Cheat Engine

[ulysse31]

Modules :
I am enumerating target Process modules by :
EnumProcessModulesEx
GetModuleFileNameEx
GetModuleInformation

I am wondering if Createtoolhelp32snapshot with TH32CS_SNAPMODULE parameter and targetprocess ID will always give the same results or is one method more reliable than the other ?

Threads :
I enumerate them by calling Createtoolhelp32snapshot with TH32CS_SNAPTHREAD and then I match results with target PID.
I reckon there is a hidden thread option in ollydbg and I am wondering if some threads could be hidden from my enumerating function ?

[atom0s]

Ultimately they should yield the same information as they both land up calling NtQuerySystemInformation. But the middle-man calls between the root API and getting there could be hooked or altered to fake the results etc.

As for the thread question, threads can be hidden from enumerations via 'NtSetInformationThread' using the 'ThreadHideFromDebugger' value (aka 0x17). This will hide the thread from being visible to debuggers directly.

[ulysse31]

Thank you very much