Cheat Engine

[marcussacana]

I have created a process with the CREATE_SUSPENDED,
And I want inject a DLL as soon possible, to this I want suspend
the process in the EntryPoint, And to this I want edit the Main module
data to put a int3 or a infinite loop.
To do this I need know before where is the Main Module Entry Point,
How I can do this? Since the EnumProcessModulesEx don't works on a suspended process

[Dark Byte]

you need to let the process run until the main module has been loaded in the target (check out windows debugging and module load notification for the debugger)

[marcussacana]

So basically, I need create a 'small debugger' and wait by the LOAD_DLL_DEBUG_EVENT?

just a question, the LOAD_DLL_DEBUG_EVENT is triggered before or after the dll is loaded?

[Dark Byte]

after the dll is loaded but before the entrypoint runs (i think)

[marcussacana]

Worked Thank you!