Analysis on XINGCODE

THIS CONTENT IS HELP FULL FOR CODERS ONLY!!

hey guys after hours of testing the new anti cheat i drew up some conclusions :- {basically help full for dll injection}

>the detection:- whenever a cheat is injected the anti-cheats detects it it might be bcuz :-
# there is an faint possibilty that the injection is logged at the kernel level which is picked up by the anti-cheat moreover the anti-cheat checks for this @ every given point of time.
# another reason is since the dll's are logged in the cpu's proceses bcuz your using it through the load librarires there is another chance that the anti-cheat picks it from there .

The possible solution:-
# look @ the kernel links of XINGCODE3.(disable the logging if its hooking any process logs.)
# try to overwrite the Kernel hooks or disable the XIGNCODE3/Process launch mechanism system.
# try to come out with an idea of how to hide the dll when its injected... (maybe by making like an common processes like an chat application,anti-virus or any other .........................you know what i mean )



these are all theoretical however in practicality its 100% possible requires some work

---------- Post added at 12:08 PM ---------- Previous post was at 11:49 AM ----------

another break through i just figured out that the detection is triggered by an task to be precise crc (cyclic redundancy check)..

now our new venture is to disable this ..

---------- Post added at 01:05 PM ---------- Previous post was at 12:08 PM ----------

example working of crc (cyclic redundancy check)
#include< stdlib.h>
#include< conio.h>
#include< stdio.h>
void main()
{
int i,j,n,g,a,arr[20],gen[20],b[20],q[20],s;
clrscr();
printf("Transmitter side:");
printf("\nEnter no. of data bits:");
scanf("%d",&n);
printf("Enter data:");
for(i=0;i< n;i++)
scanf("%d",&arr[i]);

printf("Enter size of generator:");
scanf("%d",&g);
do{
printf("Enter generator:");
for(j=0;j< g;j++)
scanf("%d",&gen[j]);

}
while(gen[0]!=1);
printf("\n\tThe generator matrix:");
for(j=0;j< g;j++)
printf("%d",gen[j]);

a=n+(g-1);
printf("\n\tThe appended matrix is:");
for(i=0;i< j;++i)
arr[n+i]=0;

for(i=0;i< a;++i)

printf("%d",arr[i]);

for(i=0;i< n;++i)
q[i]= arr[i];

for(i=0;i< n;++i)
{
if(arr[i]==0)
{
for(j=i;j< g+i;++j)
arr[j] = arr[j]^0;
}
else
{
arr[i] = arr[i]^gen[0];
arr[i+1]=arr[i+1]^gen[1];
arr[i+2]=arr[i+2]^gen[2];
arr[i+3]=arr[i+3]^gen[3];
}
}
printf("\n\tThe CRC is :");
for(i=n;i < a;++i)
printf("%d",arr[i]);
s=n+a;
for(i=n;i< s;i++)
q[i]=arr[i];
printf("\n");
for(i=0;i< a;i++)
printf("%d",q[i]);
getch();
}
/* Output

Transmitter side:
Enter no. of data bits:8
Enter data:1 0 1 0 0 0 0 1
Enter size of generator:4
Enter generator:1 0 0 1

The generator matrix:1001
The appended matrix is:10100001000
The CRC is :111
10100001111
*/

---------- Post added at 01:13 PM ---------- Previous post was at 01:05 PM ----------

way to inject a dll undetected :- this might be a breakthrough guys this code is undetected

// To Inject a DLL, we need three steps in APIHandler side.
// Allocate memory in the remote process for our library
// with write permission using the below mentioned WINAPI.
HANDLE hProc;
pLibRemote = ::VirtualAllocEx( hProcess,
NULL, sizeof(szLibPath), MEM_COMMIT, PAGE_READWRITE );

// This API writes the library path name to third party process.
::WriteProcessMemory( hProcess, pLibRemote, (void*)szLibPath,
sizeof( szLibPath ), NULL );
// Load the DLL to third party process by creating a thread in that
// process, using the below mentioned WIN API, this API enable
hThread = ::CreateRemoteThread( hProcess, NULL, 0,
(LPTHREAD_START_ROUTINE)::GetProcAddress( hKernel32,"LoadLibraryA" ),
pLibRemote,0,NULL );

// Once address is found, we have to redirect using the VirtualProtect WinAPI
// that enables write permission to third party EXE.

bool ChangeAddress(DWORD* dwOldAddress,DWORD dwNewAddress)
{
// Change the old address of the function with the new address.
// Firstly this address is changed.
DWORD dwOld;
if (!(VirtualProtect(dwOldAddress,4,PAGE_READWRITE,&d wOld)))
{
return false;
}
*dwOldAddress = dwNewAddress;
// Once changed it updated in the executable.
if (!(VirtualProtect(dwOldAddress,4,PAGE_EXECUTE,&dwO ld)))
{
return false;
}
else
{
OutputDebugString( "Change Address Final.." );
return true;
}
}