[Makes detected hacks undetected] Simple PE Cipher

[Jason]

I was talking to Bombsaway a few days ago and he was saying that the old method of ciphering a file (pumping shit onto the end of the file) no longer works with CA. It just so happens I was bored at the time so I wrote this simple little cipher. Basically it just manipulates a few values within the PE structure and also rewrites some data into the .text section.

This, unlike the older ciphers, should work to fool Nexon's hash logic.

Using it is pretty straightforward:

1. Download the .zip and extract it
2. Run "Simple PE Cipher.exe"
3. Press the browse button to locate your Dll
4. Press "Run Cipher", if all goes as expected you should see a "Cipher Completed Successfully" message box appear.
5. Inject the .dll. A backup of the original .dll is also created (with a .bak extension) in the same directory as the ciphered dll so you can revert at any time if something goes wrong.

Written in Win32 C++ for teh lulz.

If you have any issues with it, please feel free to PM me or post in the thread, I'll do my best to rectify the issues.
Virus Scan
Jotti

No idea why this had those two scanners report a backdoor to be honest. Perhaps because I'm using some I/O API, dunno.

Anyways, enjoy, and report back with results.

[Drake]

/ Approved

[waterboy543449]

I wasn't around long enough to know what a 'cipher' actually does ? Can you simplify what this program does for my nooby self ? Thanks

[iAllure]

I wasn't around long enough to know what a 'cipher' actually does ? Can you simplify what this program does for my nooby self ? Thanks

Long story short, it makes the hack undetected lol

[mystryman]

Long story short, it makes the hack undetected lol

No it doesnt actually. The RipTide v2.4, i was using and then suddenly it started crashing. i thought it was detected and i came here. Then i saw this thread and tried it out. But the hack doesnt work at all now, i dont even get in game first and then it crashes. It didnt use to crash until i played for a while IN game, please help me out, maybe i need to change something... PLEAS HELP. I need aimbot to hack legitly

[Jason]

I wasn't around long enough to know what a 'cipher' actually does ? Can you simplify what this program does for my nooby self ? Thanks

Basically, one way Nexon can detect hack attempts is to take a "hash" of the .dll when it's injected. They then compare this hash to a list of "blacklisted" dlls and if there is a match, they report a hack detection and exit. The purpose of a cipher like this is to change up some data within the .dll so that the hash of the file changes. Previously this was achieved by writing a few extra bytes of data to the end of the file. However, recently Nexon have changed the way they hash the dll (rather than simply hashing the entire file, they hash only a portion of the file), which is why some of the old ciphers have stopped working.

My method modifies safe data within the file itself (through the documented PE structure), and is thus more likely to modify the portion of the file that Nexon hashes (most likely the executable sections, but not 100% sure so I modify a few different areas). The idea, of course, is to not break the .dll itself when modifying data.

[waterboy543449]

Basically, one way Nexon can detect hack attempts is to take a "hash" of the .dll when it's injected. They then compare this hash to a list of "blacklisted" dlls and if there is a match, they report a hack detection and exit. The purpose of a cipher like this is to change up some data within the .dll so that the hash of the file changes. Previously this was achieved by writing a few extra bytes of data to the end of the file. However, recently Nexon have changed the way they hash the dll (rather than simply hashing the entire file, they hash only a portion of the file), which is why some of the old ciphers have stopped working.

My method modifies safe data within the file itself (through the documented PE structure), and is thus more likely to modify the portion of the file that Nexon hashes (most likely the executable sections, but not 100% sure so I modify a few different areas). The idea, of course, is to not break the .dll itself when modifying data.

This is why I love MPGH so much, thanks for the thorough explanations Great work sir.

[Navan]

Basically, one way Nexon can detect hack attempts is to take a "hash" of the .dll when it's injected. They then compare this hash to a list of "blacklisted" dlls and if there is a match, they report a hack detection and exit. The purpose of a cipher like this is to change up some data within the .dll so that the hash of the file changes. Previously this was achieved by writing a few extra bytes of data to the end of the file. However, recently Nexon have changed the way they hash the dll (rather than simply hashing the entire file, they hash only a portion of the file), which is why some of the old ciphers have stopped working.

My method modifies safe data within the file itself (through the documented PE structure), and is thus more likely to modify the portion of the file that Nexon hashes (most likely the executable sections, but not 100% sure so I modify a few different areas). The idea, of course, is to not break the .dll itself when modifying data.

A+ in grammar.

[Jason]

A+ in grammar.

I do try. spacefiller

[Giranta]

What is a Dll?

---------- Post added at 07:51 PM ---------- Previous post was at 07:47 PM ----------

i dont know what the fuck to look for, in the browse section. please tell me

[Dandyman4321]

Loved this game. Hack method similiar to other games

[iAllure]

nice @Jason...
It worked for me

[jonnybrav0]

it basically adds information to the hack so combatarms hacks shield doesn't notice it (simplified)

[FrosK]

Heh, lets play with old detected hacks...
Thanks, for sharing a cipher in this section

[iDaEgg]

I like this ^.^

This will work perfectly for all the detected hacks out there atm.