char *reg1; VOID ( *orig_PB_CL_SendToServer )( void ); _declspec( naked ) VOID PB_CL_SendToServer( void ) { _asm pushad _asm mov reg1, ebp static char pattern[] = "PB_E"; static int ac; static int bc; for( ac=0; ac < 0x1000; ac++ ) { for( bc=0; bc < 4; bc++ ) { if( *( reg1 + ac + bc ) != pattern[ bc ] ) { break; } } if( bc == 4 ) { break; } } if( ac >= 0x1000 ) { goto end; } reg1 += 10 + ac; Log("found @ 0x%x ( %s )", ( DWORD )reg1, ( char* )( reg1 ) ); if ( *reg1=='T' && *( reg1 + 1 ) - '0' > 4 ) { Log( "setting hack violation to zero (X)" ); memset( reg1, ' ', 6 ); } end: _asm popad _asm jmp [ orig_PB_CL_SendToServer ] } if( hModule && strstr( lpFileName, "pbcl.dll" ) ) { DWORD pbBase = (DWORD)orig_LoadLibrary( lpFileName ); Log( "PB Hook Is : 0x%x\n", ( pbBase + 0x31DCA ) ); orig_PB_CL_SendToServer = (void (__cdecl *)(void)) \ DetourFunction( (PBYTE)( pbBase + 0x31DCA ), (PBYTE)PB_CL_SendToServer ); return (HMODULE)pbBase; }