[Makes detected hacks undetected] Simple PE Cipher

[Jason]

I was talking to Bombsaway a few days ago and he was saying that the old method of ciphering a file (pumping shit onto the end of the file) no longer works with CA. It just so happens I was bored at the time so I wrote this simple little cipher. Basically it just manipulates a few values within the PE structure and also rewrites some data into the .text section.

This, unlike the older ciphers, should work to fool Nexon's hash logic.

Using it is pretty straightforward:

1. Download the .zip and extract it
2. Run "Simple PE Cipher.exe"
3. Press the browse button to locate your Dll
4. Press "Run Cipher", if all goes as expected you should see a "Cipher Completed Successfully" message box appear.
5. Inject the .dll. A backup of the original .dll is also created (with a .bak extension) in the same directory as the ciphered dll so you can revert at any time if something goes wrong.

Written in Win32 C++ for teh lulz.

If you have any issues with it, please feel free to PM me or post in the thread, I'll do my best to rectify the issues.
Virus Scan
Jotti

No idea why this had those two scanners report a backdoor to be honest. Perhaps because I'm using some I/O API, dunno.

Anyways, enjoy, and report back with results.

[Jason]

It should work on any dll file, so yes.

The Cipher itself will work, whether it'll have any affect on the game's hack detection is another matter entirely.

As a general rule, it doesn't hurt to cipher your dll's (i.e it's will not make the dll MORE likely to be detected), but it may not actually reduce detection in games other than CA. One of CA's detection methods is to take a hash value of common hack DLLs and detect them, if your game implements a similar detection method then the Cipher should get around it, otherwise it won't do much.

[DFPro7]

IS THIS ONLY FOR DLL? CAN I INSERT THIS CHIPER INTO A PROGRAM? I WANT TO INJECT THIS CHIPER INTO PROCESS SUSPENDER SO THAT IT WILL GET UNDETECTABLE...IF THE PROCESS SUSPENDER IS UNDETECTABLE...I CAN END GAMEGUARD'S PROCESS...THEN I CAN USE HACKS....

[Mc565]

IS THIS ONLY FOR DLL? CAN I INSERT THIS CHIPER INTO A PROGRAM?

This does not work for .exe files.

[aimanmuluk]

I was talking to Bombsaway a few days ago and he was saying that the old method of ciphering a file (pumping shit onto the end of the file) no longer works with CA. It just so happens I was bored at the time so I wrote this simple little cipher. Basically it just manipulates a few values within the PE structure and also rewrites some data into the .text section.

This, unlike the older ciphers, should work to fool Nexon's hash logic.

Using it is pretty straightforward:

1. Download the .zip and extract it
2. Run "Simple PE Cipher.exe"
3. Press the browse button to locate your Dll
4. Press "Run Cipher", if all goes as expected you should see a "Cipher Completed Successfully" message box appear.
5. Inject the .dll. A backup of the original .dll is also created (with a .bak extension) in the same directory as the ciphered dll so you can revert at any time if something goes wrong.

Written in Win32 C++ for teh lulz.

If you have any issues with it, please feel free to PM me or post in the thread, I'll do my best to rectify the issues.
Virus Scan
Jotti

No idea why this had those two scanners report a backdoor to be honest. Perhaps because I'm using some I/O API, dunno.

Anyways, enjoy, and report back with results.

Is it work with BlackShot ?

[Ramp15514]

can i use this with other games like CR or PB?

[Genesis]

can i use this with other games like CR or PB?

You can use it with any dll file but it's probably not going to make the hacks for other games undetected. See Jason's post at the top of this page.

The Cipher itself will work, whether it'll have any affect on the game's hack detection is another matter entirely.

As a general rule, it doesn't hurt to cipher your dll's (i.e it's will not make the dll MORE likely to be detected), but it may not actually reduce detection in games other than CA. One of CA's detection methods is to take a hash value of common hack DLLs and detect them, if your game implements a similar detection method then the Cipher should get around it, otherwise it won't do much.

[ianvillalon]

So everytime i cipher it, it changes the main code that the nexons use to become detecting hacks?....Sorry for bad english

[-*Koki-*]

Nice Release from you dude

---------- Post added at 10:31 AM ---------- Previous post was at 10:30 AM ----------

Does it works for Crossfire Dll's too and Battlefield?

[Mc565]

Nice Release from you dude

---------- Post added at 10:31 AM ---------- Previous post was at 10:30 AM ----------

Does it works for Crossfire Dll's too and Battlefield?

Quote from Jason

The Cipher itself will work, whether it'll have any affect on the game's hack detection is another matter entirely.

As a general rule, it doesn't hurt to cipher your dll's (i.e it's will not make the dll MORE likely to be detected), but it may not actually reduce detection in games other than CA. One of CA's detection methods is to take a hash value of common hack DLLs and detect them, if your game implements a similar detection method then the Cipher should get around it, otherwise it won't do much.

[Lezz194]

Can Someone Teach Me How To use this In Advanced .

[davyhartje]

the simple PE Cipher wont start it says i dont have a MSVCR100.dll dont have

[~Syphox]

Just received a thanks! Awesome share

[Volz1]

I tried 3 dll hacks, I cipher them, inject them and start combat arms EU and crash on start( When the guy is running). No one of them worked? Is it the ciphers bad or the injector? I am using Extreme Injector.

[Mc565]

I tried 3 dll hacks, I cipher them, inject them and start combat arms EU and crash on start( When the guy is running). No one of them worked? Is it the ciphers bad or the injector? I am using Extreme Injector.

Looks like all EU hacks are patched.

[matthieu503]

Yeah why? Nexon is too lazy to detect executable programs that run in the background. They only recently added a check for Cheat Engine (x64). All Injectors should be undetected still.

I know for a fact PerX and Extreme Injector are still undetected, as I use them.

Was planning on using this for other stuff