Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


Help for a noobie! Questions about detection

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine
View previous topic :: View next topic  
Author Message
Huntbutt
How do I cheat?
Reputation: 0

Joined: 10 Dec 2013
Posts: 3

PostPosted: Tue Dec 10, 2013 12:57 am    Post subject: Help for a noobie! Questions about detection Reply with quote

Hello, I'm kind of new to Cheat Engine and I have a few questions! I have changed some of the cheat engine file names to something else so that there's a chance that it might be a little harder to detect...is there anyway to make it undetected? I have Delphi 7 and all that and saw a tutorial on it but it really didn't make sense... I do realize that that is probably the best way to do it, but that's if you want it to be MAXED out on undetection! Is there anything I can do to make it harder to detect , that a noob can do? When I run CE in task manager it still has the normal default name "Cheat Engine 6.3 " even though I changed the name of the file and all of that. Can someone please help !Smile And also, does changing the names of the files *the .dlls* and all that, actually do a thing at all?

Thanks Cool

_________________
yewz yowar sk3lz
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 471

Joined: 09 May 2003
Posts: 25819
Location: The netherlands

PostPosted: Tue Dec 10, 2013 7:03 am    Post subject: Reply with quote

Easiest thing that noobs can do : Use a hexeditor and replace every occurrence of "Cheat" to "Blaaa" or another 5 character name)

Changin the .exe name works for some anti cheats. Renaming dll's is a bit more tricky as you'll then need to change it in the exe as well then

_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
mgr.inz.Player
I post too much
Reputation: 222

Joined: 07 Nov 2008
Posts: 4438
Location: W kraju nad Wisla. UTC+01:00

PostPosted: Tue Dec 10, 2013 4:37 pm    Post subject: Reply with quote

And of course, if you release this, it will be flagged after few days.


And of course, they can use "fuzzy hashes" (like ssdeep).

Example:
Create qwertrocket-x86_64.exe, just replace all cheat with qwert and engine with rocket. Both ansi and unicode.

SHA1 sums:
240f0c622e6c060ddf37de05d3f86ddd85906006 *cheatengine-x86_64.exe
652bf0266d4060838f67ffa8fe6428398c82d160 *qwertrocket-x86_64.exe

MD5 sums:
5f7050068ae458f6f549d0c4668d91e4 *cheatengine-x86_64.exe
ee65d310acaebe0e68a6cd3fcf094ef2 *qwertrocket-x86_64.exe

Great, different checksums/hashes (cryptographic hashes).
What about fuzzy hash?

Code:
>ssdeep.exe -b cheatengine-x86_64.exe
ssdeep,1.1--blocksize:hash:hash,filename
98304:qk5CI1ZZgl/g/9a5C4OlYShgj8ngEnoSE5n:qlGyIg8k,"cheatengine-x86_64.exe"

>ssdeep.exe -b qwertrocket-x86_64.exe
ssdeep,1.1--blocksize:hash:hash,filename
98304:qk5CI1ZZgl/g/9a5C4OlYShg58dgEnoSE5/:qlGyIC8i,"qwertrocket-x86_64.exe"


We computed the fuzzy hash of those two files. Yes, hashes are slightly different:
98304:qk5CI1ZZgl/g/9a5C4OlYShgj8ngEnoSE5n:qlGyIg8k
98304:qk5CI1ZZgl/g/9a5C4OlYShg58dgEnoSE5/:qlGyIC8i

What does that mean?

We compute the fuzzy hash of one file and use the matching mode to match the other one:
Code:
>ssdeep.exe -b cheatengine-x86_64.exe > hash_of_original_exe
>ssdeep.exe -bm hash_of_original_exe qwertrocket-x86_64.exe
qwertrocket-x86_64.exe matches hash_of_original_exe:cheatengine-x86_64.exe (93)

So, qwertrocket-x86_64.exe is similar to cheatengine-x86_64.exe in 93%.

_________________
Back to top
View user's profile Send private message MSN Messenger
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> Cheat Engine All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites