AMD/ATI Pixel Clock Patcher

[Trendle]

(11-09-2019 04:03 PM)ToastyX Wrote:  

(11-09-2019 03:09 PM)Trendle Wrote:  Okay, thanks. I "need" a GPU upgrade anyway, so I guess I'll go with that. It's a shame that good video cards are so expensive these days. Oh well.

If it's listening to the range limits and won't let you override it, then a new video card won't help either unless you go NVIDIA. Do you know if the monitor can even handle a pixel clock greater than 600 MHz?

No idea, no. But it doesn't matter because at that pixel clock I get frame skipping. I thought I didn't, but turns out my testing methodology was incorrect.

[ToastyX]

(11-09-2019 06:21 PM)tomppamo Wrote:  When I try make custom resolution with Radeon Settings I get "The custom resolution settings are not compatible with this display..." even though driver is patched.
If I use CRU to make the custom resolution it's not showing up in windows. This happens when I try to set pixel clock over 165000 khz.
Im using hdmi to dvi cable for my monitor.

What video card and monitor?

[tomppamo]

(11-10-2019 12:41 AM)ToastyX Wrote:  

(11-09-2019 06:21 PM)tomppamo Wrote:  When I try make custom resolution with Radeon Settings I get "The custom resolution settings are not compatible with this display..." even though driver is patched.
If I use CRU to make the custom resolution it's not showing up in windows. This happens when I try to set pixel clock over 165000 khz.
Im using hdmi to dvi cable for my monitor.

What video card and monitor?

Powercolor RX 5700 XT Red Devil

Benq G2420HDB

[board-temp]

Hello, registered this account to post here because after installing atikmdag-patcher.exe on my system i was infected with a trojan.

it creates a task scheduler job that triggers a javascript file on user logon, which transfers data from and to pastebin periodically, and also tries to run a C2 channel to a russian IP 178.140.134.36 on port 4322. my palo alto firewall detected and blocked it as "RevengeRat Command and Control Traffic".

i sent the atikmdag-patcher.exe to joes sandbox and got everything confirmed:
http://joesandbox.com/analysis/188753/0/html
so if you don't believe me, this analysis report should change your mind.


if the file was infected on my system by some other means then sorry, but i thought i better warn users here of the potential infection.
(edit: i redownloaded the file from page 1 of this thread on 2019-11-10 14:45 GMT and it still detects as malicious)
(edi2: i downloaded the exe fresh from sourceforge on 2019-11-10 15_25 and it also detects as malicious. will report there too)

check your system for the following modifications:
Autostart Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run C:\Users\user\Desktop\atikmdag-patcher.exe C:\Users\user\Desktop\atikmdag-patcher.exe /exenoupdates /forcecleanup /prereqs "0"
Task Scheduler Run new task: Network path: C:\Program Files (x86)\Common Files\driver.js

if you're infected, you also have a powershell.exe running connecting periodically to the ip i mentioned above. this is the c2 channel.
cheers.

[ToastyX]

(11-10-2019 01:49 PM)board-temp Wrote:  Hello, registered this account to post here because after installing atikmdag-patcher.exe on my system i was infected with a trojan.

it creates a task scheduler job that triggers a javascript file on user logon, which transfers data from and to pastebin periodically, and also tries to run a C2 channel to a russian IP 178.140.134.36 on port 4322. my palo alto firewall detected and blocked it as "RevengeRat Command and Control Traffic".

i sent the atikmdag-patcher.exe to joes sandbox and got everything confirmed:
http://joesandbox.com/analysis/188753/0/html
so if you don't believe me, this analysis report should change your mind.


if the file was infected on my system by some other means then sorry, but i thought i better warn users here of the potential infection.
(edit: i redownloaded the file from page 1 of this thread on 2019-11-10 14:45 GMT and it still detects as malicious)
(edi2: i downloaded the exe fresh from sourceforge on 2019-11-10 15_25 and it also detects as malicious. will report there too)

The file you uploaded to Joe Sandbox is not the same file linked in the first post. The file on SourceForge is not my file. Do not download this program from other sites.

The atikmdag-patcher.exe file is supposed to be 95744 bytes (MD5: d61992cbdda1a789a9d5f597fd0de125). The file you linked to is 6 MB. I verified that the file in the first post is still the correct file and is not infected.

[board-temp]

Hello,
i uploaded the 95k sized file (md5: d61992cbdda1a789a9d5f597fd0de125): it is malicious!

https://www.joesandbox.com/analysis/188887/0/html

timestamp: 11.11.2019 - 14:03:54
File size: 95744
MD5: d61992cbdda1a789a9d5f597fd0de125

what is happening? how did you verify on your end that this is not malicious? can you post a scan result link please?

[ToastyX]

(11-11-2019 01:12 PM)board-temp Wrote:  Hello,
i uploaded the 95k sized file (md5: d61992cbdda1a789a9d5f597fd0de125): it is malicious!

https://www.joesandbox.com/analysis/188887/0/html

timestamp: 11.11.2019 - 14:03:54
File size: 95744
MD5: d61992cbdda1a789a9d5f597fd0de125

what is happening? how did you verify on your end that this is not malicious? can you post a scan result link please?

I wrote the software, and the source code is available for download. I verified that the file in the first post is still the same file that I produced and was not tampered with.

Look at the analysis reports that you linked for the two files. They are nothing alike. The first file you linked is definitely a trojan. It bundles my software and installs malware. My file doesn't do any of the things you described, and you can verify this yourself.

The "malicious" detection for my file is bogus. What exactly is malicious about it? It doesn't bundle any software, doesn't make any network connections, and doesn't add any startup items, so how can it be malicious?

"Detects as malicious" is not the same as "infected with a trojan." Malware scanners that try to be "smart" by using heuristics and machine learning often detect random files as malicious when they're not.

By the way, I tried to join Joe Sandbox, but they rejected my registration and deleted my account. I hate services like this that incorrectly detect files as malicious and then make it difficult to report false positives.

[ToastyX]

(11-10-2019 12:33 PM)tomppamo Wrote:  Powercolor RX 5700 XT Red Devil

Benq G2420HDB

Strange, I'm not seeing any new 165 MHz limits. The "HDMI-DVI limit" is supposed to take care of your situation. Try importing the hdmi.dat file using CRU and see if that makes a difference.

[tomppamo]

(11-11-2019 03:48 PM)ToastyX Wrote:  

(11-10-2019 12:33 PM)tomppamo Wrote:  Powercolor RX 5700 XT Red Devil

Benq G2420HDB

Strange, I'm not seeing any new 165 MHz limits. The "HDMI-DVI limit" is supposed to take care of your situation. Try importing the hdmi.dat file using CRU and see if that makes a difference.

Tried to import that .dat file but no difference.

I previously had GTX 970 and got 77hz refresh rate easily with this same monitor and setup.
Now with RX 5700 XT all I get with heavily butchered timing parameters 75.600hz.

[kuri0]

Can you add support for removing the EDP/LVDS pixel clock limits. My laptop uses an ANX3110 EDP->LVDS internally and a LVDS monitor and the maximum pixel clock I can use without the resolution disappearing is 161.99mhz