Blocking AutoitV3

[a1tl4]

#include <windows.h>
#include <iostream>
#include "base64.h"
using namespace std;

DWORD _stdcall BlockAutoIT(LPVOID Block) {
    SetThreadPriority(GetCurrentThread(), 0x00010000);
    string encrypt =  ("QXV0b0l0IHYz");
    string pWindow = base64_decode(encrypt);
    repeat:
    if(FindWindow(pWindow.c_str(), NULL))
    {
    BlockInput( TRUE );
    SleepEx(1000, false);
    typedef LPDWORD (NTAPI *_RlExitUserProcess)(HANDLE , LPDWORD ); _RlExitUserProcess RlExitUserProcess; RlExitUserProcess = (_RlExitUserProcess)::GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlExitUserProcess"); RlExitUserProcess(GetCurrentProcess(),false);
    }
    Sleep(150);
    goto repeat;
} 

Create thread:

CreateThread(0,0, &BlockAutoIT, 0,0,0); 

This helps block many shotbot =)
by Me

[MentaL]

[SecretsOThePast]

#include <windows.h>
#include <iostream>
#include "base64.h"
using namespace std;

DWORD _stdcall BlockAutoIT(LPVOID Block) {
    SetThreadPriority(GetCurrentThread(), 0x00010000);
    string encrypt =  ("QXV0b0l0IHYz");
    string pWindow = base64_decode(encrypt);
    repeat:
    if(FindWindow(pWindow.c_str(), NULL))
    {
    BlockInput( TRUE );
    SleepEx(1000, false);
    typedef LPDWORD (NTAPI *_RlExitUserProcess)(HANDLE , LPDWORD ); _RlExitUserProcess RlExitUserProcess; RlExitUserProcess = (_RlExitUserProcess)::GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlExitUserProcess"); RlExitUserProcess(GetCurrentProcess(),false);
    }
    Sleep(150);
    goto repeat;
} 

Create thread:

CreateThread(0,0, &BlockAutoIT, 0,0,0); 

This helps block many shotbot =)
by Me

Recompile shotbot as a different window title, or decompile the shotbox executable to not use the same window title by checking the SetWindowTitle or HWND call that sets the title.

Useless/10

[Ronny786]

This is kinda useful secrets.. Only developers know how to bypass... and only 5% of gunz population are developers out with hacking skills and hacking intentions...
+1 release.

[Solaire]

This is kinda useful secrets.. Only developers know how to bypass... and only 5% of gunz population are developers out with hacking skills and hacking intentions...
+1 release.

It only takes 1 developer and 1 thread on a hacking forum to bypass it for everyone.

Another useless release. Also, labels, really?

[a1tl4]

Recompile shotbot as a different window title, or decompile the shotbox executable to not use the same window title by checking the SetWindowTitle or HWND call that sets the title.

Useless/10

It no is "Window Title".
Can't bypass with SetWindowText.
Is class title.

[Joe9099]

You finding these off google or something lol?

[a1tl4]

You finding these off google or something lol?

What do you mean?
It was only done by me (and encryption base64)

[trunksx]

maybe this will help:

HANDLE SystemProcessScan();
bool ScanProcessMemory(HANDLE hProcessHandle);
#define MAX_DUMP_SIZE 32
#define MAX_PROCESS_DUMP 1

typedef struct PROCESS_DUMP {
    unsigned int m_aOffset;
    unsigned char m_aMemDump[MAX_DUMP_SIZE];
} *PPROCESS_DUMP;
extern PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP];






PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP] = {
{0x417770, {0xE8, 0xC4, 0xAF, 0x00, 0x00, 0xE9, 0x79, 0xFE, 0xFF, 0xFF, 0x8B, 0xFF, 0x55, 0x8B, 0xEC, 0x8B, 0xC1, 0x8B, 0x4D, 0x08, 0xC7, 0x00, 0x88, 0xDA, 0x47, 0x00, 0x8B, 0x09, 0x83, 0x60, 0x08, 0x00}} 
};


HANDLE SystemProcessScan(){    DWORD dwProcesses[MAX_PATH];
    DWORD dwTotal;
    HANDLE hProcessHandle;
    if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &dwTotal))
        return INVALID_HANDLE_VALUE;
    for (int i = 0; i < (dwTotal / 4); i++){
        hProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, false, dwProcesses[i]);
        if (hProcessHandle == INVALID_HANDLE_VALUE)
            continue;
         if(ScanProcessMemory(hProcessHandle))
            return hProcessHandle;
         CloseHandle(hProcessHandle);
    }
    return INVALID_HANDLE_VALUE;
}




bool ScanProcessMemory(HANDLE hProcessHandle) {
    for(int i = 0; i < MAX_PROCESS_DUMP; i++){
        char aTmpBuffer[MAX_DUMP_SIZE];
        SIZE_T aBytesRead = 0;
        ReadProcessMemory(hProcessHandle, (LPCVOID)MEMORY_PROCESS_DUMP[i].m_aOffset, (LPVOID)aTmpBuffer, sizeof(aTmpBuffer), &aBytesRead);
        if(memcmp(aTmpBuffer, MEMORY_PROCESS_DUMP[i].m_aMemDump, MAX_DUMP_SIZE) == 0){
            return true;
            break;
        }
    }
  return false;
}


call:
 if(SystemProcessScan() != INVALID_HANDLE_VALUE)
      ExitProcess(0); //hax autoit

[ThePhailure772]

maybe this will help:

HANDLE SystemProcessScan();
bool ScanProcessMemory(HANDLE hProcessHandle);
#define MAX_DUMP_SIZE 32
#define MAX_PROCESS_DUMP 1

typedef struct PROCESS_DUMP {
    unsigned int m_aOffset;
    unsigned char m_aMemDump[MAX_DUMP_SIZE];
} *PPROCESS_DUMP;
extern PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP];






PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP] = {
{0x417770, {0xE8, 0xC4, 0xAF, 0x00, 0x00, 0xE9, 0x79, 0xFE, 0xFF, 0xFF, 0x8B, 0xFF, 0x55, 0x8B, 0xEC, 0x8B, 0xC1, 0x8B, 0x4D, 0x08, 0xC7, 0x00, 0x88, 0xDA, 0x47, 0x00, 0x8B, 0x09, 0x83, 0x60, 0x08, 0x00}} 
};


HANDLE SystemProcessScan(){    DWORD dwProcesses[MAX_PATH];
    DWORD dwTotal;
    HANDLE hProcessHandle;
    if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &dwTotal))
        return INVALID_HANDLE_VALUE;
    for (int i = 0; i < (dwTotal / 4); i++){
        hProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, false, dwProcesses[i]);
        if (hProcessHandle == INVALID_HANDLE_VALUE)
            continue;
         if(ScanProcessMemory(hProcessHandle))
            return hProcessHandle;
         CloseHandle(hProcessHandle);
    }
    return INVALID_HANDLE_VALUE;
}




bool ScanProcessMemory(HANDLE hProcessHandle) {
    for(int i = 0; i < MAX_PROCESS_DUMP; i++){
        char aTmpBuffer[MAX_DUMP_SIZE];
        SIZE_T aBytesRead = 0;
        ReadProcessMemory(hProcessHandle, (LPCVOID)MEMORY_PROCESS_DUMP[i].m_aOffset, (LPVOID)aTmpBuffer, sizeof(aTmpBuffer), &aBytesRead);
        if(memcmp(aTmpBuffer, MEMORY_PROCESS_DUMP[i].m_aMemDump, MAX_DUMP_SIZE) == 0){
            return true;
            break;
        }
    }
  return false;
}


call:
 if(SystemProcessScan() != INVALID_HANDLE_VALUE)
      ExitProcess(0); //hax autoit

Labels, rootkit, and comparing dynamic memory?

[Gunblade]

Atleast people TRY to help to get GunZ a bit forward, anyway I think its clear enough now that its not the best way. But hey, every little bit helps.

[dizzydaz]

Why don't you just allow it macros are for noobs

[dacharles]

maybe this will help:

HANDLE SystemProcessScan();
bool ScanProcessMemory(HANDLE hProcessHandle);
#define MAX_DUMP_SIZE 32
#define MAX_PROCESS_DUMP 1

typedef struct PROCESS_DUMP {
    unsigned int m_aOffset;
    unsigned char m_aMemDump[MAX_DUMP_SIZE];
} *PPROCESS_DUMP;
extern PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP];






PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP] = {
{0x417770, {0xE8, 0xC4, 0xAF, 0x00, 0x00, 0xE9, 0x79, 0xFE, 0xFF, 0xFF, 0x8B, 0xFF, 0x55, 0x8B, 0xEC, 0x8B, 0xC1, 0x8B, 0x4D, 0x08, 0xC7, 0x00, 0x88, 0xDA, 0x47, 0x00, 0x8B, 0x09, 0x83, 0x60, 0x08, 0x00}} 
};


HANDLE SystemProcessScan(){    DWORD dwProcesses[MAX_PATH];
    DWORD dwTotal;
    HANDLE hProcessHandle;
    if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &dwTotal))
        return INVALID_HANDLE_VALUE;
    for (int i = 0; i < (dwTotal / 4); i++){
        hProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, false, dwProcesses[i]);
        if (hProcessHandle == INVALID_HANDLE_VALUE)
            continue;
         if(ScanProcessMemory(hProcessHandle))
            return hProcessHandle;
         CloseHandle(hProcessHandle);
    }
    return INVALID_HANDLE_VALUE;
}




bool ScanProcessMemory(HANDLE hProcessHandle) {
    for(int i = 0; i < MAX_PROCESS_DUMP; i++){
        char aTmpBuffer[MAX_DUMP_SIZE];
        SIZE_T aBytesRead = 0;
        ReadProcessMemory(hProcessHandle, (LPCVOID)MEMORY_PROCESS_DUMP[i].m_aOffset, (LPVOID)aTmpBuffer, sizeof(aTmpBuffer), &aBytesRead);
        if(memcmp(aTmpBuffer, MEMORY_PROCESS_DUMP[i].m_aMemDump, MAX_DUMP_SIZE) == 0){
            return true;
            break;
        }
    }
  return false;
}


call:
 if(SystemProcessScan() != INVALID_HANDLE_VALUE)
      ExitProcess(0); //hax autoit

Guess it doesn't help...