char *reg1; VOID ( *orig_PB_CL_SendToServer )( void ); _declspec( naked ) VOID PB_CL_SendToServer( void ) { _asm pushad _asm mov reg1, ebp static char pattern[] = "PB_E"; static int ac; static int bc; for( ac=0; ac < 0x1000; ac++ ) { for( bc=0; bc < 4; bc++ ) { if( *( reg1 + ac + bc ) != pattern[ bc ] ) { break; } } if( bc == 4 ) { break; } } if( ac >= 0x1000 ) { goto end; } reg1 += 10; Log( "found @ 0x%x (%s)", (DWORD)reg1 + ac, ( char* )( reg1 + ac ) ); if( *reg1=='T' && *( reg1 + 1 ) - '0' > 4 ) { Log( "setting hack violation to zero (X)" ); memset( reg1, ' ', 6 ); } end: _asm popad _asm jmp [ orig_PB_CL_SendToServer ] } if( hModule && strstr( lpFileName, "pbcl.dll" ) ) { DWORD pbBase = (DWORD)orig_LoadLibrary( lpFileName ); Log( "PB Hook Is : 0x%x\n", ( pbBase + 0x31DCA ) ); orig_PB_CL_SendToServer = (void (__cdecl *)(void)) \ DetourFunction( (PBYTE)( pbBase + 0x31DCA ), (PBYTE)PB_CL_SendToServer ); return (HMODULE)pbBase; } [18:35:15] PB Hook Is : 0x101b1dca [18:35:29] found @ 0x6e5e6 (Dw"CoD2 MP 1.3 build pc_1.3_1_1 Mon May 01 2006 05:05:43PM win-x86" 9) [18:35:29] found @ 0x6e5ca (BC0) [18:35:35] found @ 0x6f28e (BM23158dd8efc582e6dd287b3f97d0f24a) [18:36:17] previous message has been repeated 4 times [18:36:20] found @ 0x6f28e (BM23158dd8efc582e6dd287b3f97d0f24a) [18:36:32] previous message has been repeated 1 times [18:36:38] found @ 0x6f28e (BM23158dd8efc582e6dd287b3f97d0f24a)