Application Detection/Undetection

So lets say I just released a hack/macro. And after a few days it gets detected, but not patched. How is XingCode detecting it? Via memory? Or when something is hooked/attached into the game?

Also since it's only detected, if I re-compile my application would it still work?
I'm thinking to create a macro which has the functions like Builder and Stub. So the member can create the macro, (of course not literally create, re-create the application with existing codes in the stub), since the executable is re-created would that make it undetected again?

Thanks.

****** Open Handles can lead to a scan, random scans, strings, writing to read only pages, IAT, Peb(linked modules), Splicing hooks also known as detours, and signatures

Static: Fileinfos in combination with size, strings(pdb path for ex), IAT.

Catch-on Scans: Xigncode stores some detections in temp under a random file with dll extension, mui cache.

Originally Posted by zZzeta/S

****** Open Handles can lead to a scan, random scans, strings, writing to read only pages, IAT, Peb(linked modules), Splicing hooks also known as detours, and signatures

Static: Fileinfos in combination with size, strings(pdb path for ex), IAT.

Catch-on Scans: Xigncode stores some detections in temp under a random file with dll extension, mui cache.

Thanks @zZzeta/S I understood half the thing you said, lol. Just lack the knowledge but fear not I'm learning. Could you please tell me what IAT stands for? Because googling just "IAT" wont help.

Originally Posted by jaydeeph

Thanks @zZzeta/S I understood half the thing you said, lol. Just lack the knowledge but fear not I'm learning. Could you please tell me what IAT stands for? Because googling just "IAT" wont help.

Import Address Table. Another section in any valid PE file. If you use a func like GetAsyncKeyState there will be an import to User32.dll with GetAsyncKeyState addr.

Oh and I forogt return adress checks on certain funcs

Originally Posted by zZzeta/S

Import Address Table. Another section in any valid PE file. If you use a func like GetAsyncKeyState there will be an import to User32.dll with GetAsyncKeyState addr.

Oh and I forogt return adress checks on certain funcs

Ohh that makes a lot more sense now. Thanks a lot mate. Rep++ if I can.
Edit: Offtopic: What's the name of the anime on your profile pic? Looks cool.

Black Rock Shooter

Originally Posted by zZzeta/S

Black Rock Shooter

Thanks bro

.
@Riddick requesting a close on this thread, thanks bro.

Application Detection/Undetection

Similar Threads

Tags for this Thread