# amlegit

reverse engineering of amlegit/xcheats.cc 

## overview

amlegit.com/xcheats.cc sell the same cheat. As of 2/15/2020 the cheat has been released as "free" whilst selling almost the same pasted software. In short the loader works as so:

<img src="https://git.hacks.ltd/xerox/amlegit/raw/master/images/amlegit_diagram.png"/>

The internal DLL is anything but undetected. Memory is not hidden, many imports, threads, directly hooking present function....

<img src="https://git.hacks.ltd/xerox/amlegit/raw/master/images/lapex_imports.png"/>

The spoofer is clearly pasted:

<img src="https://git.hacks.ltd/xerox/amlegit/raw/master/images/spoofer_paste.png"/>

<img src="https://git.hacks.ltd/xerox/amlegit/raw/master/images/nsiproxy_paste.PNG"/>