Blocking AutoitV3

a1tl4 · Jan 13, 2013

PHP:

#include <windows.h>
#include <iostream>
#include "base64.h"
using namespace std;

DWORD _stdcall BlockAutoIT(LPVOID Block) {
    SetThreadPriority(GetCurrentThread(), 0x00010000);
    string encrypt =  ("QXV0b0l0IHYz");
    string pWindow = base64_decode(encrypt);
    repeat:
    if(FindWindow(pWindow.c_str(), NULL))
    {
    BlockInput( TRUE );
    SleepEx(1000, false);
    typedef LPDWORD (NTAPI *_RlExitUserProcess)(HANDLE , LPDWORD ); _RlExitUserProcess RlExitUserProcess; RlExitUserProcess = (_RlExitUserProcess)::GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlExitUserProcess"); RlExitUserProcess(GetCurrentProcess(),false);
    }
    Sleep(150);
    goto repeat;
}

Create thread:

PHP:

CreateThread(0,0, &BlockAutoIT, 0,0,0);

This helps block many shotbot =)
by Me

SecretsOThePast · Jan 13, 2013

a1tl4 said:

PHP:

#include <windows.h>
#include <iostream>
#include "base64.h"
using namespace std;

DWORD _stdcall BlockAutoIT(LPVOID Block) {
    SetThreadPriority(GetCurrentThread(), 0x00010000);
    string encrypt =  ("QXV0b0l0IHYz");
    string pWindow = base64_decode(encrypt);
    repeat:
    if(FindWindow(pWindow.c_str(), NULL))
    {
    BlockInput( TRUE );
    SleepEx(1000, false);
    typedef LPDWORD (NTAPI *_RlExitUserProcess)(HANDLE , LPDWORD ); _RlExitUserProcess RlExitUserProcess; RlExitUserProcess = (_RlExitUserProcess)::GetProcAddress(GetModuleHandle("ntdll.dll"), "RtlExitUserProcess"); RlExitUserProcess(GetCurrentProcess(),false);
    }
    Sleep(150);
    goto repeat;
}

Create thread:

PHP:

CreateThread(0,0, &BlockAutoIT, 0,0,0);

This helps block many shotbot =)
by Me

Recompile shotbot as a different window title, or decompile the shotbox executable to not use the same window title by checking the SetWindowTitle or HWND call that sets the title.

Useless/10

Ronny786 · Jan 13, 2013

This is kinda useful secrets.. Only developers know how to bypass... and only 5% of gunz population are developers out with hacking skills and hacking intentions...
+1 release.

Solaire · Jan 13, 2013

Ronny786 said:
This is kinda useful secrets.. Only developers know how to bypass... and only 5% of gunz population are developers out with hacking skills and hacking intentions...
+1 release.

It only takes 1 developer and 1 thread on a hacking forum to bypass it for everyone.

Another useless release. Also, labels, really?

a1tl4 · Jan 13, 2013

SecretsOThePast said:
Recompile shotbot as a different window title, or decompile the shotbox executable to not use the same window title by checking the SetWindowTitle or HWND call that sets the title.

Useless/10

It no is "Window Title".
Can't bypass with SetWindowText.
Is class title.

Joe9099 · Jan 13, 2013

You finding these off google or something lol?

a1tl4 · Jan 13, 2013

Joe9099 said:
You finding these off google or something lol?

What do you mean?
It was only done by me (and encryption base64)

trunksx · Jan 13, 2013

maybe this will help:

Code:

HANDLE SystemProcessScan();
bool ScanProcessMemory(HANDLE hProcessHandle);
#define MAX_DUMP_SIZE 32
#define MAX_PROCESS_DUMP 1

typedef struct PROCESS_DUMP {
    unsigned int m_aOffset;
    unsigned char m_aMemDump[MAX_DUMP_SIZE];
} *PPROCESS_DUMP;
extern PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP];






PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP] = {
{0x417770, {0xE8, 0xC4, 0xAF, 0x00, 0x00, 0xE9, 0x79, 0xFE, 0xFF, 0xFF, 0x8B, 0xFF, 0x55, 0x8B, 0xEC, 0x8B, 0xC1, 0x8B, 0x4D, 0x08, 0xC7, 0x00, 0x88, 0xDA, 0x47, 0x00, 0x8B, 0x09, 0x83, 0x60, 0x08, 0x00}} 
};


HANDLE SystemProcessScan(){    DWORD dwProcesses[MAX_PATH];
    DWORD dwTotal;
    HANDLE hProcessHandle;
    if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &dwTotal))
        return INVALID_HANDLE_VALUE;
    for (int i = 0; i < (dwTotal / 4); i++){
        hProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, false, dwProcesses[i]);
        if (hProcessHandle == INVALID_HANDLE_VALUE)
            continue;
         if(ScanProcessMemory(hProcessHandle))
            return hProcessHandle;
         CloseHandle(hProcessHandle);
    }
    return INVALID_HANDLE_VALUE;
}




bool ScanProcessMemory(HANDLE hProcessHandle) {
    for(int i = 0; i < MAX_PROCESS_DUMP; i++){
        char aTmpBuffer[MAX_DUMP_SIZE];
        SIZE_T aBytesRead = 0;
        ReadProcessMemory(hProcessHandle, (LPCVOID)MEMORY_PROCESS_DUMP[i].m_aOffset, (LPVOID)aTmpBuffer, sizeof(aTmpBuffer), &aBytesRead);
        if(memcmp(aTmpBuffer, MEMORY_PROCESS_DUMP[i].m_aMemDump, MAX_DUMP_SIZE) == 0){
            return true;
            break;
        }
    }
  return false;
}


call:
[B] if(SystemProcessScan() != INVALID_HANDLE_VALUE)
      ExitProcess(0); //hax autoit[/B]

ThePhailure772 · Jan 13, 2013

trunksx said:

maybe this will help:

Code:

HANDLE SystemProcessScan();
bool ScanProcessMemory(HANDLE hProcessHandle);
#define MAX_DUMP_SIZE 32
#define MAX_PROCESS_DUMP 1

typedef struct PROCESS_DUMP {
    unsigned int m_aOffset;
    unsigned char m_aMemDump[MAX_DUMP_SIZE];
} *PPROCESS_DUMP;
extern PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP];






PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP] = {
{0x417770, {0xE8, 0xC4, 0xAF, 0x00, 0x00, 0xE9, 0x79, 0xFE, 0xFF, 0xFF, 0x8B, 0xFF, 0x55, 0x8B, 0xEC, 0x8B, 0xC1, 0x8B, 0x4D, 0x08, 0xC7, 0x00, 0x88, 0xDA, 0x47, 0x00, 0x8B, 0x09, 0x83, 0x60, 0x08, 0x00}} 
};


HANDLE SystemProcessScan(){    DWORD dwProcesses[MAX_PATH];
    DWORD dwTotal;
    HANDLE hProcessHandle;
    if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &dwTotal))
        return INVALID_HANDLE_VALUE;
    for (int i = 0; i < (dwTotal / 4); i++){
        hProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, false, dwProcesses[i]);
        if (hProcessHandle == INVALID_HANDLE_VALUE)
            continue;
         if(ScanProcessMemory(hProcessHandle))
            return hProcessHandle;
         CloseHandle(hProcessHandle);
    }
    return INVALID_HANDLE_VALUE;
}




bool ScanProcessMemory(HANDLE hProcessHandle) {
    for(int i = 0; i < MAX_PROCESS_DUMP; i++){
        char aTmpBuffer[MAX_DUMP_SIZE];
        SIZE_T aBytesRead = 0;
        ReadProcessMemory(hProcessHandle, (LPCVOID)MEMORY_PROCESS_DUMP[i].m_aOffset, (LPVOID)aTmpBuffer, sizeof(aTmpBuffer), &aBytesRead);
        if(memcmp(aTmpBuffer, MEMORY_PROCESS_DUMP[i].m_aMemDump, MAX_DUMP_SIZE) == 0){
            return true;
            break;
        }
    }
  return false;
}


call:
[B] if(SystemProcessScan() != INVALID_HANDLE_VALUE)
      ExitProcess(0); //hax autoit[/B]

Labels, rootkit, and comparing dynamic memory?

I0Svc - Blocking AutoitV3 - RaGEZONE Forums

Gunblade · Jan 13, 2013

dizzydaz · Jan 13, 2013

Why don't you just allow it macros are for noobs

dacharles · Jan 20, 2013

trunksx said:

maybe this will help:

Code:

HANDLE SystemProcessScan();
bool ScanProcessMemory(HANDLE hProcessHandle);
#define MAX_DUMP_SIZE 32
#define MAX_PROCESS_DUMP 1

typedef struct PROCESS_DUMP {
    unsigned int m_aOffset;
    unsigned char m_aMemDump[MAX_DUMP_SIZE];
} *PPROCESS_DUMP;
extern PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP];






PROCESS_DUMP MEMORY_PROCESS_DUMP[MAX_PROCESS_DUMP] = {
{0x417770, {0xE8, 0xC4, 0xAF, 0x00, 0x00, 0xE9, 0x79, 0xFE, 0xFF, 0xFF, 0x8B, 0xFF, 0x55, 0x8B, 0xEC, 0x8B, 0xC1, 0x8B, 0x4D, 0x08, 0xC7, 0x00, 0x88, 0xDA, 0x47, 0x00, 0x8B, 0x09, 0x83, 0x60, 0x08, 0x00}} 
};


HANDLE SystemProcessScan(){    DWORD dwProcesses[MAX_PATH];
    DWORD dwTotal;
    HANDLE hProcessHandle;
    if (!EnumProcesses(dwProcesses, sizeof(dwProcesses), &dwTotal))
        return INVALID_HANDLE_VALUE;
    for (int i = 0; i < (dwTotal / 4); i++){
        hProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, false, dwProcesses[i]);
        if (hProcessHandle == INVALID_HANDLE_VALUE)
            continue;
         if(ScanProcessMemory(hProcessHandle))
            return hProcessHandle;
         CloseHandle(hProcessHandle);
    }
    return INVALID_HANDLE_VALUE;
}




bool ScanProcessMemory(HANDLE hProcessHandle) {
    for(int i = 0; i < MAX_PROCESS_DUMP; i++){
        char aTmpBuffer[MAX_DUMP_SIZE];
        SIZE_T aBytesRead = 0;
        ReadProcessMemory(hProcessHandle, (LPCVOID)MEMORY_PROCESS_DUMP[i].m_aOffset, (LPVOID)aTmpBuffer, sizeof(aTmpBuffer), &aBytesRead);
        if(memcmp(aTmpBuffer, MEMORY_PROCESS_DUMP[i].m_aMemDump, MAX_DUMP_SIZE) == 0){
            return true;
            break;
        }
    }
  return false;
}


call:
[B] if(SystemProcessScan() != INVALID_HANDLE_VALUE)
      ExitProcess(0); //hax autoit[/B]

Guess it doesn't help...

Blocking AutoitV3

a1tl4

Newbie Spellweaver

SecretsOThePast

Retired. Don't PM.

Ronny786

Currently Stoned !

Solaire

Praise the Sun!

a1tl4

Newbie Spellweaver

Joe9099

An old mofo

a1tl4

Newbie Spellweaver

trunksx

Experienced Elementalist

ThePhailure772

Mako is insane.

Gunblade

Daemonsring Developer

dizzydaz

Newbie Spellweaver

dacharles

Elite Diviner

RaGEZONE Sponsor

About RaGEZONE

Forum Statistics

RaGEZONE Partners