Yo!
I decided to create again tutorial about scripting in AutoIt. This time I will show you, how to make your trainers undetected!
Some anti-hackshields use fielchecks (crc) to detect some tools (hgwc does it in games like S4 League, Crossfire etc.). I will show you a special way to bypass that. Ofc, you can do some byte patches in the programs that checks it, or hooks some apis but I wanna show you this way :3
In the theory, it looks like that:
So lets start! First we have to create a program that encrypts our tool (wich we wanna make undetected). I do it in this way:
In this source, we open the file, read the binarys, encrypt them and save them in a new file.
Ofc you can use other UDF's instead of the Crypt.au3, I choosed it because its already addet to the includes in AutoIt ;o In my example, I use sourcefiles, you can directly write the encrypted filebytes in the executable, its your decision how you do it. This is just a tutorial for suggest you some ideas ^^
After we have crypted the filebinary and saved it to a file we can start now with the stub:
Hm, thats really more code then before ^^ First, we check if the file is compiled (doesnt works with an .au3, dont know if it works with a3x. I dont think so...), after that, we check if its compiled as an 64 bit executable. This wont work good, so its better to compile this in 32 bit. Then, we check if the filesource exists (if not, we would have a dead process). Now, we read it, decrypt it (remember to use the same key and algorhytm in the encrypter and the stub! Otherwise it wont work!) and run the decrypted binary. Thats all.
The complete source and all the stuff wich is needet for testing and so on can get downloadet in the attachment! VT can be found there too.
As I said, there are much thinks that you can change, its your decision how you want to do it.
Hope you like my little tutorial ^^ This tutorial is only for education! What you do with this, is your responsibility.
Regards, K1ramoX
I decided to create again tutorial about scripting in AutoIt. This time I will show you, how to make your trainers undetected!
Some anti-hackshields use fielchecks (crc) to detect some tools (hgwc does it in games like S4 League, Crossfire etc.). I will show you a special way to bypass that. Ofc, you can do some byte patches in the programs that checks it, or hooks some apis but I wanna show you this way :3
In the theory, it looks like that:
- Encrypt the binary of your file you want to make undetected
- Write it in a sourcefile (you can do it in other ways, its just an example)
- Create a stubfile wich will run your tool from the memory (known as RunPE >> no additional processes)
So lets start! First we have to create a program that encrypts our tool (wich we wanna make undetected). I do it in this way:
In this source, we open the file, read the binarys, encrypt them and save them in a new file.
Ofc you can use other UDF's instead of the Crypt.au3, I choosed it because its already addet to the includes in AutoIt ;o In my example, I use sourcefiles, you can directly write the encrypted filebytes in the executable, its your decision how you do it. This is just a tutorial for suggest you some ideas ^^
After we have crypted the filebinary and saved it to a file we can start now with the stub:
Hm, thats really more code then before ^^ First, we check if the file is compiled (doesnt works with an .au3, dont know if it works with a3x. I dont think so...), after that, we check if its compiled as an 64 bit executable. This wont work good, so its better to compile this in 32 bit. Then, we check if the filesource exists (if not, we would have a dead process). Now, we read it, decrypt it (remember to use the same key and algorhytm in the encrypter and the stub! Otherwise it wont work!) and run the decrypted binary. Thats all.
The complete source and all the stuff wich is needet for testing and so on can get downloadet in the attachment! VT can be found there too.
As I said, there are much thinks that you can change, its your decision how you want to do it.
Hope you like my little tutorial ^^ This tutorial is only for education! What you do with this, is your responsibility.
Regards, K1ramoX
