Cheat Engine

marius89 · How do I cheat? Reputation: 0 Joined: 13 Jul 2011 Posts: 3

Hi everyone, could you help me out with some answer?
The question is like the thread subject.. how can be blocked the dll injection?
Sorry for my bad english .. i hope u will help me, i saw a tutorial for a dll injection program but i want a dll injection blocker.Thanx in advance.

NoMercy · Posted: Wed Jul 13, 2011 3:06 pm Post subject:

Not sure, but I guess you can hook DllMain().

AhMunRa · Posted: Wed Jul 13, 2011 3:29 pm Post subject:

http://social.msdn.microsoft.com/Forums/en-US/vclanguage/thread/0323aaaa-b234-4b31-b5b9-2fba7255d1f1/

Suggests that blocking isn't possible.

marius89 · How do I cheat? Reputation: 0 Joined: 13 Jul 2011 Posts: 3

AhMunRa · Posted: Thu Jul 14, 2011 9:26 am Post subject:

Upon rereading the previous thread I posted from MSDN forums, you could use a Notification Hook to watch for an injected dll then have your application handle it accordingly. Though I doubt this method would distinguish between a good dll and a malicious one.

http://msdn.microsoft.com/en-us/library/z9h1h6ty%28VS.80%29.aspx

http://www.gamer z needz.net/forums/legacy-delphi-other-languages/110502-anti-dll-injection.html *EDIT STUPID AUTO CORRECT remove the spaces link should work.

First post in this thread includes source code, for blocking dll injection, but poster also states you can bypass this by through WriteProcessMemory()

Slugsnack · Posted: Thu Jul 14, 2011 9:57 am Post subject:

There isn't a way you can block it if the attacker is trying hard enough. A simple thing is to just hook LoadLibrary in your own process. This will prevent generic injectors but is easy to subvert. It really depends what your requirement is.

atom0s · Posted: Thu Jul 14, 2011 10:39 am Post subject:

Most anti-cheats wont load if your firewall blocks them because they cannot obtain update information. They are designed to not work unless they are able to validate they are running the latest version of the anti-cheat software to prevent users from just blocking updates. (People did this with GameGuard til they caught on.)

Like Slug mentioned, you wont do much in terms of blocking a user from injection as they will get around your blocks. Even more so, doing anything from usermode is easily undone.

If you are going to attempt to block injection in any serious manner you will want to do things from the kernel rather than from usermode.

From usermode you can do some basics such as:
- Block LoadLibrary calls that are not whitelisted.
- Block CreateThread/CreateRemoteThread calls that are not valid for your process.
- Block memory alterations; use hashes/checksums on memory locations to prevent edits.
- Block obtaining a handle to your process.

As said though all of these are easily bypassed if done in usermode since people can just rehook what you hook and skip your checks entirely.

marius89 · How do I cheat? Reputation: 0 Joined: 13 Jul 2011 Posts: 3

Thanx for replies, u all helped me alot ..
Wiccan, most anti -cheats it using CreateThread/CreateRemoteThread calls metod.For me as far this i think will be enought.But i have to learn making this program, some examples if u wanna post not really the exact code, as i know nobody give's the source code for what he want.Just a few examples if u know somewhere to look at it, so i will understand how to make this.Thanx again for answers.I'm glad to be here, nice people u are.