Radar & Trigger - Self modifying - External

Status: UNDETECTED since 07-01-2015




Intro

Over the last few days I have worked on this small hack with one (hopefully) effective feature to keep the hack undetected for long periods of time.
The feature isn't exactly in the hack itself but in the loader which is actually a program that will add alot of junk code (the junk code generation can be done alot better but it should be enough for now) in between the original code lines, it will also swap the position of function declarations and the position of code in a function (whenever it is swapable).

For this to work you need to have the latest Visual C++ (Studio).
The Visual Studio Express 2013 for Windows should work but I only have VS 2013 Ultimate installed.

I tried to make the program as user friendly as possible but it is more complicated then using "normal" hacks.

---

I posted this on another forum first (like 1 week ago) and I am the same guy as on that forum.
I am using this username as I forgot the password of the account with my username and the email was a 10 minute mail like mail.

How to use:



The "View compiler output" checkbox is useful when the program fails to compile, if you have C++ knowledge you can probably debug it yourself and otherwise you should post the output here.

The "Protect file" checkbox allows you to protect/pack the generated exe with for example VMProtect or Themida before it is run. Make sure the protected file has the exact same name!!!

The "Delete after exit" checkbox will delete the generated hack when you close the hack, otherwise it will just sit in your TEMP folder.

Run the loader as admin!!!
If the hack stops working press INSERT again while ingame

1. Download Microsoft Visual Studio 2013 Express For Windows if you do not have it installed!
2. Press the "..." button and browse to your cl.exe compiler.
   It should be a vc compiler with support for std::threads.
   In my case the location is: "C:\Program Files\Microsoft Visual Studio 12.0\VC\bin\cl.exe"
3. Press execute

"Something went wrong when compiling the randomized source!":
Try to compile it again, otherwise check the View compiler output checkbox and try it again, when it fails post the compiler output to this forum.

The generated hack.exe stopped working:
This happens sporadically when the junk code the loader added is creating errors, just generate a new hack (Press execute again).

Changing offsets:
You can change the offsets in required/offsets.txt

More info:
My goal was to change the signature of the hack every time it runs, the current junk code generator only adds int declarations and adding & substraction of ints so maybe the signature will not change enough.

I am not an expert in C++ nor in reverse engineering, I have not studied the behaviour and working of VAC so this may be a useless thing that I have done but hopefully it is not.

Source code:
The source code of the C++ hack with tags for the generation of junk code is available in the zip (required/src/).
The loader is made in C# and is easily refactored/decompiled or you could just sent me a PM requesting the source.

Download:
Jotti: http://virusscan.jotti.org/en/scanre...579897ab0c9947
Virustotal: http://virustotal.com/en/file/738187...is/1420640855/


Comparison

Made by a user from another forum with a tool that scans for signatures kind of like vac does.

Video
https://vid.me/ovrC

Happy hacking,

Merccy