This is an advanced guide covering only conceptual stuff for people who already know how to create trainers. It's not the stuff you should completely rely on, but something I figured out for myself by inspecting X-Trap's behavior.
At the moment, X-Trap's detection routine is pretty lame.
Stuff you could try to prevent your hack from being detected:
That's all for now; hope UG folks will add some nice advises to my lame assumptions :) Happy hacking!
At the moment, X-Trap's detection routine is pretty lame.
- It has a blacklist of program's it doesn't like to be running.
- It verifies a checksum of static address space of a protected application (it either does it once or pretty rarely)
Stuff you could try to prevent your hack from being detected:
- In order to fight the blacklisting, run your trainer with random image name each time. Example: it runs, copies itself into a tempfile, runs the tempfile which patches the memory.
- X-Trap doesn't like when remote processes mess with its application's address space. Make your code reside in application's address space (injection). Do your modifications in a while after the application starts, so we're sure X-Trap's done with its checks already.
- Beat blacklisting when using LoadLibrary - make sure the file name is random and and always deallocate the filename string from remote process memory.
- Advanced: don't inject a DLL, inject the code itself by allocating memory inside the target process. I haven't done this myself (because DLL injection still works and is much easier :p), but this will be a bold option when X-Trap detection mechanism improves.
That's all for now; hope UG folks will add some nice advises to my lame assumptions :) Happy hacking!
