Doing static memory editing with proxying -> XIGNCODE

[NiscorinA]

This does not not work on all XIGNCODE versions, but works on a lot out there right now. The method is based on using an exported function that is close to the one that loads the drivers. You probably won't need to do any extra digging for most versions.

Now, this is how the function looks like in pseudocode for my game ->

signed int __stdcall sub_BABEBEEF(int a1, int a2)
{
  signed int result;
  int dwErrCode;

  if ( !hModule || !dword_11C48E0 )
  {
    hModule = GetModuleHandleW(L"x3.xem");
    if ( !hModule )
      hModule = GetModuleHandleW(&off_1074148);
    if ( !hModule )
    {
      SetLastError(0xBABEBEEF);
      return 0;
    }
    dword_11C48E0 = (int (__stdcall *)(_DWORD, _DWORD))GetProcAddress(hModule, (LPCSTR)1);
  }
  if ( dword_0000000000 )
  {
    dwErrCode = dword_000000(a1, a2);
    if ( dwErrCode & 0x80000000 )
    {
      SetLastError(dwErrCode);
      result = 0;
    }
    else
    {
      result = 1;
    }
  }
  else
  {
    SetLastError(0xBABEBEEF);
    result = 0;
  }
  return result;
}

But of course, we can translate that into code we can use for our proxy ->

#include <windows.h>

#define __X3Init 0x80000000
#define __X3Export __declspec(dllexport)
#define __X3API __stdcall

typedef int(__X3API *__myX3Dispatch)(DWORD, DWORD);
static __myX3Dispatch __X3Dispatch{ nullptr };

void __X3API __myMain()
{
	MessageBoxW(nullptr, L"Loaded succesfully!", L"Success!", MB_SYSTEMMODAL | MB_ICONASTERISK);
}

__X3Export int __X3API __X3Func(DWORD __var1, DWORD __var2)
{
	if (__X3Dispatch == nullptr)
	{
		HINSTANCE __loadX3File = LoadLibraryW(L"XIGNCODE\\x3original.xem");

		if (__loadX3File == nullptr)
			return __X3Init;

		__X3Dispatch = reinterpret_cast<__myX3Dispatch>(GetProcAddress(__loadX3File, reinterpret_cast<LPCSTR>(1)));

		if (__X3Dispatch == nullptr)
			return __X3Init;

		__myMain();
	}

	return __X3Dispatch(__var1, __var2);
}

Now, this is not much of a bypass, but it lets you do static memory editing before XIGNCODE loads, so you can edit some values before XIGNCODE does its checksums and possibly avoid detection if there is no other protection in place (may be in your case). I am also aware that this is not the only way you can achieve something like this and there are easier ways, but this is just an informative thread.