How to patch MD5 detected hacks
I'm creating this because some people wonder how to hex edit a detected dll hack to make it undetected. The hacks are currently detected based on the file's MD5 check sum. You can learn more about MD5's on Wikipedia here. Either way when you hex edit the dll it gives it a new MD5 checksum. You can use any common hex editor that can edit and then resave the file. The one i use is HxD editor since its freeware. When you open up the hack dll in the hex editor you will notice a string which generally says "This program cannot be run in DOS mode" unless the hack has already been edited before. In the case that it has already been edited then just know the byte locations that can be edited in the following screenshot.
Once you find the location you edit some of the bytes to what ever you wish. For example for a couple of my edited hack releases i simply added 420 into the string. See the following screenshot for a example.
You can edit the entire string, but its not necessary. After editing the bytes you wish just resave it and then you have your undetected dll. If you do not release it then most likely it will not become detected. That's if my random MD5 method in my loader doesn't kill off the private hex'ed copies by getting those MD5's detected :P.
Anyways that's pretty much all there is to it. A alternative if you don't want to hex edit it or have a problem hex editing it is my Exile's Hack Loader v3. Using the injector in EHL v3 will apply this same method just with entire randomness instead. The loader/injector edits the dll in this same manner before it saves the temporary copy to be injected therefore creating a random MD5 every time its to be injected.
Hope this helps someone and don't forget to click Thanks!
Once you find the location you edit some of the bytes to what ever you wish. For example for a couple of my edited hack releases i simply added 420 into the string. See the following screenshot for a example.
You can edit the entire string, but its not necessary. After editing the bytes you wish just resave it and then you have your undetected dll. If you do not release it then most likely it will not become detected. That's if my random MD5 method in my loader doesn't kill off the private hex'ed copies by getting those MD5's detected :P.
Anyways that's pretty much all there is to it. A alternative if you don't want to hex edit it or have a problem hex editing it is my Exile's Hack Loader v3. Using the injector in EHL v3 will apply this same method just with entire randomness instead. The loader/injector edits the dll in this same manner before it saves the temporary copy to be injected therefore creating a random MD5 every time its to be injected.
Hope this helps someone and don't forget to click Thanks!
.
Originally Posted by R3dLine
