- Oct 28, 2021
- 87
- 182
Just tried to play, and my PC immediately cried "VIRUS" and quarantined two Viruses.
There were no viruses in my crack, the crack was actually very simple: the RPG Maker archive that was extracted from the protected exe, this archive does not contain executable code that would flag any antivirus and the game.exe which is the default RPG Maker engine the game used, the file was not packed or modified and it's identical to the file used by many games. That would leave either start.exe which is part of the DRM, but is not used at all, and maybe the original game exe if it was included, which is also part of the DRM. The protection used PlayDRM is actually Enigma Protector, which is a full fledged protector, virtualizer/obfuscator, and those are popular with malware authors. If it was just the start.exe and a backup of the game exe then deleting those files won't prevent game play at all (the game does not use them). Feel free to let me know which of the files it was, I will redownload OP's upload to check as well.
Edit: I looked at the mediafire upload, there's just 1 exe, Game.exe which is the original RPG Maker exe that is used with all those RPG Maker games. I have no idea what else it would be?
Edit 2: Seems it was just the unmodified game exe. Jotti reported 4 positive detections out of 13 total tried. That's a bit high, but really strange given that the file is as clean as possible. Open it in IDA Pro or any disassembler you want, you'll see statically linked C runtime (MSVC), and a handful of very tiny functions that do nothing but load the RPG maker dll and its exports...
Edit 3: I found the cause. It seems when I dumped the exe out of RPG Maker, I had opened it in a PE editor, which corrected its SizeOfImage field (that's just 2 bytes. old value is 0x27000, new is 0x26AA8), this does not change the functionality in any way, but it changes the file hash, which some antivirus might be relying on to whitelist it. This is the scan
You must be registered to see the links
of the 0x27000 one, the 0x26AA8 gets 4 detections.I've attached 0x27000 version if anyone wants it, you can compare in any hex editor that it's just 2 changed bytes as well.
Last edited: