Results 1 to 12 of 12
  1. #1
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,693
    Reputation
    3319
    Thanks
    11,105
    My Mood
    Happy

    Methods Reduce Being Detected

    Well I'm just looking for some help. My hack currently works. Mostly simple features. All my strings are encrypted, but I'm crashing in about 2 minutes into a game.

    Its being detected by HS. I'm crashing with the Ending Banner showing at the end.

    Anyone have suggestions to help? Would be appreciated

    Thanks.

    EDIT: I'm pretty sure its my memory editing function. Any ideas would be nice.


    Last edited by Flengo; 05-21-2012 at 12:35 AM.


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


  2. #2
    Saltine's Avatar
    Join Date
    Jun 2011
    Gender
    male
    Posts
    494
    Reputation
    104
    Thanks
    625
    Research polymorphic techniques utilized by viruses to "morph" the program at run time, rendering it impossible to detect by signature. Also, PEB hiding is another technique you should research. Shoot me a PM if you have any questions!
    Edit: Off topic- I like the UI :P
    Last edited by Saltine; 05-21-2012 at 07:17 PM.

    Oh no! Vortex is gay!

  3. The Following User Says Thank You to Saltine For This Useful Post:

    [MPGH]Flengo (05-21-2012)

  4. #3
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,693
    Reputation
    3319
    Thanks
    11,105
    My Mood
    Happy
    Quote Originally Posted by Saltine View Post
    Research polymorphic techniques utilized by viruses to "morph" the program at run time, rendering it impossible to detect by signature. Also, PEB hiding is another technique you should research. Shoot me a PM if you have any questions!
    Edit: Off topic- I like the UI :P
    PEB Hiding is something I looked into. Still crashing. ALL of my strings are encrypted.


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


  5. #4
    GodDamnFrank's Avatar
    Join Date
    May 2012
    Gender
    male
    Posts
    25
    Reputation
    10
    Thanks
    2
    Its your memory edit function. Engine nametags suck anyways and the only good memory hacks are super bullets and weapon range. Find a better function.

  6. #5
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,693
    Reputation
    3319
    Thanks
    11,105
    My Mood
    Happy
    Quote Originally Posted by GodDamnFrank View Post
    Its your memory edit function. Engine nametags suck anyways and the only good memory hacks are super bullets and weapon range. Find a better function.
    I tried editing it up. Still failing.


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


  7. #6
    Saltine's Avatar
    Join Date
    Jun 2011
    Gender
    male
    Posts
    494
    Reputation
    104
    Thanks
    625
    Did you test the hack with all the functionality commented out, but the menu still left? This would tell you if it happened to be the detours or your rendering.

    Oh no! Vortex is gay!

  8. #7
    matypatty's Avatar
    Join Date
    Aug 2009
    Gender
    male
    Posts
    862
    Reputation
    156
    Thanks
    2,688
    My Mood
    Amused
    hide module and polymorphic, look in my base for an example. could also be detours.

  9. #8
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,693
    Reputation
    3319
    Thanks
    11,105
    My Mood
    Happy
    Quote Originally Posted by Saltine View Post
    Did you test the hack with all the functionality commented out, but the menu still left? This would tell you if it happened to be the detours or your rendering.
    Yes I tried that. I tried someone's working detours, still working on their PUB.

    Quote Originally Posted by matypatty View Post
    hide module and polymorphic, look in my base for an example. could also be detours.
    I looked into your base, tried.

    Code:
    #include <Windows.h>
    #include "Base.h"
    #include "Poly.h"
    
    void EraseHeaders(HINSTANCE hModule)
    {
    	PIMAGE_DOS_HEADER pDoH; 
    	PIMAGE_NT_HEADERS pNtH;
    	DWORD i, ersize, protect;
    
    	if (!hModule) return;
    	
    	// well just to make clear what we doing
    	pDoH = (PIMAGE_DOS_HEADER)(hModule);
    
    	pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
    
    	ersize = sizeof(IMAGE_DOS_HEADER);
    	if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
    	{
    		for ( i=0; i < ersize; i++ )
    				*(BYTE*)((BYTE*)pDoH + i) = 0;
    	}
    
    	ersize = sizeof(IMAGE_NT_HEADERS);
    	if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
    	{
    		for ( i=0; i < ersize; i++ )
    				*(BYTE*)((BYTE*)pNtH + i) = 0;
    	}
    	return;
    }
    
    void HideModule(HINSTANCE hModule)
    {
    	DWORD dwPEB_LDR_DATA = 0;
    	_asm
    	{
    		pushad;
    		pushfd;
    		mov eax, fs:[30h]           
    		mov eax, [eax+0Ch]          
    		mov dwPEB_LDR_DATA, eax		
    
    			mov esi, [eax+0Ch]			
    		mov edx, [eax+10h]			
    
    LoopInLoadOrderModuleList: 
    		lodsd		            
    			mov esi, eax			
    			mov ecx, [eax+18h]		
    		cmp ecx, hModule		
    			jne SkipA				
    			mov ebx, [eax]		
    		mov ecx, [eax+4]	
    		mov [ecx], ebx		
    			mov [ebx+4], ecx	
    			jmp InMemoryOrderModuleList  
    SkipA:
    		cmp edx, esi       
    			jne LoopInLoadOrderModuleList 
    
    InMemoryOrderModuleList:
    		mov eax, dwPEB_LDR_DATA	
    			mov esi, [eax+14h]   
    		mov edx, [eax+18h]  
    
    LoopInMemoryOrderModuleList: 
    		lodsd
    			mov esi, eax
    			mov ecx, [eax+10h]
    		cmp ecx, hModule
    			jne SkipB
    			mov ebx, [eax] 
    		mov ecx, [eax+4]
    		mov [ecx], ebx
    			mov [ebx+4], ecx
    			jmp InInitializationOrderModuleList
    SkipB:
    		cmp edx, esi
    			jne LoopInMemoryOrderModuleList
    
    InInitializationOrderModuleList:
    		mov eax, dwPEB_LDR_DATA 
    			mov esi, [eax+1Ch]	    
    		mov edx, [eax+20h]	    
    
    LoopInInitializationOrderModuleList: 
    		lodsd
    			mov esi, eax		
    			mov ecx, [eax+08h]
    		cmp ecx, hModule		
    			jne SkipC
    			mov ebx, [eax] 
    		mov ecx, [eax+4]
    		mov [ecx], ebx
    			mov [ebx+4], ecx
    			jmp Finished
    SkipC:
    		cmp edx, esi
    			jne LoopInInitializationOrderModuleList
    
    Finished:
    		popfd;
    		popad;
    	}
    }
    
    unsigned char APIENTRY DllMain( HMODULE hModule,
    					   DWORD  ul_reason_for_call,
    					   LPVOID lpReserved
    					 )
    {
    
    	if(ul_reason_for_call == DLL_PROCESS_ATTACH)
    	{
    		EraseHeaders(hModule);
    		HideModule(hModule);
    		Poly.DestroyAndMorphSection( hModule, ".init" );
    
    		CreateThread(0, 0, CBase::MainThread, 0, 0, 0);
    		//CreateThread(0, 0, CBase::DIPHook, 0, 0, 0);
    	}
    
    	return TRUE;
    }
    
    #pragma code_seg()


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


  10. #9
    matypatty's Avatar
    Join Date
    Aug 2009
    Gender
    male
    Posts
    862
    Reputation
    156
    Thanks
    2,688
    My Mood
    Amused
    Quote Originally Posted by comando2056 View Post


    Yes I tried that. I tried someone's working detours, still working on their PUB.



    I looked into your base, tried.

    Code:
    #include <Windows.h>
    #include "Base.h"
    #include "Poly.h"
    
    void EraseHeaders(HINSTANCE hModule)
    {
    	PIMAGE_DOS_HEADER pDoH; 
    	PIMAGE_NT_HEADERS pNtH;
    	DWORD i, ersize, protect;
    
    	if (!hModule) return;
    	
    	// well just to make clear what we doing
    	pDoH = (PIMAGE_DOS_HEADER)(hModule);
    
    	pNtH = (PIMAGE_NT_HEADERS)((LONG)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
    
    	ersize = sizeof(IMAGE_DOS_HEADER);
    	if ( VirtualProtect(pDoH, ersize, PAGE_READWRITE, &protect) )
    	{
    		for ( i=0; i < ersize; i++ )
    				*(BYTE*)((BYTE*)pDoH + i) = 0;
    	}
    
    	ersize = sizeof(IMAGE_NT_HEADERS);
    	if ( pNtH && VirtualProtect(pNtH, ersize, PAGE_READWRITE, &protect) )
    	{
    		for ( i=0; i < ersize; i++ )
    				*(BYTE*)((BYTE*)pNtH + i) = 0;
    	}
    	return;
    }
    
    void HideModule(HINSTANCE hModule)
    {
    	DWORD dwPEB_LDR_DATA = 0;
    	_asm
    	{
    		pushad;
    		pushfd;
    		mov eax, fs:[30h]           
    		mov eax, [eax+0Ch]          
    		mov dwPEB_LDR_DATA, eax		
    
    			mov esi, [eax+0Ch]			
    		mov edx, [eax+10h]			
    
    LoopInLoadOrderModuleList: 
    		lodsd		            
    			mov esi, eax			
    			mov ecx, [eax+18h]		
    		cmp ecx, hModule		
    			jne SkipA				
    			mov ebx, [eax]		
    		mov ecx, [eax+4]	
    		mov [ecx], ebx		
    			mov [ebx+4], ecx	
    			jmp InMemoryOrderModuleList  
    SkipA:
    		cmp edx, esi       
    			jne LoopInLoadOrderModuleList 
    
    InMemoryOrderModuleList:
    		mov eax, dwPEB_LDR_DATA	
    			mov esi, [eax+14h]   
    		mov edx, [eax+18h]  
    
    LoopInMemoryOrderModuleList: 
    		lodsd
    			mov esi, eax
    			mov ecx, [eax+10h]
    		cmp ecx, hModule
    			jne SkipB
    			mov ebx, [eax] 
    		mov ecx, [eax+4]
    		mov [ecx], ebx
    			mov [ebx+4], ecx
    			jmp InInitializationOrderModuleList
    SkipB:
    		cmp edx, esi
    			jne LoopInMemoryOrderModuleList
    
    InInitializationOrderModuleList:
    		mov eax, dwPEB_LDR_DATA 
    			mov esi, [eax+1Ch]	    
    		mov edx, [eax+20h]	    
    
    LoopInInitializationOrderModuleList: 
    		lodsd
    			mov esi, eax		
    			mov ecx, [eax+08h]
    		cmp ecx, hModule		
    			jne SkipC
    			mov ebx, [eax] 
    		mov ecx, [eax+4]
    		mov [ecx], ebx
    			mov [ebx+4], ecx
    			jmp Finished
    SkipC:
    		cmp edx, esi
    			jne LoopInInitializationOrderModuleList
    
    Finished:
    		popfd;
    		popad;
    	}
    }
    
    unsigned char APIENTRY DllMain( HMODULE hModule,
    					   DWORD  ul_reason_for_call,
    					   LPVOID lpReserved
    					 )
    {
    
    	if(ul_reason_for_call == DLL_PROCESS_ATTACH)
    	{
    		EraseHeaders(hModule);
    		HideModule(hModule);
    		Poly.DestroyAndMorphSection( hModule, ".init" );
    
    		CreateThread(0, 0, CBase::MainThread, 0, 0, 0);
    		//CreateThread(0, 0, CBase::DIPHook, 0, 0, 0);
    	}
    
    	return TRUE;
    }
    
    #pragma code_seg()
    where did you start the code segment?

  11. #10
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,693
    Reputation
    3319
    Thanks
    11,105
    My Mood
    Happy
    Quote Originally Posted by matypatty View Post


    where did you start the code segment?
    Oh sorry. I just noticed that was there, shouldn't be there. Just ignore that I removed it.


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


  12. #11
    matypatty's Avatar
    Join Date
    Aug 2009
    Gender
    male
    Posts
    862
    Reputation
    156
    Thanks
    2,688
    My Mood
    Amused
    you need to start and end the code segment, then destroy and morph it

  13. The Following User Says Thank You to matypatty For This Useful Post:

    [MPGH]Flengo (05-24-2012)

  14. #12
    Flengo's Avatar
    Join Date
    May 2010
    Gender
    male
    Location
    Ontario, Canada
    Posts
    15,693
    Reputation
    3319
    Thanks
    11,105
    My Mood
    Happy
    Quote Originally Posted by matypatty View Post
    you need to start and end the code segment, then destroy and morph it
    Just tried that. Still crashed.


    I Read All Of My PM's & VM's
    If you need help with anything, just let me know.
     
     
    VM | PM

    Publicist Since 04.04.2015
    Middleman Since Unknown - Unknown
    Global Moderator Since 08.01.2013
    Donator Since 05.29.2013

    Minion+ Since 04.18.2013

    District 187 Minion Since 04.04.2013
    Steam Minion Since 02.26.2013
    WarRock Minion Since 02.19.2013
    A.V.A Minion Since 02.13.2013
    DayZ Minion Since 01.21.2013
    Combat Arms Minion Since 12.26.2012
    Contributor Since 11.16.2012
    Member Since 05.11.2010


Similar Threads

  1. Alll injectors being detected
    By meoh! in forum Combat Arms Help
    Replies: 7
    Last Post: 08-08-2010, 07:26 AM
  2. how do you hack without being detected?!?!
    By mitch the bitch in forum Call of Duty Modern Warfare 2 Help
    Replies: 4
    Last Post: 12-06-2009, 01:55 PM
  3. PUBLIC HACK IS BEING DETECTED
    By johningledew in forum Combat Arms Europe Hacks
    Replies: 13
    Last Post: 01-27-2009, 06:26 PM
  4. the hack is already being detected! care.
    By lefo in forum Combat Arms Hacks & Cheats
    Replies: 3
    Last Post: 12-20-2008, 07:05 AM
  5. Hacks being detected...
    By tolb in forum WarRock - International Hacks
    Replies: 22
    Last Post: 06-10-2007, 12:37 PM