 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Huntbutt How do I cheat?
Reputation: 0
Joined: 10 Dec 2013 Posts: 3
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 471
Joined: 09 May 2003 Posts: 25820 Location: The netherlands
|
Posted: Tue Dec 10, 2013 7:03 am Post subject: |
|
|
Easiest thing that noobs can do : Use a hexeditor and replace every occurrence of "Cheat" to "Blaaa" or another 5 character name)
Changin the .exe name works for some anti cheats. Renaming dll's is a bit more tricky as you'll then need to change it in the exe as well then
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
mgr.inz.Player I post too much
Reputation: 222
Joined: 07 Nov 2008 Posts: 4438 Location: W kraju nad Wisla. UTC+01:00
|
Posted: Tue Dec 10, 2013 4:37 pm Post subject: |
|
|
And of course, if you release this, it will be flagged after few days.
And of course, they can use "fuzzy hashes" (like ssdeep).
Example:
Create qwertrocket-x86_64.exe, just replace all cheat with qwert and engine with rocket. Both ansi and unicode.
SHA1 sums:
240f0c622e6c060ddf37de05d3f86ddd85906006 *cheatengine-x86_64.exe
652bf0266d4060838f67ffa8fe6428398c82d160 *qwertrocket-x86_64.exe
MD5 sums:
5f7050068ae458f6f549d0c4668d91e4 *cheatengine-x86_64.exe
ee65d310acaebe0e68a6cd3fcf094ef2 *qwertrocket-x86_64.exe
Great, different checksums/hashes (cryptographic hashes).
What about fuzzy hash?
| Code: | >ssdeep.exe -b cheatengine-x86_64.exe
ssdeep,1.1--blocksize:hash:hash,filename
98304:qk5CI1ZZgl/g/9a5C4OlYShgj8ngEnoSE5n:qlGyIg8k,"cheatengine-x86_64.exe"
>ssdeep.exe -b qwertrocket-x86_64.exe
ssdeep,1.1--blocksize:hash:hash,filename
98304:qk5CI1ZZgl/g/9a5C4OlYShg58dgEnoSE5/:qlGyIC8i,"qwertrocket-x86_64.exe" |
We computed the fuzzy hash of those two files. Yes, hashes are slightly different:
98304:qk5CI1ZZgl/g/9a5C4OlYShgj8ngEnoSE5n:qlGyIg8k
98304:qk5CI1ZZgl/g/9a5C4OlYShg58dgEnoSE5/:qlGyIC8i
What does that mean?
We compute the fuzzy hash of one file and use the matching mode to match the other one:
| Code: | >ssdeep.exe -b cheatengine-x86_64.exe > hash_of_original_exe
>ssdeep.exe -bm hash_of_original_exe qwertrocket-x86_64.exe
qwertrocket-x86_64.exe matches hash_of_original_exe:cheatengine-x86_64.exe (93) |
So, qwertrocket-x86_64.exe is similar to cheatengine-x86_64.exe in 93%.
_________________
|
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|