Cheat Engine

bhpianist · Cheater Reputation: 1 Joined: 17 Apr 2010 Posts: 38

My quick search told me I have the following options:

(1) Write a driver which hooks NtCreateSection()
I don't want to write a driver, it's too messy for the simple thing that I want to accomplish.

(2) Use the AppInit_DLLs registry value
I don't want to use this method, it's kind of lame..

(3) Use EnumProcesses() in a loop and detect new & destroyed processes
I refuse to believe that this the most efficient way for this problem, and I'm always scared of hogging resources.

Anyone know a good method?

Dark Byte · Posted: Tue Jun 01, 2010 6:46 pm Post subject:

only good and 'official' method is 1, but don't hook NtCreateSection, Just call PsSetCreateProcessNotifyRoutine

alternatively, perhaps you could do something with WMI ( http://msdn.microsoft.com/en-us/library/aa390425%28VS.85%29.aspx )

bhpianist · Cheater Reputation: 1 Joined: 17 Apr 2010 Posts: 38

Drivers are too messy though.. there isn't another way to run a system-wide hook?

WMI is messy too...

tombana · Posted: Thu Jun 03, 2010 2:14 am Post subject:

You could use SetWindowsHookEx to inject a dll into every process. The dll could report back to the main application to notify when it has been injected into a new process. However this will not be at the point the process is created but only once it is completely loaded (and running) I think.

bhpianist · Cheater Reputation: 1 Joined: 17 Apr 2010 Posts: 38

tombana · Posted: Sat Jun 05, 2010 5:29 am Post subject:

Dark Byte · Posted: Sat Jun 05, 2010 5:49 am Post subject:

Note that it won't load into processes that have no gui