Name: HackShield CRC Check Bypassing CE Assembly Script.

qkckcqkckcq

[enable]
loadlibrary(DLL.dll)
[disable]




[Enable]

//Name: HackShield CRC Check Bypassing CE Assembly Script.

//Version: 1.0 for HackShield 5.2.17.993+

//Author: nimo1993

//Thanks: 大可

//Date: November 9, 2009



alloc(NimoHSCRCBypass,256)

label(BackToOP)



//如果有錯誤，請把Memory View的功能表 View -> Kernelmode symbol打勾

OpenProcess:

        jmp     NimoHSCRCBypass



NimoHSCRCBypass:

        mov     eax, fs:[20]

        cmp     eax, [esp+0c]

        jne     BackToOP

        mov     fs:[34], 57

        xor     eax, eax

        ret     000c



BackToOP:

        mov     edi, edi

        push    ebp

        mov     ebp, esp

        jmp     OpenProcess+5



[Disable]

OpenProcess:

        mov     edi, edi

        push    ebp

        mov     ebp, esp



dealloc(NimoHSCRCBypass)