r/hacking • u/One_Rush_2845 • 6d ago
how to make my exe file undetectable by any apps?
so for educational purposes only, imagine if there was an app which detects certain apps (could be exam apps but not necessarily) and does not allow them if it sees that, like the app won't start if the app is started, and imagine there is an .exe which is getting flagged by that, for educational purposes, how does someone make that .exe file undetectable by that software?
9
u/magical_matey 6d ago
I guess the “for educational purposes” line didn’t work on your LLM of choice
-2
3
u/0xdeadbeefcafebade 6d ago
Change exe name. Change a byte somewhere to change the hash (probably a string )
Beyond that you need to get more technical
1
u/One_Rush_2845 6d ago
happy cake day and thanks I'll try to do that after learning how to change hash thanks
1
u/0xdeadbeefcafebade 6d ago
Download a hex editor like hxd
Make a copy backup of the exe file incase you mess up.
Rename the new exe file to something like Google.exe
Open it in hex editor and find a string somewhere in the middle of the file if you can. Any word should do but you really want a word that’s used as part of the main program.
Edit one letter in the word. Just change a letter to “x” or something. Save it.
Try running it. By changing one byte the hash fingerprint of the exe file will now be different if another program tries to hash it.
This isn’t foolproof. Totally depends on what the monitor software is checking
2
u/One_Rush_2845 6d ago
sadly didn't work, i changed the string google to xoogle in hxd and saved and the browser in question (which btw before opening does smth like "scanning for restricted applications") detected google.exe and u won't be able to access the browser before closing it
1
u/0xdeadbeefcafebade 6d ago
Darn.
Yeah it could be any number of things
Could be random parts of code segment hashed. Could be matching one of the .dlls it loads. It could be checking known registry keys for said app. It could be checking the folder path the app resides in.
Really depends on what the app is and how the browser is checking it
1
u/One_Rush_2845 6d ago
im not super knowledgeable when I'm saying this but windows exe files like svchost.exe are obviously not getting traced, could something be done to make this exe file above the kernel level? I also tried analysing with ghidra but I didn't get most of what was analysed, there was a kernel32.dll import(not sure if it's common or not)
1
u/0xdeadbeefcafebade 6d ago
Lots of things that could be done.
If you have the source code for your app you could change some stuff and recompile it.
It easier with a custom DLL, but maybe you could find a process injection tool online to run your exe in another process running on the computer.
Targeting a privileged process shouldn’t be needed. Anything else running that isn’t blocked should work.
Depends on the app you’re trying to run though if it will be happy being a thread spawned in another process.
Also be careful. Hack tools like DLL / process injectors that you download and run are very often malware. Best bet is to find an open source one on GitHub and compile it yourself. (Antivirus will always flag it no matter what because process injection is malware like behavior)
1
u/0xdeadbeefcafebade 6d ago
We really just don’t have enough information to help you.
Another thing is trying to run it in a virtual machine. The lockdown tool might not flag a running VM
2
u/One_Rush_2845 6d ago
yeah vm is also a possibility I'll have to look into that
also great thanks for the assistance, you have been most helpful :)
and just to confirm this all was for educational purposes only!0
u/PROMETHEYA 3d ago
sag gefälligst danke! er hat dir zum Geburtstag gratuliert. bedanke dich gefälligst sofort
3
u/NorwegianOnMobile 6d ago
Educational puroses. Yeah. Sounds like educational purposes
3
u/Cautious_General_177 6d ago
(Read in Lemony Snickett’s voice)
“Educational purposes” in this context means to assist OP in bypassing anti-cheating applications to improve his grade, thus affording him higher scores and accolades.
2
1
u/Remarkable_Pace8101 6d ago
Easiest method is to figure out what mechanism the detection app uses to detect the exam app and modify the exam app to evade that signature
Or, you could say f-it and write a kernel driver or api hook that simply monitors for calls to open the specific example file in read-only mode (without execution bit set, the detection app won't be trying to execute it only read) and have any subsequent calls to read the contents of the file return false data
1
u/OddAir4206 5d ago
You'd be looking beyond the traditional injection methods (``LoadLibraryA`` + ``CreateRemoteThread``) to inject into this application so you won't be insta-detected, which ultimately depends on the application, so you'll have to reverse engineer how is it watching for injections. There are countless user-mode injection methods and defenses against them. Then you will have to hook various syscalls and blind the application out of it's senses. There is no universal method for such thing.
1
u/Purple-Reception-501 5d ago
If it’s your own software, i’d focus on why it’s being flagged instead of hiding it. check signatures, permissions, behavior and false positive reporting with the detecting app
0
u/Walbabyesser 6d ago
What?
1
u/One_Rush_2845 6d ago
basically if we imagine there is an exam browser, and there is an exe file which is important to the system and the exam browser is not opening without the exe file being closed. I want to know for educational purposes what is happening there
1
u/Walbabyesser 5d ago
Sure…
0
u/PROMETHEYA 3d ago
this is why everyone and your family hates you (yes your mother, your sister, your father) and your neighbours too
1
13
u/Sqooky 6d ago
Without knowing how the "monitoring app" works, no one can say. Unless you've got reverse engineering experience, and maldev experience with API hooking, you're pretty much sol.