Alternative to Detected C++ Code?

Quote:

Originally Posted by Jeoni I don't know how XCrap exactly works, but I would recommend you to crypt your strings (simple xor-encryption or something like that) and use function proxyfying to cover winapi calls. Last thing would look like this for the winapi function OpenProcess: Code: typedef HANDLE (WINAPI* __OpenProcess) ( DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId); __forceinline HANDLE WINAPI _OpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId){return reinterpret_cast<__OpenProcess>(GetProcAddress(GetModuleHandle(/*kernel32.dll*/XorStr(12, 0xA8, 0xC342D44B, 0xC14F9113, 0x8E7BF271).c_str()), /*OpenProcess*/XorStr(11, 0x9A, 0xD569FD79, 0xC667FB70, 0xF762E300).c_str()))(dwDesiredAccess, bInheritHandle, dwProcessId);} (I used a method called XorStr to decrypt the strings used in GetModuleHandle and GetProcAddress) Than just call _OpenProcess instead of OpenProcess. This method cover your used functions out of the IAT. Next thing is that your code contains functions you didn't reveal to us (e.g. ChangeHairStyle, Teleport), which is ok. I guess you do some memory writing there. Maybe XCrap validates these regions? So if you are standing here now and one second later some kilometers away it's quite obvious, isn't it? Same thing could be with your output to the ingame chat window (?) via PrintMessageOnChat. Maybe only specified functions are allowed print something like that so your call is being detected by that? Hope that this will help you ;) Jeoni

void HairStAdd()
{
	if( iHairStyle < 12 )
		iHairStyle = iHairStyle + 1;
	PrintMessageOnChat( "Hairstyle #%d", iHairStyle );
}

void HairStSub()
{
	if( iHairStyle > 0 )
		iHairStyle = iHairStyle - 1;
		PrintMessageOnChat( "Hairstyle #%d", iHairStyle );
}

void HairStSet()
{
	PrintMessageOnChat( "Changing hairstyle to #%d", iHairStyle );
	ChangeHairstyle( iHairStyle );
}

if( ( GetAsyncKeyState( VK_MENU) & 0x8000 ) == 0x8000 )
{
	if( GetAsyncKeyState( VK_ADD ) & 1 )
	{
		HairStAdd();
	}
	if( GetAsyncKeyState( VK_SUBTRACT ) & 1 )
	{
		HairStSub();
	}
	if( GetAsyncKeyState( VK_F12) & 1 )
	{
		HairStSet();
	}
}

Quote:

Originally Posted by Jeoni Well, if ChangeHairstyle is just about changing some address, WPM (+RPM if you need to read one or more pointer(s)) would work, too. But XCrap could have detection methods for this, too, but I don't know. With string encryption I mean something like this: imagine you have functions encrypt and decrypt. Both taking a string as argument and return the encrypted / decrypted string. Now, in your DLL you have the instruction "PrintMessageOnChat( "Hairstyle #%d", iHairStyle );" and you don't want the string "Hairstyle #%d" to be seen in your DLLs data section. Before you compile your DLL you use your encrypt function (used by an external tool or something) to encrypt this string. Let's say your encrypted string is "ayicxzfgyeawdaop". Then you change your line "PrintMessageOnChat( "Hairstyle #%d", iHairStyle );" to Code: PrintMessageOnChat( decrypt("ayicxzfgyeawdaop"), iHairStyle ); Now only the crypted string "ayicxzfgyeawdaop" is stored in your DLL and is decrypted (but not stored somewhere except a temporary heap space or the stack) at runtime in order to pass it to the PrintMessageOnChat function. Now to the proxy functions. In order to understand it, you have to know how the IAT works: [Only registered and activated users can see links. Click Here To Register...] (reconstructing the IAT is interesting but not necessery for understanding it). Feel free to google it for yourself if something is not clear. So proxified functions would avoid this system by getting the functionpointer at runtime via GetModuleHandle / GetProcAddress and not via the IAT entry. Even more, the IAT address wouldn't be used but also wouldn't be set (this is normally done at compiletime) as the compiler doesn't know what function you want to execute (as the call destination is dynamically acquired at runtime) and won't write the IAT entry therefore. For more information please refer to the link above and to the msdn sites of GetProcAddress / GetModuleHandle. Sorry if I confuse you with this. Maybe it's not necessery to get around XCrap but I think it's quite usefull in some cases. I hope that this is clearer now :D Jeoni

int iHairStyle =0;
typedef int  (*t_HairStyle)     ( int );
t_HairStyle	   ChangeHairstyle        = (t_HairStyle)0x004484C2;

//and using it:

void HairStSet()
{
	PrintMessageOnChat( "Changing hairstyle to #%d", iHairStyle );
	ChangeHairstyle( iHairStyle );// <------ DETECTED CODE
}

typedef int  (*t_HairStyle)     ( int );
t_HairStyle	   ChangeHairstyle        = (t_HairStyle)0x004484C2;
ChangeHairstyle( iHairStyle );