T3KTONIT
Well-known member
- Joined
- Sep 2, 2013
- Messages
- 308
- Reaction score
- 5
wtf i expect an anti-cheat to at least have a false positive... the exe is completely fud 0/52 in virustotal fuck that i ain't running that shit...
unless you're trying to rat us... i don't see any reason to crypt an ac.
give the original link to the ac not the one uploaded by KhalidAhmedShalabi...
unless you're trying to rat us... i don't see any reason to crypt an ac.
give the original link to the ac not the one uploaded by KhalidAhmedShalabi...
- Joined
- Feb 18, 2013
- Messages
- 1,123
- Reaction score
- 174
T3KTONIT said:
Well, it can be crypted and FUD as you can attach taggant signatures and contact av manufactures to get your executable whitelisted.
+ The executable here linked is only a installer stub therefore it isn't really crypted - just packed.
The .asi inside is protected with "http://www.enigmaprotector.com/"
Means that some "important" functions inside of it may be virtualized.
I manged to reconstruct sam of the api imports and he seems to use the default CreateToolhelp32Snapshot, EnumProcesses and so on procedures. So bypassing it may be possible w/ an internal module (dunno how engima handles api hooks). But emulating the client would be easier I think >.> just my 5 cents.
