From reading through the crossfire section i noticed everything gets detected in like a day!
So i decided to try and make a patcher. After i made it, i noticed a few people on this forum had a similar idea for dll's in another section.
Iv not patchd any dll's and tested them but its capable of patching them too.
I did however test it on @
sa3ed 's Injector v0.9! because it is detected.
Screen
[IMG]http://i203.photobucke*****m/albums/aa29/Baxter_esa/InjectorScreen.png[/IMG]
The patcher seems to work fine. As you can see, i got in the game with the hack tool open.
Screen using his patched injector
[IMG]http://i203.photobucke*****m/albums/aa29/Baxter_esa/Patchedscreen.png[/IMG]
Unpatched version got detected straight away.
Screen using injector not patched
[IMG]http://i203.photobucke*****m/albums/aa29/Baxter_esa/UnpatchedScreen.png[/IMG]
Heres a scrreen of the patcher. Simple gui cause im shit at it.
The patcher
[IMG]http://i203.photobucke*****m/albums/aa29/Baxter_esa/MaScreen.png[/IMG]
C# Function source
Code:
void _Patch(string keyword)
{
if (keyword == string.Empty) return;
OpenFileDialog OF = new OpenFileDialog();
if (OF.ShowDialog() == DialogResult.OK)
{
byte[] SIn = File.ReadAllBytes(OF.FileName);
bool Found = false;
if (SIn.Length == 0) return;
byte[] SFor = Encoding.ASCII.GetBytes(keyword);
int[] Byts = new int[256];
int End = SFor.Length - 1, j = 0;
for (int i = 0; i < 256; i++)
Byts[i] = SFor.Length;
for (int i = 0; i < End; i++)
Byts[SFor[i]] = End - i;
while (j <= SIn.Length - SFor.Length & !Found)
{
for (int i = End; SIn[j + i] == SFor[i]; i--)
{
if (i == 0)
{
#region Random String
string _Chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx yz";
char[] Buff = new char[keyword.Length];
Random Ran = new Random();
for (int k = keyword.Length; k-- > 0; )
{
SIn[j + k] = (byte)_Chars[Ran.Next(_Chars.Length)];
}
#endregion
Found = true;
string _Extension = Path.GetExtension(OF.FileName), FileName = Path.GetFileNameWithoutExtension(OF.FileName);
File.WriteAllBytes(Path.GetDirectoryName(OF.FileNa me) + @"\" + "Patched-" + FileName + _Extension, SIn);
break;
}
}
j += Byts[SIn[j + End]];
}
MessageBox.Show(Found ? "Patched successful..." : "Keyword not found. Nothing patched...", "Status...");
}
}
VB Function source
Code:
Private Sub _Patch(ByVal keyword As String)
If keyword = String.Empty Then
Return
End If
Dim _Open As New OpenFileDialog
If (_Open.ShowDialog = DialogResult.OK) Then
Dim SIn As Byte() = File.ReadAllBytes(_Open.FileName)
Dim Found As Boolean = False
If SIn.Length = 0 Then
Return
End If
Dim SFor As Byte() = Encoding.ASCII.GetBytes(keyword)
Dim Byts(256) As Byte
Dim _End As Integer = SFor.Length - 1, j = 0
For i As Integer = 0 To 256
Byts(i) = SFor.Length
Next
For i As Integer = 0 To _End
Byts(SFor(i)) = _End - i
Next
Dim Index As Integer = 0
While j <= SIn.Length - SFor.Length And Not Found
Index = _End
Do While SIn(j + Index) = SFor(Index)
If Index = 0 Then
Dim _Chars As String = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwx yz"
Dim Buff(keyword.Length) As Char
Dim Ran As New Random
For k = keyword.Length To 0 Step -1
Dim tmp As String = _Chars(Ran.Next(_Chars.Length))
SIn(j + k) = CByte(Asc(tmp))
Next
Found = True
File.WriteAllBytes(Path.GetDirectoryName(_Open.Fil eName) & "\Patched-" & Path.GetFileNameWithoutExtension(_Open.FileName) & Path.GetExtension(_Open.FileName), SIn)
Exit Do
End If
Index -= 1
Loop
If Byts(SIn(j + _End)) = 0 Then
Exit While
End If
j += Byts(SIn(j + _End))
End While
MessageBox.Show(If(Found, "Patched successful...", "Keyword not found. Nothing patched..."), "Status...")
End If
End Sub
How it works..
It searches the file using the boyer moore horspool search algorithm for a keyword.
In this case im using the word *program*. If the keyword is found, it'l replaced with a random string of equal length and the file is rebuilt as a new patched file. Changing the MD5 and or SHA-1 hash but keeping the same file size.
Unless xtrap have other methods of detection, i cant see this new patched injector being detected again as long as it stays private.
How to use..
Just click the patch button and choose the file you wish to patch. A new file is created. Use the newly created file.
The keyword on the app can stay the same but if you wish to search for another keyword, just change it.
Virustotal
Jotti
@
Hero
@
Austin
@
Jigsaw
@
Royku
@
BACKD00R
@
DaRk
Use at your own risk. The price you pay when dealing with xtrap.
Please test it on a fake account first. If a hack is detected, not patch a loader,
patch the injector and the hack.dll separately to see if it works
Dont be stupid and try using this app on a patched hack. Patched hacks mean the memory was relocated.
Detected hack is xtrap related.