QuestionHelpUndetected Packer

Posts 1–15 of 20 · Page 1 of 2
Undetected Packer
I have tried many dll packer/protector but all of them are detected by XTrap. Can anyone suggest a good undetected dll packer/protector?
VmProtacort is still undc
packers don't make dll hack undetected -.-
Quote Originally Posted by zikox View Post
VmProtacort is still undc
Thanks for the suggestion.. I will try it later.
Edit: You mean VMProtect?

Quote Originally Posted by somewhatpro View Post
packers don't make dll hack undetected -.-
You've missed my point.. my sourcecode is not detected if it's not protected by packer, it's just the protector/packer itself. I want to release hack in public but w/o protection makes me feel uncomfortable.

Any advice and suggestions will be greatly appreciated. Anyone?..
Quote Originally Posted by remzkee0903 View Post
You've missed my point.. my sourcecode is not detected if it's not protected by packer, it's just the protector/packer itself. I want to release hack in public but w/o protection makes me feel uncomfortable.
And you think that packing your dll it will make some difference? IT will not be reversed in 5 min it will be in 10 min ... that's all. If you wanna be "comfortable" keep it for yourself.
if you release your hack its gonna be detected anyways... so save for yourself those techniques that you developped in your hack for making it undetectable. otherwise they will be on xtrap's hands and you won't be able to create any hack lol...

btw, your hack when it is loaded into crossfire.exe , it is already unpacked and running on memory. So, your hack will get exposed anyways.
Quote Originally Posted by bandi12 View Post
And you think that packing your dll it will make some difference? IT will not be reversed in 5 min it will be in 10 min ... that's all. If you wanna be "comfortable" keep it for yourself.
Thanks for the advice..
Quote Originally Posted by somewhatpro View Post
if you release your hack its gonna be detected anyways... so save for yourself those techniques that you developped in your hack for making it undetectable. otherwise they will be on xtrap's hands and you won't be able to create any hack lol...

btw, your hack when it is loaded into crossfire.exe , it is already unpacked and running on memory. So, your hack will get exposed anyways.
So you mean after injecting into CF it will automatically scan the sourcecode & it will distribute into Xtrap database? That's a fckin' hilarious!!!

Though.. thanks for the suggestion mate.
Quote Originally Posted by remzkee0903 View Post
So you mean after injecting into CF it will automatically scan the sourcecode & it will distribute into Xtrap database? That's a fckin' hilarious!!!
Nope. He mean that when the dll is injected , your comp. will unpack it to can run it. So after you release it Xtrap guy's will download your dll , and will ad it to the blacklist of Xtrap ( update =>> detected , last pub. hack was detected only after 6 hours). Well i dont know about Xtrap log , but HGWC log can be requested by server , after that HGWC will upload the log to the server , so they can check what exactly caused the crash / detection / etc....
well, protecting you .dll is a good thing to avoid decompilers, but, i don't recommend use cracked versions of packers, if they already get cracked, think about you dll....
Quote Originally Posted by bandi12 View Post
Nope. He mean that when the dll is injected , your comp. will unpack it to can run it. So after you release it Xtrap guy's will download your dll , and will ad it to the blacklist of Xtrap ( update =>> detected , last pub. hack was detected only after 6 hours). Well i dont know about Xtrap log , but HGWC log can be requested by server , after that HGWC will upload the log to the server , so they can check what exactly caused the crash / detection / etc....
Thank you so much for the detailed explanation, now I have an idea how's the flow of game security.
Quote Originally Posted by XarutoUsoCrack View Post
well, protecting you .dll is a good thing to avoid decompilers, but, i don't recommend use cracked versions of packers, if they already get cracked, think about you dll....
Thanks for the advice sir.. you mean buying good quality packers is what you've recommend most? How about freeware packers? Pls kindly suggest any that is not yet detected.
Using cracked packers usually isn't a good idea - tons of AV false-detects due to anti-virus manufacturers detecting the signatures of cracked packers (packers are usually watermarked and the packer-developers provide these watermarks to the AV-devs as soon as the product gets leaked/cracked). Saying packers "unpack your DLL in order to execute it" is not correct in general: professional packers, like VMProtect for instance, when used correctly, are capable of executing parts of your code in virtual machines (that's why it's even called "VM"Protect, obviously), thus never exposing unpacked code to RAM. VMProtect generates a VM with a unique instruction set for each binary you pack, so if you want to analyze it, you first have to write either a "converter" generating equivalent x86 bytecode or a processor module for IDA, which is probably far beyond the skills level of the XT guys (it's also an enormously time consuming task, so even if they could do it, they probably wouldn't). You should not overuse VM-usage in your cheat however, it's pretty bad for the overall performance, especially when used in stuff that is called per-frame. :P VMProtect also features code-mutation, which makes your code a huge pain in the ass to reverse. Just dropping your hack in and clicking "pack" won't use either of the features btw, check the VMProtect help in order to learn how to use it correctly.

TL;DR: Acquire a VMProtect license and learn how to use it correctly (either using marker-calls or .map files, see VMProtect help).
@Ende! packed or non-packed. Xtrap still is going to detect it in few day's. After that make shure that they will analize it to make the used methode detected.. So pack or don't pack the best way to keep something safe is to don't make it public. If would that easy that we pack a dll and done , then we will be still there when all c+p coder's have an UD base but we are not there right ? so .....
Quote Originally Posted by bandi12 View Post
@Ende! packed or non-packed. Xtrap still is going to detect it in few day's. After that make shure that they will analize it to make the used methode detected.. So pack or don't pack the best way to keep something safe is to don't make it public. If would that easy that we pack a dll and done , then we will be still there when all c+p coder's have an UD base but we are not there right ? so .....
They can still detect your cheat using signatures, obviously, yes. However I assure you that if you got methods that aren't only slightly modified versions of already detected methods or which are available to public, they will have a very hard time analyzing it when your code applying it is compiled inside of one of VMProtects VMs. Like I said before, just dropping your cheat into VMProtect (or whatever other packer) and hitting "compile" or "pack" or whatever, is *not* enough. You have to manually pick relevant code for VM-compilation or at least mutation (or even both).

Quote Originally Posted by somewhatpro View Post
take a packed DLL, inject it to crossfire.exe then its gonna be unpacked

xtrap guy takes yo dll.., injects it in crossfire.exe, gets rights to debugg crossfire because he is xtrap guy..., looks in your dll's assembly..., spots your methods, boom yo dll is detected nigga have fun. xD
Did you even read my previous post?
take a packed DLL, inject it to crossfire.exe then its gonna be unpacked

xtrap guy takes yo dll.., injects it in crossfire.exe, gets rights to debugg crossfire because he is xtrap guy..., looks in your dll's assembly..., spots your methods, boom yo dll is detected nigga have fun. xD
really, themida is the best, but, license have a high price.

i don't know if xtrap check themida signatures ( well, most everything in game use themida ).
Posts 1–15 of 20 · Page 1 of 2
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Talk with us