HOWTO: Create a custom patch (e.g. for Cheat Engine)

[Etherea]

Warden uses several methods to detect cheaters in WoW. We know that warden actively scans your system memory for known cheating programs. Also, warden looks at the names of processes on your computer as well. We can only speculate that Warden computes a "hash" of each of your processes in memory and tries to match these values with those of known cheating applications. This guide is to create a custom "patch" to an application (such as Cheat Engine) as to rename the Window and Taskbar titles. In doing so, the programs footprint will also be modified to prevent Blizzard from simply hashing the process and comparing with known values.

What you need:
-Any hex editing software. There are plenty of free ones available. Search google for "hex editor".
-Program that you want to patch.

Steps:
1. Open the program you want to patch in the hex editor (e.g. "Cheat Engine.exe")
2. Search for text (ASCII) strings that match the Window and Taskbar titles (e.g. "Cheat Engine 5.2").
3. Overwrite part (or all) of the text with other characters.
4. Repeat search until text is not found.
5. Save your modified executable over the original.

Now when you launch the program, you should see your modified values in the window and taskbar titles. This will also have the effect of changing the "hash" value of processes memory, making it harder to detect.

This is essentially what relz no window patch was doing, except that his only modifies the taskbar title (not the window title) and overwrites them with null-bytes. The problem with just using his patcher, is that hundreds of MMOwned users have used it already, and likely Blizz is familiar with this variation of Cheat Engine. That is why you should take the time to make a custom patch to your applications. Note that this will not work with some applications as the binaries are "packed" (compressed). For example if you open Glider.exe in the hex editor you will not be able to find the text string "Glider" anywhere.

Notes on Safe Cheat Engine installation:
I am using Cheat Engine 5.2 with both stealth modes enabled, "prevent detection of debugger", and a custom patch to the executable. You should also rename the folder and the .exe (to be paranoid). Do not bother installing Process Guard as it will not help you be undetected.

Happy Hacking!

lo-fi ;o)

[eddy9994]

nice stuff

+ rep

[yourmom69]

sweet +rep

[Rohi]

I did try to use cheat engine for 2 hours on wow and no bans :s but good idea

[Pragma]

This is a good idea, although most wow hacking programs are undetectable.

+rep

[loganpimp]

very nice!

[MaXe]

Very nice +Rep Gave me some ideea's hehe

This is a good idea, although most wow hacking programs are undetectable.

+rep

In fact most programs are quite detectable now

[goider]

Very nice +Rep Gave me some ideea's hehe




In fact most programs are quite detectable now

damn blizz and their searchinessness

[2dgreengiant]

danke for this +repppp

[Elites360]

thank you, this really helps. +rep

[mmoninja]

nice +rep!
i wonder why everyone says process guard doesnt work... i use cheat engine all the time without any stealth mode enabled, with just process guard on, and i get all these in my process guard log file...

Sat 23 - 18:06:58 [READ] c:\wow\wow.exe [2552] was blocked from reading c:\wowh\o\o.exe [2684]
Sat 23 - 18:06:58 [READ] c:\wow\wow.exe [2552] was blocked from reading c:\wowh\o\o.exe [2684]
Thu 14 - 20:46:37 [PHYSICAL MEMORY] c:\wow\wow.exe was blocked from accessing physical memory
Thu 14 - 20:46:48 [PHYSICAL MEMORY] c:\wow\wow.exe was blocked from accessing physical memory

etc etc etc, i get tons of those all the time (o.exe is what i renamed my cheat engine oto)

[Zore.]

Nice +reperz

[Kinch]

Lawl. I get an "Access Denied" message when i try to save this in my Hex Editor... nice anyways.

[Etherea]

Reason why cheatengine is detected is that it is compiled and that Blizzard does have acces to the compiled version. By just adding some offset checks you can easily see if cheatengine are running even with processguard on since it can check persitent dll files too. If you recompile CheatEngine after moving around the code and addning new empty functions to move around the offsets you will be able to make a 100% secure cheatengine.

UnknOwned brings up a good point on Matsy's post (about DLL injection) that Cheat Engine is open source, and that a safer way is to make changes to the source code and then recompile it. I recommend this method over the way I described, but it requires a bit more work as you would need the right compiler, and have some programming experience. Also, the method described here works even when you don't have the source code.

[monkeyman]

Lawl. I get an "Access Denied" message when i try to save this in my Hex Editor

yeah i got this problem too, anybody know how to fix it? :confused: