Cheat Engine

Polynomial

I'm attempting to develop a small stub executable that launches CE in a way that makes it undetectable, without needing a recompile. Here's what it does so far:

1) Stores the standard CE executable and extracts, appending some random data on the end to fool hash checks.
2) Modifies the CE window title to something random.
3) Renames the executable file.
4) Alters some values (including the file description meta) in the CE binary from "Cheat Engine" to "CE0123456789", with a random number.

Any ideas to help make it undetectable?

Dark Byte · Posted: Sun Apr 11, 2010 1:02 pm Post subject:

change the position and widths of the windows and objects (resource editing)

Cheat Engine User · Posted: Sun Apr 11, 2010 1:09 pm Post subject:

unlink yourself from EPROCESS

Polynomial · Posted: Sun Apr 11, 2010 2:00 pm Post subject:

Cheat Engine User · Posted: Sun Apr 11, 2010 4:09 pm Post subject:

Polynomial · Posted: Sun Apr 11, 2010 4:16 pm Post subject:

I'll give it a go.

When CE attaches its debugger, is there a DLL injected into the target process? If so, I'll need to remove it from the process' loaded module list. This could get difficult.

Noz3001 · Posted: Tue Apr 13, 2010 10:50 am Post subject:

giwang · Posted: Sat Apr 24, 2010 12:22 pm Post subject:

Array of bytes in the combo box string has been detected

Polynomial · Posted: Mon Apr 26, 2010 8:23 pm Post subject:

I actually figured that certain programs might check that, so I was going to switch the spaces to underscores and stick a space or two on the end.

As regards unlinking from EPROCESS, if it's done by CE, then I'd guess it's done with Kernel Mode Stealth in the options. I'd probably need a clarification on this by Dark Byte to be sure though, since I can still see it in the task manager. Might be that CE checks the calling process.