Home

Awesome

Summary

YouMayPasser is an x64 implementation of Gargoyle (https://github.com/JLospinoso/gargoyle)

BLOG POST HERE: https://www.arashparsa.com/bypassing-pesieve-and-moneta-the-easiest-way-i-could-find/

It contains several parts.

Stable PeSieve and Moneta Bypass and Clean Exits.

This gif demonstrates full functionality and stability of the code on Windows 10.

PESieve Bypassed

Stable Moneta Bypass

Moneta Bypassed

IOCs

Below are a list of current IOCs

I will fix none of these issues. This is nothing more than an x64 gargoyle POC to demonstrate how it can be leveraged to bypass PeSieve and Moneta.

shoutouts

  1. Ret address spoofing - Namaszo (https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html)
  2. Timer sleep - computerBeat (https://blat-blatnik.github.io/computerBear/making-accurate-sleep-function/)
  3. VEH Hooks - CheatEngine Forums https://www.cheatengine.org/forum/viewtopic.php?t=610689&sid=c329059fbe5c36ef296bce5ef72decfc