Cheat Engine

mStorm · Last edited by mStorm on Tue Jul 21, 2009 12:00 pm; edited 1 time in total

is using thlp32 and cycling through the modules the fastest way to find the base of a dll?

or is there another way that is much more simple?

(non injected).

*Solved: I just used looping through modules until I get the right name (using thlp32)

Slugsnack · Posted: Sun Jul 19, 2009 5:08 am Post subject:

that's the best way that i'm aware of

here's a short source for it :
http://wj32.wordpress.com/2009/03/14/howto-get-the-command-line-of-a-process-in-unicode-or-ansi/

Guy · Posted: Sun Jul 19, 2009 10:14 am Post subject:

That's the quickest way I know of as well; I made a sample using it to blacklist modules by name and entrypoint (Terrible, terrible idea; it was a piece of code I wrote intended for users to create hashes of the actual module, and check the names of modules that shouldn't change).

Regardless, here ya' go if you're interested: http://majii.wordpress.com/2009/07/17/whitelist-module-sample-quick-update/

mStorm · Posted: Mon Jul 20, 2009 5:17 am Post subject:

Yea, i've put it to use. I was thinking there was a quicker way, but that is pretty quick.

BanMe · Posted: Mon Jul 20, 2009 5:18 pm Post subject:

Of course there are "quicker" ways and definitly ways less intrusive..
but they are not "kosher"..but im guessing that CreateToolHelp32SnapShot Internals havent changed..(from XP to 7) and prolly wont. So open up kernel32 and analyze the functions to find the internals involved..also RtlQueryProcessDebugInformation works ..but for those fuckers that cry its "undocumented" they can shove it and there own heads up there ass..

there are others but I wont go over to them Wink

http://www.woodmann.com/forum/showthread.php?t=12883

regards BanMe

Guy · Posted: Mon Jul 20, 2009 5:22 pm Post subject:

BanMe · Posted: Mon Jul 20, 2009 5:28 pm Post subject:

they havent changed...look at them..
microsoft fucking lies through there teeth!

so lets go over why they wont change.. First the have to Modify Kernel32's
CreateToolHelp32SnapShot and Module/Thread/Process(32)/First and Next... thats a task in a of itself.. next they have to modify the Kernel to add another function that "attaches" to a process and queries info..they got enough of them..thirdly they have to also modify ntdll and add a new Syscall.. counting all this I highly doubt they will change..but yea, to each there own Wink

also my "subsystem" Sin32 that im developing uses all these "undocumented" API's on 2k XP and (with slight) modifications) on Vista.. so hmm..they really changed "alot"..

regards BanMe

DoomsDay · Posted: Mon Jul 20, 2009 5:32 pm Post subject:

^^^ On that subject, did you notice a difference in the PEB sturcutre?

BanMe · Posted: Mon Jul 20, 2009 5:37 pm Post subject:

yes and I rewrote my Peb Dll Finder to function on everything from Nt ~ vista.. that was soooo hard.. lol

regards BanMe

Guy · Posted: Mon Jul 20, 2009 6:41 pm Post subject:

Slugsnack · Posted: Tue Jul 21, 2009 3:47 am Post subject:

another reason not to use undocumented APIs. just the fact.. they ARE undocumented and often if they're not then they are documented poorly. admittedly there are places where more information on them can be found but for me it's not the effort compared to the convenience of msdn library

DoomsDay · Posted: Tue Jul 21, 2009 6:48 am Post subject:

Still, you must admit that using that would be faster (assuming that you made sure you're running on Windows XP SP3 ) Smile

Slugsnack · Posted: Tue Jul 21, 2009 7:56 am Post subject:

yes.. but if you are gonna do little things like that then why not unroll all your loops to make it faster but bigger and there is a lot more things you can do. you could detect system and then write a separate code for each one. sometimes you have to compromise though. but i guess something small like this is personal preference

DoomsDay · Posted: Tue Jul 21, 2009 8:28 am Post subject:

Unrolling won't do well in this case (branch prediction - wise) Razz

Anyways, as you said - its all about personal preferences ^^
If anyone is interested, you might find this useful.