Making ms-crc
Posted: Sat Apr 02, 2011 10:45 pm
This thread will fully concentrate on making MS-CRC.
Useful threads
http://www.gamerzplanet.net/forums/tras ... asses.html
Alright let's look at the previous v101 ms-crc bypass
Useful threads
http://www.gamerzplanet.net/forums/tras ... asses.html
Alright let's look at the previous v101 ms-crc bypass
If you know anything, contribute here.//MSCRC - No on no hack
//MSEA v101
[enable]
alloc(mscrc,100)
alloc(copy,1024)
alloc(dump,10482664) // // Dump size, alloc(Label, Memory), label points out the base address of the allocated memory,amount of memory allocated in bytes
So above just allocate some memory space in bytes for the label*
alloc() is a function within Cheat Engine Auto Assembler that allocates a specific amount of memory.
createthread(copy)
label(exitmscrc)
label(mscrcret)
label(llop)
label(getoutahere)
mscrc: // CRC STARTS HERE
cmp eax,00401000 // Image base
jl exitmscrc // jump if lesser
cmp eax,00E00000 // Image end
jg exitmscrc // jump if greater
sub eax,00401000 // substract 401000 (image base) from eax
push ecx // Push api to stack
lea ecx,[dump]
add eax,ecx // add ecx to eax
pop ecx // pop (opposite to push)
exitmscrc:
movzx ecx,byte ptr [eax]
mov eax,[ebp+14] // move [ebp+14] to eax
jmp mscrcret // conditional jump
copy:
mov eax,00401000 // move 00401000, image base to eax
lea ecx,[dump]
llop:
xor ebx,ebx // xor
movzx ebx,byte ptr [eax]
mov byte ptr [ecx],bl
inc eax // increment +1
inc ecx // increment +1
cmp eax,00E00000 // compare Image end with eax
jg getoutahere // jump if greater
jmp llop // jump llop
getoutahere:
lea ebx,[dump]
add ebx,789F74 // 00B8AF74 - 401000 // OEP - IMAGE BASE : Get entry point (EP)
xor eax,eax
mov al,0F // move 0F to AL
mov byte ptr [ebx],al //
inc ebx // increment +1 to ebx
mov al,B6 // move B6 to al
mov byte ptr [ebx],al
inc ebx // increment ebx + 1
mov al,08 // move 08 to al
mov byte ptr [ebx],al
inc ebx // increment ebx + 1
mov al,8B // move 8B to AL
mov byte ptr [ebx],al
inc ebx
mov al,45 // move 45 to AL
mov byte ptr [ebx],al
ret // return
00B8AF74:
jmp mscrc // jump
db 14
mscrcret: // MS crc return
[disable] // Disable
00B8AF74:
db 0F B6 08 8B 45 14
dealloc(mscrc)
dealloc(dump)
dealloc(copy)