Release Trinity's anti-hack

[Scurvy]

Was just wondering if someone had a hand on it yet. I've posted this up a few minutes ago somewhere on this forum:

Originally Posted by Scurvy

Nothing is as worse as Trinity's, lol. I've been looking into that this afternoon by accident, was just wondering. They simply edit the hash that is generated from Gunz.exe. Mostly by an absolute zero (XOR).

ASM: (Taken from aikido.dII)

10004930   8B4424 10        MOV EAX,DWORD PTR SS:[ESP+10]
10004934   32C9             XOR CL,CL
10004936   C600 23          MOV BYTE PTR DS:[EAX],23
10004939   C640 01 11       MOV BYTE PTR DS:[EAX+1],11
1000493D   8848 02          MOV BYTE PTR DS:[EAX+2],CL
10004940   8848 03          MOV BYTE PTR DS:[EAX+3],CL
10004943   8848 04          MOV BYTE PTR DS:[EAX+4],CL
10004946   8848 05          MOV BYTE PTR DS:[EAX+5],CL
10004949   8848 06          MOV BYTE PTR DS:[EAX+6],CL
1000494C   8848 07          MOV BYTE PTR DS:[EAX+7],CL
1000494F   8848 08          MOV BYTE PTR DS:[EAX+8],CL
10004952   8848 09          MOV BYTE PTR DS:[EAX+9],CL
10004955   8848 0A          MOV BYTE PTR DS:[EAX+A],CL
10004958   8848 0B          MOV BYTE PTR DS:[EAX+B],CL
1000495B   8848 0C          MOV BYTE PTR DS:[EAX+C],CL
1000495E   8848 0D          MOV BYTE PTR DS:[EAX+D],CL
10004961   C640 0E 02       MOV BYTE PTR DS:[EAX+E],2
10004965   C640 0F 32       MOV BYTE PTR DS:[EAX+F],32
10004969   C3               RETN

In C++ that would be:

//Load the value that is loaded into the EAX register first, that's the 4th parameter, which would be the MD5 hash of Gunz.exe.
BYTE byMD5Hash[] = {
    0x23, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2, 0x32
}

I'll make an update for Trinity first. For now, this doesn't work anymore and most likely will get you banned. Therefore, don't use it, and a lock is requested.

Once again, I don't promise anything yet. I've got a lot more to do. Might take a few days, might take a few weeks.

Someone has found this already? Or any other checks?

[Aesmade]

Open aikido.dII in olly, search for referenced strings, all of the checks are there. I've bypassed it a couple times, can't be arsed to make a bypass for the latest version, though I doubt it's much different, I prolly just need to update some addresses.