
Attachments
You can download 0 Attachments
-
922.7 KB Views: 166
Last edited:
Thanks for your feedback! I'm a sucker for well-put together, well-formatted and quality posts/threads/shares. But do you think it' readable or should i make the images bigger?Nice job, very well put together. Good overview for everyone new in bypassing anticheat area
I would recommend making the picture bigger, even me myself is having a hard time reading it.Thanks for your feedback! I'm a sucker for well-put together, well-formatted and quality posts/threads/shares. But do you think it' readable or should i make the images bigger?
And it's definitely a good overview and shows what people need to consider and do![]()
I updated the attachments for a bigger size. The forum automatically formats the image to be smaller so you might wanna look at the attachment instead!I would recommend making the picture bigger, even me myself is having a hard time reading it.
[table="width: 618"]
[tr]
[td][IMG]https://i45.tinypic.com/10eiwbn.jpg[/IMG][/td]
[/tr]
[/table]
90 - NOP
86 - Mov X,X
C0 EAX
C9 ECX
D2 EDX
DB EBX
E4 ESP
ED EBP
F6 ESI
FF EDI
PUSH-POP
5058 EAX
5159 ECX
525A EDX
535B EBX
545C ESP
555D EBP
565E ESI
575F EDI
void CTools::HideDLL(HINSTANCE hModule)
{
DWORD dwPEB_LDR_DATA = 0;
_asm
{
pushad;
pushfd;
mov eax, fs:[30h]
mov eax, [eax+0Ch]
mov dwPEB_LDR_DATA, eax
InLoadOrderModuleList:
mov esi, [eax+0Ch]
mov edx, [eax+10h]
LoopInLoadOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+18h]
cmp ecx, hModule
jne SkipA
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp InMemoryOrderModuleList
SkipA:
cmp edx, esi
jne LoopInLoadOrderModuleList
InMemoryOrderModuleList:
mov eax, dwPEB_LDR_DATA
mov esi, [eax+14h]
mov edx, [eax+18h]
LoopInMemoryOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+10h]
cmp ecx, hModule
jne SkipB
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp InInitializationOrderModuleList
SkipB:
cmp edx, esi
jne LoopInMemoryOrderModuleList
InInitializationOrderModuleList:
mov eax, dwPEB_LDR_DATA
mov esi, [eax+1Ch]
mov edx, [eax+20h]
LoopInInitializationOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+08h]
cmp ecx, hModule
jne SkipC
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp Finished
SkipC:
cmp edx, esi
jne LoopInInitializationOrderModuleList
Finished:
popfd;
popad;
}
}
void CTools::EraseHeader(HINSTANCE hModule)
{
/*
* func to erase headers, by Croner.
* keep in mind you wont be able to load
* any resources after you erase headers.
*/
PIMAGE_DOS_HEADER pDoH;
PIMAGE_NT_HEADERS pNtH;
DWORD i, ersize, protect;
if (!hModule) return;
// well just to make clear what we doing
pDoH = (PIMAGE_DOS_HEADER)(hModule);
pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
ersize = sizeof(IMAGE_DOS_HEADER);
if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
{
for ( i=0; i < ersize; i++ )
*(BYTE*)((BYTE*)pDoH + i) = 0;
}
ersize = sizeof(IMAGE_NT_HEADERS);
if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
{
for ( i=0; i < ersize; i++ )
*(BYTE*)((BYTE*)pNtH + i) = 0;
}
return;
}
MemoryManage::MemoryManage(void)
{
hKlDll = NULL;
hNtDll = NULL;
}
void MemoryManage::InitNtKExt(void)
{
while(!hNtDll)
{
hNtDll = GetModuleHandle("ntdll.dll");
Sleep(50);
}
while(!hKlDll)
{
hKlDll = GetModuleHandle("kernel32.dll");
Sleep(50);
}
_GetProcAddress = reinterpret_cast<GPA> ( GetProcAddress(hKlDll, "GetProcAddress"));
if(!_GetProcAddress)
{
Sleep(500);
TerminateProcess(GetCurrentProcess(), 0);
}
NtProtectVirtualMemory = reinterpret_cast<NTPVM> (__GetProcAddress(hNtDll, "NtProtectVirtualMemory"));
RtlNtStatusToDosError = reinterpret_cast<RTLNTSTDE>(__GetProcAddress(hNtDll, "RtlNtStatusToDosError"));
RtlCreateUserThread = reinterpret_cast<RTLCUT> (__GetProcAddress(hNtDll, "RtlCreateUserThread"));
NtResumeThread = reinterpret_cast<NTRT> (__GetProcAddress(hNtDll, "NtResumeThread"));
NtClose = reinterpret_cast<NTC> (__GetProcAddress(hNtDll, "NtClose"));
if(!NtProtectVirtualMemory ||
!RtlNtStatusToDosError ||
!RtlCreateUserThread ||
!NtResumeThread ||
!NtClose)
{
Sleep(500);
TerminateProcess(GetCurrentProcess(), 0);
}
Sleep(500);
}