Leaderboard

Thank you very much for the quick response and your hard work ^^ Runs like a charm now

It works wit Steam version, thanks!

Thanks, looks like a single hex pattern was different between the exe files (I adjusted the pattern so it's the same for both exes), the dlls both have the same patterns, so those are fine. Try the new version I uploaded, I think it might work this time.

Sure! Here they are: Space Haste 2.zip

It's fixed! Thanks a lot!

This should be fixed now.

Thanks, works perfectly!

Hey, sorry for the mistake I made, it was on my side. Try the new version, should work fine now.

Hey, can you try the new version I uploaded?

The latest patch only supports 1.8 version of the game without hotfix, wait for the patch update.

I have everything working now! 👍 Holy man! So nice to replay one of my favorite childhood games. Much respect! 💎🏆🥇

Thank you very much for the file. I know the post is old and probably no one will see the comment, but anyway, this was the version I needed to play Resident Evil 1 Classic Rebirth with Seamless HD Project, which was causing graphical glitches in the new 2024 versions of DgVoodoo2 when using antialiasing and anisotropic filters. I couldn’t find this version anywhere, as the official site has broken links for the old versions. I followed the tip I saw in the comments on D’Flayer’s YouTube channel when I saw him using ReShade with dgVoodoo in HD texture mode.

Feel free to create a program that attempts to establish an encrypted connection using TLS 1.1 that _doesn't_ trigger that same MITRE detection. If you are able to, then that MITRE detection needs to be improved since clearly it's not working as intended and not detecting your use of TLS 1.1. Or, most likely, you're not actually using TLS 1.1 and instead use TLS 1.2 or 1.3 which the scanner wouldn't, you know, "detect" since there's nothing "to detect." It's that simple.

As someone who actually worked as a security analysts, and a programmer. as well as have performed almost daily investigation on executables, both of my own creation as well as those of others, this looks like a normal false positive. Though as always we at PCGamingWiki does not make any guarantees whatsoever, so anyone is still downloading at their own risk. Anyway, regardless though, the use of a techniques defined or detected by MITRE does not really need to mean anything. This is even clear in the link itself by checking the actual details of the calls: https://www.hybrid-analysis.com/sample/33480dbf71388eedae4383629155ac4cee70098a37c3054bff31a7ecaa7d65ab/654a9e80c44a7cedf30a92af > "Calls an API typically used for keylogging" has the details ""Kane.and.Lynch.Ultrawide.Fix.exe" called "GetKeyState" with parameters {"nVirtKey": "16"}" What this means is that _something_ that got executed as part of the process (either the process itself or an OS component that was executed as part of it) queried the state of the Shift key. The related details indicates the key state for Ctrl, Shift, Alt, and WinKey Left + Right was checked. This does not mean its a keylooger -- it just means the patcher tool itself, or an OS component that it invoked, checked whether any of those keys were held down. That's all. Going through the other "suspicious" calls it makes shows that it tries to find and check details for a process called "kaneandlynch.exe" -- meaning it basically tries to identify if the game is currently running or not (since it can't be running if it's going to patch it). And again, let me reinstate that ALL code that gets executed as part of the process within the sandbox gets logged as being caused by the specific process and code, regardless of whether it's actually caused by the OS itself or the code the executable contains. Misunderstanding the data is how we get ridiculous Reddit threads like the "Epic Games Store scans all of the certificates on your system!!!!" scaremongering, when in reality that's required for a normal TLS encrypted connection to be made to establish trust with the opposite end (meaning any and all HTTPS connections made on your system does literally the same). > Contains ability to terminate a process (API string) > Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004588.00000001.69110.00401000.00000040.mdmp, 00000000-00004588.00000002.71033.00401000.00000040.mdmp") Oh my, a patcher tool that requires the game to not be running, and checks for the presence of the game running, also includes the ability to terminate that process... Color me surprised. Then we have the absolute ridiculousness that is this sort of "detection": > Uses 32 bit executable PE > "Kane.and.Lynch.Ultrawide.Fix.exe" has flags like IMAGE_FILE_32BIT_MACHINE / IMAGE_FILE_EXECUTABLE It's a "detection" that indicates that the tool is a 32-bit application. That's all this "detection" means. What we end up with is an executable that: - Machine learning detections (which are extremely prone to false positives) identified it as a "grayware" with a 90% confidence. This is not surprising, since it's a binary patcher for another executable. Those are typically used for licensing/crack reasons, and so is a frequent target for security tools to ensure corporations don't commit any unwanted licensing violations (which would've otherwise turned up during an audit and may cost hundreds of thousands in a penalty fee). - Makes encrypted HTTPS connection(s) using the now obsolete TLS 1.1 version... Which also isn't all that surprising as the patcher was created using the CodeFusion Wizard, a tool that harkens back to the 90s and Windows 9x/NT. TLS 1.1 defined in 2006, and only deprecated in 2020. So this doesn't actually mean anything. And again, it's not even guaranteed that the tool made the connection -- it might as well be the OS environment as it performed a compatibility check or whatever as the process was launched. And these are the only two "malicious" indicator. One indicates the unsurprising use of a now obsolete encryption protocol, and the other that the executable may be "grayware" and as such unwanted in enterprise environments. The remaining "suspicious" indicators are equally generally unimportant, with either minor notes (the modifier key states) or a couple of unique sections in the executable that doesn't by themselves mean anything nefarious is going on. Ergo, it's almost certainly a false positive. Also, this is why PC gaming modding is slowly but steadily dying off -- the whole act of modifying a separate executable, process, or such is something that piracy/licensing violations also rely on, and so are prime targets for security enterprises that are interested in selling their services to corporations interested in ensuring their employees don't do anything nefarious which can harm the company in any way. What we end up with are constant false positives everywhere, and the 6 (now 9) detections this had on VirusTotal is in reality quite few. Like just try and use CheatEngine for a game trainer, and you end up with 25-30+ "malware" detections all because a tool created to manipulate memory of other processes (to enable cheating) can also be utilized for nefarious reasons (to enable license violations or piracy).