PoeHUD - Overlay for Path of Exile

[Trejox]

honestly I have no idea what's going on in here

a couple of weeks ago when leagues started with 1.3 and Coyl was busy in real life for a few days and the update came late everybody started to freak out and spread rumours that it was cancelled because of leeches. then he came back and explained(even though it was not necessary, free program etc.)why he was late and promptly uploaded a working version. everybody was happy. fastforward a couple of patches Coyl moved the link in his first post to a different site with a newer version which is now down, and people claim the size is different and has virus/keyloggers. BUT Coyl has not been back yet and has not said anything - probably busy in real life again. then some purple name admin(or whatever) person comes along and says it's officially been cancelled and gone private because of people complaining about keyloggers(it was like 3 or 4 people out tends of thousands downloading? lol) and uploading their own version(because the original uploader has not been seen in a while and the russian site/size problem seemed dodgy). All I see here is a natural turn of things due to Coyl not being around and people being suspicious.

However the hack still works fine for me(using one uploaded on like the 22nd or so) and I have no reason at all to assume that Coyl did anything malicious to the file, obviously I don't know the guy but can't imagine this being the case.

[Treasure_Box]

I've been doing some reading, and if he is using confuser ex, one of the things mentioned in support forums for that tool talks about when you use the maximum obfuscation setting that it can cause problems like false positives. The use of confuser ex is going to add additional size to the exe too.

[Jaerin]

I've been doing some reading, and if he is using confuser ex, one of the things mentioned in support forums for that tool talks about when you use the maximum obfuscation setting that it can cause problems like false positives. The use of confuser ex is going to add additional size to the exe too.

DIng ding ding winner winner chicken dinner. This is exactly why Virustotal and every online scanner will not give you anything of use. Because it can't read the EXE and therefore instead of telling you that it spits out a bunch of nefarious looking pseudo-positives about not being able to read the file.

Go back and rescan all the previously packed versions and it will be the same.

I guarantee you that when it is packed, if there is a virus or malware, you won't know about it unless you put a wrapper around the exe and detect all the outbound communications. Oh but then how are you going to tell if that auto-updater is actually only sending a request to update? The fact of the matter is you have no idea if you have a virus or malware in your software. Your AV software and Anti-malware are huge waste of CPU and Disk IO. The things they can actually detect only an idiot would get infected with them. Like every pop up that says that your computer is infected with a virus. Everything else the AV/AMW software is guessing based on some shitty fuzzy logic. In fact it might submit it to a database and check to see if anyone is running it and have reported problems with it. Ever wonder why things disappear from your computer without any explanation? It's your AV software "protecting" you.

As I said all that has happened is the updated versions have gone private. If you want it updated do it yourself. Which yes means going back to one of the open source versions and updating it yourself.

[Manocean]

Ding ding ding, try to pack clean poehud.exe with ConfuserEX.
Why are you people so stupid?

Q: The executable gets detected by a few antiviruses as Trojan.MSIL.Injector.Gen (or something like that)
A: That is to be expected. Client hacks do write into the PathOfExile process memory - since it's mostly malware that writes into memory of other processes, PoeHUD gets detected for having a similar behaviour.

There is ZERO false positive detection with clean exe.
Ok, now we know, clean unpacked exe dont detected by any antivirus.

Now we try to pack clean exe with ConfuserEx.
Do it ****in by yourself, if you dont believe me.
Pack clean exe with confuser.

THERE IS ONLY 2(3) FALSE POSITIVE DETECTION WITH CLEAN VERSION

Coyls exe have 25 «false positive» detections.

Can you do the math?
There is a difference between 2 and 25 detections.

If you are stupid and did not understand how the obfuscator works, dont misleading the people.


And again, just do it by yourself, pack clean exe and make sure there is some viruses in Coyls version.

[Dave90]

DIng ding ding winner winner chicken dinner. This is exactly why Virustotal and every online scanner will not give you anything of use. Because it can't read the EXE and therefore instead of telling you that it spits out a bunch of nefarious looking pseudo-positives about not being able to read the file.

Go back and rescan all the previously packed versions and it will be the same.

I guarantee you that when it is packed, if there is a virus or malware, you won't know about it unless you put a wrapper around the exe and detect all the outbound communications. Oh but then how are you going to tell if that auto-updater is actually only sending a request to update? The fact of the matter is you have no idea if you have a virus or malware in your software. Your AV software and Anti-malware are huge waste of CPU and Disk IO. The things they can actually detect only an idiot would get infected with them. Like every pop up that says that your computer is infected with a virus. Everything else the AV/AMW software is guessing based on some shitty fuzzy logic. In fact it might submit it to a database and check to see if anyone is running it and have reported problems with it. Ever wonder why things disappear from your computer without any explanation? It's your AV software "protecting" you.

As I said all that has happened is the updated versions have gone private. If you want it updated do it yourself. Which yes means going back to one of the open source versions and updating it yourself.

You are obviously very knowledgeable in computer science, I don't know if you studied it in university or spent some years teaching it yourself. Most of us(or me atleast) who would like to update offsets or whatever must be done to update the hack are not that fortunate, did not have the time or gifted with this talent naturally. I have tried asking here, other forums and via youtube guides and google to find a way to learn how to update the offsets myself in a hack like this to carry on using it even when support is dropped. Came up empty. Could you maybe link me something or to somewhere with which I could try and do it myself? Without having to spend a year reading books. Obviously if it's too complicated to bypass this step then just mention it now and i'll have to sit here and carry on "leeching" or pay again. If it's something that can be done by anyone after having learned how to do it properly(edit the source to make it compatible with the latest version of the game) then i'm willing to update it myself for the rest of us here on the forum. Cheers

[Treasure_Box]

Well in order to be able to test this, we need to know what version of Confuser Ex is being used(that is, if ts confuser ex, and not another obfuscation tool). Then compile with each output setting, and test to see if it creates a match for virus total pre-compiled exe matching the source date. This doesn't tell us if the hud was clean or not, it just gives us a working base to start from.

[Jaerin]

You are obviously very knowledgeable in computer science, I don't know if you studied it in university or spent some years teaching it yourself. Most of us(or me atleast) who would like to update offsets or whatever must be done to update the hack are not that fortunate, did not have the time or gifted with this talent naturally. I have tried asking here, other forums and via youtube guides and google to find a way to learn how to update the offsets myself in a hack like this to carry on using it even when support is dropped. Came up empty. Could you maybe link me something or to somewhere with which I could try and do it myself? Without having to spend a year reading books. Obviously if it's too complicated to bypass this step then just mention it now and i'll have to sit here and carry on "leeching" or pay again. If it's something that can be done by anyone after having learned how to do it properly(edit the source to make it compatible with the latest version of the game) then i'm willing to update it myself for the rest of us here on the forum. Cheers

I haven't updated. It's not simple to update as people have shown here. People seem to think that it is and that everyone should just do it for them and hand them the results. I am often in the same boat as you because I'm not knowledgeable in the actual coding of reverse engineering. I understand what and how they are doing it, but the actual details of the code elude me. This is why I make sure to support the people who ARE writing the code because I know that I can't. I encouraged everyone to do the same and everyone scoffed about how they were poor or said they were contributing, but never actually did. The fact is people sacrifice their time to make these programs usually for free and every time people take it for granted. They bitch and complain when it doesn't work, they complain when it doesn't work the same way it used too, they have all kinds of complaints, but when it comes time to pony up and actually give back something, they don't have time.

So don't look at me to get this back up and running, I did it once with my wallet and it worked. Too bad no one else helped me out.

You got your use out of my $100 worth of support, guess that's been used up.

[Jaerin]

Ding ding ding, try to pack clean poehud.exe with ConfuserEX.
Why are you people so stupid?

There is ZERO false positive detection with clean exe.
Ok, now we know, clean unpacked exe dont detected by any antivirus.

Now we try to pack clean exe with ConfuserEx.
Do it ****in by yourself, if you dont believe me.
Pack clean exe with confuser.

THERE IS ONLY 2(3) FALSE POSITIVE DETECTION WITH CLEAN VERSION

Coyls exe have 25 «false positive» detections.

Can you do the math?
There is a difference between 2 and 25 detections.

If you are stupid and did not understand how the obfuscator works, dont misleading the people.


And again, just do it by yourself, pack clean exe and make sure there is some viruses in Coyls version.

Can you send me a link to this "Coyl's version" I'd like to compare it against my private version. I would be willing to guess that you don't have anything from Coyl at all...its probably some hacked up version that someone posted on Mediafire pretending that they fixed it.

[Manocean]

Well in order to be able to test this, we need to know what version of Confuser Ex is being used(that is, if ts confuser ex, and not another obfuscation tool). Then compile with each output setting, and test to see if it creates a match for virus total pre-compiled exe matching the source date. This doesn't tell us if the hud was clean or not, it just gives us a working base to start from.

The current version is packed with ConfuserEx - https://github.com/yck1509/ConfuserEx/releases

It was last version (0.4) according to suspended poehud.com

[Manocean]

Can you send me a link to this "Coyl's version" I'd like to compare it against my private version. I would be willing to guess that you don't have anything from Coyl at all...its probably some hacked up version that someone posted on Mediafire pretending that they fixed it.

Lol, there is link on virustotal https://www.virustotal.com/en/file/f...664b/analysis/
From official site (poehud.com) Did you know how to use google cache? Find it if you dont trust me.
Hash is fd814aebeb3663130b5242e44794736e2ac01880de1e1a234136cd3d8e58664b
This is exact same file, which was uploaded by Coyl.

[Jaerin]

Yes we know what used to pack it. They said you would have to use the same version and settings as Coyl to be sure.

Okay so he took the website down. I'll check and see if he has any plans to keep updating it. I would guess if the site is down that he doesn't, at least not publicly.

[Manocean]

Yes we know what used to pack it. They said you would have to use the same version and settings as Coyl to be sure.

Why ever you defend Coyl?
Wait... This guy have some «private version».
Let me guess. Without viruses, right? Of course it is.

Let me ask you a question. Did you ever use ConfuserEx? I did. And I would be willing to guess that you don't.

Just stop shittalk and defend your friend if you even dont try to check it out.

[Philss]

so what is going on here? im still using last version just fine i came here to see if there was any update but i hear ppl talking about it not beeing updated?? WTF can we still get a pay method or somethnig?

[Jaerin]

so what is going on here? im still using last version just fine i came here to see if there was any update but i hear ppl talking about it not beeing updated?? WTF can we still get a pay method or somethnig?

No it's been updated Manocean just keeps insisting that it MUST be a virus because Virustotal is reporting that it has been packed. The same way that is always does, but apparently because more than just 2 figure out that it is packed now it must contain viruses.

[Philss]

No it's been updated Manocean just keeps insisting that it MUST be a virus because Virustotal is reporting that it has been packed. The same way that is always does, but apparently because more than just 2 figure out that it is packed now it must contain viruses.

But when i click the download link it send me to some russian website and i dont see any download buton