*BlackShot Europe.
Look at this:
Code:
00407081 . 68 88B18500 PUSH blacksho.0085B188 ; ASCII "http://217.113.38.170:6999/CrashHackLog.asp?id=%s&hackType=1&HackDesc=DirexX_DLL"
00407086 . EB 14 JMP SHORT blacksho.0040709C
00407088 > 3C 05 CMP AL,5
0040708A . 75 24 JNZ SHORT blacksho.004070B0
0040708C . E8 20E1FFFF CALL blacksho.004051B1
00407091 . 05 42010000 ADD EAX,142
00407096 . 50 PUSH EAX
00407097 . 68 E0B18500 PUSH blacksho.0085B1E0 ; ASCII "http://95.211.238.33:8090/CrashHackLog.asp?id=%s&hackType=1&HackDesc=DirexX_DLL"
0040709C > 8D85 C4EFFFFF LEA EAX,DWORD PTR SS:[EBP-103C]
004070A2 . 50 PUSH EAX
004070A3 . E8 0BE33000 CALL blacksho.007153B3
004070A8 . 83C4 0C ADD ESP,0C
004070AB . 33DB XOR EBX,EBX
004070AD . 43 INC EBX
004070AE . EB 26 JMP SHORT blacksho.004070D6
004070B0 > 33DB XOR EBX,EBX
004070B2 . 43 INC EBX
004070B3 . 3AC3 CMP AL,BL
004070B5 . 75 1F JNZ SHORT blacksho.004070D6
004070B7 . E8 F5E0FFFF CALL blacksho.004051B1
004070BC . 05 42010000 ADD EAX,142
004070C1 . 50 PUSH EAX
004070C2 . 68 30B28500 PUSH blacksho.0085B230 ; ASCII "http://203.117.135.58:990/CrashHackLog.asp?id=%s&hackType=1&HackDesc=DirexX_DLL"
004070C7 . 8D85 C4EFFFFF LEA EAX,DWORD PTR SS:[EBP-103C]
004070CD . 50 PUSH EAX
004070CE . E8 E0E23000 CALL blacksho.007153B3
004070D3 . 83C4 0C ADD ESP,0C
004070D6 > 8D85 C4EFFFFF LEA EAX,DWORD PTR SS:[EBP-103C]
004070DC . 50 PUSH EAX ; /String
004070DD . FF15 28728100 CALL DWORD PTR DS:[<&KERNEL32.lstrlenA>] ; \lstrlenA
004070E3 . 85C0 TEST EAX,EAX
004070E5 . 7E 29 JLE SHORT blacksho.00407110
004070E7 . 33FF XOR EDI,EDI
004070E9 . 57 PUSH EDI ; /IsShown => 0
004070EA . 57 PUSH EDI ; |DefDir => NULL
004070EB . 8D85 C4EFFFFF LEA EAX,DWORD PTR SS:[EBP-103C] ; |
004070F1 . 50 PUSH EAX ; |Parameters
004070F2 . 68 80B28500 PUSH blacksho.0085B280 ; |FileName = "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
004070F7 . 68 B0B28500 PUSH blacksho.0085B2B0 ; |Operation = "open"
004070FC . 57 PUSH EDI ; |hWnd => NULL
004070FD . FF15 C0738100 CALL DWORD PTR DS:[<&SHELL32.ShellExecut>; \ShellExecuteA
00407103 . 8D85 C4EFFFFF LEA EAX,DWORD PTR SS:[EBP-103C]
00407109 . 50 PUSH EAX
0040710A . FF15 F4748100 CALL DWORD PTR DS:[<&WININET.DeleteUrlCa>; WININET.DeleteUrlCacheEntryASoo the process is:
1- Send a Hack Report using a web link ( when they find something ofc ).
2- Open my Internet Explorer using ShellExecute
3- Execute this link in ShellExecute params
4- When finish, just clean my cache, so i will not see anything.
I REPORT U BLACKSHOT, SPYING MAH PC !
Soo now you ask me why this shit topic ?
Well, you can easy disable that ( if you want )
just do that
Code:
004070FD . FF15 C0738100 CALL DWORD PTR DS:[<&SHELL32.ShellExecut>; \ShellExecuteA
put a 6 byte length nop here and it's done.Code:
00406799 |. 68 DCAD8500 PUSH blacksho.0085ADDC ; ASCII ".\HShield\EhSvc.dll"
0040679E |. 50 PUSH EAX
0040679F |. E8 9CE53000 CALL blacksho.00714D40
004067A4 |. 83C4 20 ADD ESP,20
004067A7 |. 833D F8DE8B00 >CMP DWORD PTR DS:[8BDEF8],10
004067AE |. 68 04000080 PUSH 80000004 ; /Arg6 = 80000004
004067B3 |. 68 AE21885B PUSH 5B8821AE ; |Arg5 = 5B8821AE
004067B8 |. B8 E4DE8B00 MOV EAX,blacksho.008BDEE4 ; |
004067BD |. 0F4305 E4DE8B0>CMOVNB EAX,DWORD PTR DS:[8BDEE4] ; |
004067C4 |. 50 PUSH EAX ; |Arg4
004067C5 |. 68 33230000 PUSH 2333 ; |Arg3 = 00002333
004067CA |. 68 0A654000 PUSH blacksho.0040650A ; |Arg2 = 0040650A
004067CF |. 8D85 F4FDFFFF LEA EAX,DWORD PTR SS:[EBP-20C] ; |
004067D5 |. 50 PUSH EAX ; |Arg1
004067D6 |. E8 67A13700 CALL blacksho.00780942 ; \blacksho.00780942
004067DB |. 85C0 TEST EAX,EAX
004067DD |. 74 34 JE SHORT blacksho.00406813
004067DF |. 50 PUSH EAX
004067E0 |. 68 F0AD8500 PUSH blacksho.0085ADF0
004067E5 |> 8D85 F8FEFFFF LEA EAX,DWORD PTR SS:[EBP-108]
004067EB |. 50 PUSH EAX
004067EC |. E8 C2EB3000 CALL blacksho.007153B3
004067F1 |. 83C4 0C ADD ESP,0C
004067F4 |. 8D85 F8FEFFFF LEA EAX,DWORD PTR SS:[EBP-108]
004067FA |. 53 PUSH EBX ; /Style
004067FB |. 68 54AC8500 PUSH blacksho.0085AC54 ; |Title = "HShield"
00406800 |. 50 PUSH EAX ; |Text
00406801 |. 53 PUSH EBX ; |hOwner
00406802 FF15 54748100 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; \MessageBoxACode:
0040674F /$ 55 PUSH EBPohh, you finded !
Code:
00406A8F |> 68 F4AE8500 PUSH blacksho.0085AEF4 ; ASCII "SUCCESS | HackShield Update"
00406A94 |. 6A 00 PUSH 0
00406A96 |. FFD7 CALL EDI
00406A98 |. 50 PUSH EAX
00406A99 |. FFD3 CALL EBX
00406A9B |. 83C4 0C ADD ESP,0C
00406A9E E8 ACFCFFFF CALL blacksho.0040674F
00406AA3 |. 84C0 TEST AL,AL
00406AA5 |. 75 16 JNZ SHORT blacksho.00406ABD
00406AA7 |. 68 10AF8500 PUSH blacksho.0085AF10 ; ASCII "FAIL | HackShield Init"
Put a 5 byte length nop here.Do the same thing, find dat shit just putting a breakpoint in all MessageBox call's, when find, go to call from the messagebox and put a nop, you can search by string too.
Congratz you just "bypassedz" the hackshield, now you need find the hearthbeat protection ( else game will DC ), good luck.
Creditz:
OllyDbg
Hi, this is a comment.
RépondreSupprimerTo delete a comment, just log in and view the post's comments. There you will have the option to edit or delete them.
When it comes to the SAG TV noms, Kate Winslet, Juliana Margulies, Tina Fey, Julie Bowen and Sofia Vergara will all have many designer options -- with Winslet getting the most, of course. But Margulies always looks amazing at any awards show.
RépondreSupprimer