./c0de/c/wpepro.txt

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
/*
   Anti WPE-Pro
   Coded by a59
*/
#include <windows.h>
#include <stdio.h>
 
unsigned long __stdcall AntiWPEPro( void* pVoid )
{
   bool bHooked = false;
   unsigned char szBuffer[ 8 ];
 
   // First 6 bytes of of Send/Recv
   unsigned char bOriginal[ ] = "\x55"         // PUSH EBP
                         "\x8B\xEC\x83"   // MOV EBP, ESP
                         "\xEC\x10";   // SUB ESP, 10
 
   int i;
 
   unsigned long dwRecvCall = (unsigned long)GetProcAddress( GetModuleHandle( "WS2_32.dll" ), "recv" );
   unsigned long dwSendCall = (unsigned long)GetProcAddress( GetModuleHandle( "WS2_32.dll" ), "send" );
 
   while( true )
   {
      ReadProcessMemory( GetCurrentProcess( ), (void *)dwRecvCall, szBuffer, 6, 0 );
 
      for( i = 0; i < 6; i++ )
      {
         // If we find one part missing, write the original bytes back and break the loop
         if( bOriginal[ i ] != szBuffer[ i ] )
         {
            WriteProcessMemory( GetCurrentProcess( ), (void *)dwRecvCall, bOriginal, 6, 0 );
            break;
         }         
      }
 
      ReadProcessMemory( GetCurrentProcess( ), (void *)dwSendCall, szBuffer, 6, 0 );
 
      for( i = 0; i < 6; i++ )
      {
         // Send + Recvs first 6 bytes are the same, we can use the same buffer
         if( bOriginal[ i ] != szBuffer[ i ] )
         {
            WriteProcessMemory( GetCurrentProcess( ), (void *)dwSendCall, bOriginal, 6, 0 );
            break;
         }
      }
 
      Sleep( 500 );
   }
 
   return 0;
};
 
int main( )
{
   LoadLibrary( "WS2_32.dll" );
   CreateThread( 0, 0, &AntiWPEPro, 0, 0, 0 );
 
   getchar( );
   system( "PAUSE" );
 
   return 0;
};

Back