Change your executables

[Pilan]

I don't know if warden is checking checksum of some of the most known bots/helpers, but to be on a safe side it is very easy to change it and to have unique executable.

Let's take a example with notepad. You can train with it and if you like the results you can apply it to your bot.
First you need to open a command prompt (Start -> Run, type 'cmd')

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS>copy notepad.exe notepad_test.exe
1 Datei(en) kopiert.

C:\WINDOWS>echo whatever_you_want >> notepad_test.exe

C:\WINDOWS>dir notepad*.exe

23.08.2001 14:00 67.072 NOTEPAD.EXE
14.11.2007 11:54 67.092 notepad_test.exe

start the notepad:
C:\WINDOWS>notepad_test.exe

It works! Good... Now go to your favorite bot, make a safe copy of a file, apply the changes and enjoy in better security. You have a boot that no one else in the world has.

Quick explanation: your executable knows where does it ends and it will never look after this point. You can have lots of garbage after and you can still use the program without any problems. I just put some random chars inside, but you can even paste complete file inside, it is up to you. Command for this would be:


C:\WINDOWS>type NOTEPAD.EXE >> notepad_test.exe

C:\WINDOWS>dir notepad*.exe

23.08.2001 14:00 67.072 NOTEPAD.EXE
14.11.2007 12:02 134.164 notepad_test.exe

It is definitely not the same file, but have the same function.

If you are interested in more details, or need more help just ask, I would be glad to help.

[97036]

Great idea, I'm going to follow this advice for sure, +rep!

edit: just to proove that it works I followed instructions above, did a MD5-file before and checked after, these are the results:

[tttommeke]

Don't really get it ? Ow wait, like changing his name in not see able characters ? I taught you would do something like : edit .exe to .scr but +rep for contribution

[typisklol]

The file you download is like everyone else download. If you copy it, you should get different checksums and other ram adresses.

This is for the paranoid. ^^

[Pilan]

The file you download is like everyone else download. If you copy it, you should get different checksums and other ram adresses.

This is for the paranoid. ^^

No, you will always get the same checksum, because you downloaded the same file as everyone else. OK, date can differ but this is not important. For more informations about the checksums and verifications you can see this link. Addressing the program in RAM doesn't have anything with the method I mentioned.

It is maybe for paranoid, but it is 5 minutes of work for additional security check. It is worth it, in my opinion.

@tttommeke, sorry if I was not precise enough. You don't change the file name, I did it for a test to show the idea. The proper way would be:
- copy your <bot>.exe to backup_<bot>.exe
- make changes to <bot>.exe
- run <bot>.exe as usually

Replace <bot> with the program you are starting.

[Lahtin3n]

Great, thanks. If I were able to +rep you, I sure would. So I hope that the persons that is able to +rep you does so.

Edit: Here comes my first +rep =)

[r00tman]

This command writes "whatever_you_want" in the notepad... omg?

[Pilan]

This command writes "whatever_you_want" in the notepad... omg?

No, it does not. At least you as a C programmer should know what redirection does.
It paste the string (or binary) you want to the end of the executable file.

[larmio69]

yeah, thanks OP for the tips! havent thought it but now I have changed all my bot executables checksums

[larmio69]

This command writes "whatever_you_want" in the notepad... omg?

Quick way to test this is:

1. Open notepad and drag-drop your "bot.exe" to the notepad window (yeah you see gibberish as its the actual binary of the .exe)
2. Scroll in notepad to the very end of this file, you see the last characters there. (may be space characters aswell, no matter that)
3. copy/paste "bot.exe" to "Copy of bot.exe", run command    echo whatever_you_want >> Copy of bot.exe
4. now drag/drop your new modified "Copy of bot.exe" to notepad window and look to the end.
5. wow, your text is in the end of file? Done. :)

[r00tman]

No, it does not. At least you as a C programmer should know what redirection does.
It paste the string (or binary) you want to the end of the executable file.

that is what i mean^^
but okay i like this idea.
(With the "omg" i mean that its not really secure for detectet Hacks / bots and something)

You can use cygwin for a better functionality
you will love it +Rep

[Monx_W0W]

i prefer a ASM for WoW coding..warden seems not bothered by it

[spender]

Note that you can't do this for arbitrary executables. Data overlays (this technique being used) are sometimes used by legitimate programs, including setup executables or packed binaries. Modifying the overlay will corrupt the data, since most will extract the overlay by doing a seek at a known offset from the end of the file.