Okay, let's try to understand how does it work to make your own.
I opened an old name changer with debugger.
After few minutes of search we can find this:
Quote:
|
75 07 B8 00 00 00 00 EB 00 6A 01
|
Probably the pattern of the name check
And now, how do you make it undetectable ?
Oh wait, we can see the function AddVectoredExceptionHandler
By using this function the right way, we can hook a part of a code without changing the opcode.
Conclusion: Hook the function with the pattern by using vectored exceptions handler, enjoy your name changer & protect it