Eidolon decrypt

[numerbo]

// main.cpp
        PatchDecryptGadget(SDK::Memory::BaseAddress + 0x1A901D); 
        for (uintptr_t address = SDK::Memory::BaseAddress; address < SDK::Memory::EndAddress; address += 0x100) {
            DecryptAddress(address);
        }

// decrypt.hpp
#pragma  once
#include  <stdint.h>

extern "C" {
    uint64_t __fastcall DecryptAddress(uint64_t encryptedPtr);
    extern   uint64_t          FindGadget;
}

inline void PatchDecryptGadget(uintptr_t gadgetVA)
{
    FindGadget = gadgetVA;
}

// decrypt.asm
PUBLIC  DecryptAddress
PUBLIC  FindGadget

.code
DecryptAddress PROC
    jmp     qword ptr [FindGadget]
DecryptAddress ENDP

.data
    ALIGN 8
FindGadget  dq 0
END

Enjoy.

Just dump with x64 now, or whatever you'd like.

[numerbo]

wink )))))))))))))

[std233]

thanks for sharing~

[numerbo]

61965 it was for the official retail implementation that went up and was removed.


.text:00000000001A901D mov rax, [rcx]
.text:00000000001A9020 retn

[rik.chong]

// main.cpp
        PatchDecryptGadget(SDK::Memory::BaseAddress + 0x1A901D); 
        for (uintptr_t address = SDK::Memory::BaseAddress; address < SDK::Memory::EndAddress; address += 0x100) {
            DecryptAddress(address);
        }

// decrypt.hpp
#pragma  once
#include  <stdint.h>

extern "C" {
    uint64_t __fastcall DecryptAddress(uint64_t encryptedPtr);
    extern   uint64_t          FindGadget;
}

inline void PatchDecryptGadget(uintptr_t gadgetVA)
{
    FindGadget = gadgetVA;
}

// decrypt.asm
PUBLIC  DecryptAddress
PUBLIC  FindGadget

.code
DecryptAddress PROC
    jmp     qword ptr [FindGadget]
DecryptAddress ENDP

.data
    ALIGN 8
FindGadget  dq 0
END

Enjoy.

Just dump with x64 now, or whatever you'd like.

I noticed that some expansions are applying the Eidolon protection.
Can I ask how to run these codes 'internally'? By injecting a dll?

My previous dll injector (using GitHub - guided-hacking/GuidedHacking-Injector: The BEST DLL Injector Library.) did not work.
I tried different injection method with no luck.
In classic expansion the GH-Injector with 'INJECTION_MODE::IM_LdrLoadDll + LAUNCH_METHOD::LM_NtCreateThreadEx' is working perfectly though.