Cheat Engine

[Krähne]

[Dark Byte]

If you go use a driver like that then why even bother with a usermode dll?
A driver is present in every processes taskspace, which means that you just have to make sure the context your thread is executed in belongs to the target process and do all the edits in there (example of this is the CETC project which is a kernelmode memory scanner with a network interface for control)

[Krähne]

[Dark Byte]

You just use the kernelmode KeAttachProcess, or just change the CR3 register to the value of the target process. (or even just map the physical memory of the target process to a local virtual address)

From there you can read and edit all the memory without anything blocking you, or even able to block you (Virtualpagedir plugin in the plugin section for example makes use of mapping the physical memory of the target process based on the physical address stored in Cr3 of the target)

but yeah, if you don't know the difference between CR3 and CR0 then usermode is the easiest option for now

[Krähne]

[Innovation]

[Jorg hi]

..What if someone creates a way to automatically change everything inside the program to allow it to be undetected?

[Krähne]

[Slugsnack]

[Freiza]

If I create GUI in C#/WPF and implement core functionality in C++ then is it a good idea or still it can be easily detected?

[Dark Byte]

The anti cheats will just look for your gui
Search for a window with specific object classes and names, or even just their relative position between eachother (e.g ce's gui has 2 buttons next to eachother and an image in the top-right with a flat button right under it. Quite specific and can be scanned for)

Really, getting access to the process's memory is easy, it's just that hiding your gui is a little more troublesome as you need to manually adjust that every time it's detected (and just randomizing the position and widths of all objects would make a really bad interface for the user)

Anyhow, look up the cetc project, it's a gui-less memory scanner. Only visible thing is the network interface that is used to communicate with it from another system

Of course, if you never give out your undetected program you should be fine

[iPromise]

I'm actually almost done my own "Cheat Engine" in C++. I'm adding the dissassembler now and it will be complete.

@Wiccan You can quickly inject your DLL before the anti-cheat initializes.

[Slugsnack]

yes, you can inject before anti-cheat initialises but some of them will check for presence of unknown dll at runtime

[iPromise]

you're right and I took my gamble on it, but what about the friendly dll's that some external hardwares (keyboards, mouses) and programs that need to inject their dll's globally into every process?

i think the anti cheat engines havn't checked for the precense of unknown dll's because it could lead to an unstable computer/game for the user

and a question, cant you just add on your code to a dll from the games directory bypass the check for any corrupt dlls by the anti-cheat engine. its what we use to do for gunbound we replaced Buddy2.dll, the friend chatting didn't work but your code was injected, and in this case, loaded.

[Slugsnack]

depends how far the protection goes. some of them do integrity checks such as crc32 with the dlls. in regards to globally injected dlls, some protections freak out but often they have a whitelist for these. if your dll injects (with that method), you got lucky because their checks are not as extensive