VirtualProtect((void*)(Memory3),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory3) = 4;
VirtualProtect((void*)(Memory4),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory4) = 4;
VirtualProtect((void*)(Memory5),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory5) = 4;
VirtualProtect((void*)(Memory6),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory6) = 4;
VirtualProtect((void*)(Memory7),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory7) = 4;
VirtualProtect((void*)(Memory8),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory8) = 4;
VirtualProtect((void*)(Memory9),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory9) = 4;
VirtualProtect((void*)(Memory10),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory10) = 4;
VirtualProtect((void*)(Memory11),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory11) = 4;
VirtualProtect((void*)(Memory12),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory12) = 4;
VirtualProtect((void*)(Memory13),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory13) = 4;
VirtualProtect((void*)(Memory14),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory14) = 4;
VirtualProtect((void*)(Memory15),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory15) = 4;
VirtualProtect((void*)(Memory16),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory16) = 4;
VirtualProtect((void*)(Memory17),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory17) = 4;
VirtualProtect((void*)(Memory18),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory18) = 4;
VirtualProtect((void*)(Memory19),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory19) = 4;
VirtualProtect((void*)(Memory20),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory20) = 4;
VirtualProtect((void*)(Memory21),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory21) = 4;
VirtualProtect((void*)(Memory22),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);
*(DWORD*)(Memory22) = 4;
VirtualProtect((void*)(Memory23),0x6,PAGE_EXECUTE_READWRITE,&OldProtect);



Sleep(5);
}

 

 

Enjoy

 

 

note:

To all those who don't want to take because i don't have many posts, not my problem you don't take code, just don't post stupid comments.

[IAVI 1]

an easier one:

DWORD OldProtection;
void MEMwrite(void *adr, void *ptr, int size)
{
VirtualProtect(adr,size,PAGE_EXECUTE_READWRITE, &OldProtection);
memcpy(adr,ptr,size);
VirtualProtect(adr,size,OldProtection, &OldProtection);
}

void NewDetourhs(long Address,int Size,int Size2)
{
long EhSvc = (long)GetModuleHandleA("EhSvc.dll");
DWORD OldProtect;
VirtualProtect((void*)(EhSvc+Address),Size,PAGE_EXECUTE_READWRITE,&OldProtect); 
*(DWORD*)(EhSvc+Address) = Size2; 
//*(int*)(EhSvc+Address) = Size;
}


void CopyModules(void)
{

long EhSvc = (long)GetModuleHandleA("EhSvc.dll");

//self crc checks
MEMwrite((void *)(EhSvc+0x0FF28),(void*)(PBYTE)"\xB8\x01\x00\x00\x00",5);

	//anti asm scan warrock.exe
MEMwrite((void *)(EhSvc+0x1BC28),(void*)(PBYTE)"\x90\x90",2);//

////unhook dip & sss 8
MEMwrite((void *)(EhSvc+0x650A5),(void*)(PBYTE)"\xEB",1);//
MEMwrite((void *)(EhSvc+0x650CF),(void*)(PBYTE)"\xEB",1);//

//dll jump code check
MEMwrite((void *)(EhSvc+0x66931),(void*)(PBYTE)"\xEB",1);//
MEMwrite((void *)(EhSvc+0x66B79),(void*)(PBYTE)"\xEB",1);//

//anti restore page
MEMwrite((void *)(EhSvc+0x5F80E),(void*)(PBYTE)"\xEB",1);//
MEMwrite((void *)(EhSvc+0x5F784),(void*)(PBYTE)"\xEB",1);//

//processscan, main eagle process detect callback, for cheat engine
MEMwrite((void *)(EhSvc+0x54A14),(void*)(PBYTE)"\xE9\x7E\x0A\x00\x00",5);//

// nano detect objects
MEMwrite((void *)(EhSvc+0x2411B),(void*)(PBYTE)"\xEB",1);//
MEMwrite((void *)(EhSvc+0x24265),(void*)(PBYTE)"\xEB",1);//
MEMwrite((void *)(EhSvc+0x2435F),(void*)(PBYTE)"\x31",1);//
MEMwrite((void *)(EhSvc+0x22556),(void*)(PBYTE)"\x31",1);//
MEMwrite((void *)(EhSvc+0x26171),(void*)(PBYTE)"\x31",1);//
MEMwrite((void *)(EhSvc+0x25618),(void*)(PBYTE)"\xEB",1);//
MEMwrite((void *)(EhSvc+0x2572C),(void*)(PBYTE)"\xEB",1);//
MEMwrite((void *)(EhSvc+0x25ADB),(void*)(PBYTE)"\xEB",1);//

int EhPtr = 0x0D0F40;
NewDetourhs((EhPtr-0x44),0x8,4);//
NewDetourhs((EhPtr-0x40),0x8,4);//
NewDetourhs((EhPtr-0x20),0x8,4);//

NewDetourhs(0x0D13F8,0x8,4);//
NewDetourhs(0x0CD5F8,0x8,4);//
NewDetourhs(0x0C7570,0x8,4);//
NewDetourhs(0x0C7754,0x8,4);//
NewDetourhs(0x0CED40,0x8,4);//
NewDetourhs(0x0C7739,0x8,4);//
NewDetourhs(0x0D2E08,0x8,4);//
NewDetourhs(0x0C7758,0x8,4);//
NewDetourhs(0x0C62F8,0x8,4);//
NewDetourhs(0x0C7715,0x8,4);//
NewDetourhs(0x0D0F40,0x8,4);//
NewDetourhs(0x0C7719,0x8,4);//
NewDetourhs(0x0D2E40,0x8,4);//
NewDetourhs(0x0C62F8,0x8,4);//
NewDetourhs(0x0CD8FC,0x8,4);//
NewDetourhs(0x0CD5F8,0x8,4);//
NewDetourhs(0x0D3DF1,0x8,4);//


}
void Loop(void)
{
for(;;)
{
long EhSvc = (long)GetModuleHandleA("EhSvc.dll");
if(EhSvc!=0)
{
CopyModules();
}
Sleep(20);
}
}

i found it on pastebin its about 5% mine because i modyfied it

 

OUTDATED!!!

its just an example

[rob7601 0]

how do you make a bypass?

[NeoIII 5137]

thx for sharing,

 

a note to credits, credits can include the coders name its not needed to link to any website!

[-l2eSpecT_ 1]

thx for sharing,

 

a note to credits, credits can include the coders name its not needed to link to any website!

 

what can i do with that ?

[IAVI 1]

thx for sharing,

 

a note to credits, credits can include the coders name its not needed to link to any website!

 

pastebin doesnt give credits so i dont know

[asaf111 0]

1>------ Build started: Project: Bypass, Configuration: Debug Win32 ------

1>Compiling...

1>main.cpp

1>(1) : error C2008: '.' : unexpected in macro definition

1>(2) : error C3861: 'GetModuleHandleA': identifier not found

1>(3) : error C2059: syntax error : 'constant'

1>(3) : error C2447: '{' : missing function header (old-style formal list?)

1>Build log was saved at "

1>Bypass - 4 error(s), 0 warning(s)

========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========

[Im V!rus 2]

I will only share 1 address I don,t know why.

 

 

WR - Hackshield:

 

// Credits Unknown_pk ( found it ) and me for updating it ( V!rus )
// Website of unknown_pk = fearthesk**ls.com ( ** = il )
memory_b((void*)(hEhSvc+0x57164),(PBYTE)"\xE9\x7E\x0A\x00\x00",5);

[=h0Ax= 2]

sry, maibe i'm stupid but, #define "x_file.h"

...

if i made this file what have to put in?

 

sry 4 my bad english :S

[0rder 1]

lol

[Im V!rus 2]

I will only share 1 address I don,t know why.

 

 

WR - Hackshield:

 

// Credits Unknown_pk ( found it ) and me for updating it ( V!rus )
// Website of unknown_pk = fearthesk**ls.com ( ** = il )
memory_b((void*)(hEhSvc+0x59794),(PBYTE)"\xE9\x7E\x0A\x00\x00",5);