| View previous topic :: View next topic |
| Author |
Message |
Hieroglyphics I post too much
Reputation: 0
Joined: 06 Dec 2007 Posts: 2007 Location: Your bedroom
|
Posted: Thu Mar 25, 2010 9:55 am Post subject: Bypass a program that detects DLL Injection? |
|
|
How would I bypass a program that detects DLL Injection, because I injected my bot into WonderKing and didn't even start anything on it and it banned me after getting to char selection, because it detected a hack :/ I am using Borland C++ _________________
|
|
| Back to top |
|
 |
Jesper Grandmaster Cheater Supreme
Reputation: 9
Joined: 21 Feb 2007 Posts: 1156
|
Posted: Thu Mar 25, 2010 10:35 am Post subject: |
|
|
| WonderKing uses hackshield am I right? If so then you would need a HackShield bypass or inject before HackShield loads. |
|
| Back to top |
|
 |
Slugsnack Grandmaster Cheater Supreme
Reputation: 71
Joined: 24 Jan 2007 Posts: 1857
|
Posted: Thu Mar 25, 2010 12:25 pm Post subject: |
|
|
you'd have to find out how it's detecting the injection then target that. for example if it's enumerating loaded modules you could hook the functions used for walking module lists, etc.
realistically that particular method is not used very much though |
|
| Back to top |
|
 |
Hieroglyphics I post too much
Reputation: 0
Joined: 06 Dec 2007 Posts: 2007 Location: Your bedroom
|
Posted: Thu Mar 25, 2010 5:52 pm Post subject: |
|
|
I think the HS is completely gone in WK now, except the game itself detects if a hack is running and it bans you before you can even get in game :/ _________________
|
|
| Back to top |
|
 |
Flyte Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006 Posts: 1887 Location: Canada
|
Posted: Thu Mar 25, 2010 7:13 pm Post subject: |
|
|
Manually load the DLL into the target process by mapping the file into your own and constructing the sections while fixing all of the static entries as per the .reloc section. This way you completely bypass the windows loader, and the only residue left in the target process is the allocated memory in which the code resides (which is a weakness you can get around with some clever positioning, or a root kit that fucks with the virtual memory space by hooking the page fault handler).
A few years back I used the same method to load an executable into another process (though the executable had to be specially compiled to include a .reloc section). |
|
| Back to top |
|
 |
|