[Discuss] Not hooks but still being detected

[imnotsorry]

Hello everyone.
I'm new to hacks but not to programming.
I'm trying to make myself a hack but so far no luck.

I've coded this injector that maps my dll in CA memory and start a remote thread in it's entry point.
The dll in question just creates another thread that sends some messages to my app for debugging. NO HOOKING yet.
The simple presence of my injected code makes CA close after a few minutes

What I'm missing?

Thanks.

[Little]

the module may be getting detected?

[xCyniu]

Originally Posted by imnotsorry

Hello everyone.
I'm new to hacks but not to programming.
I'm trying to make myself a hack but so far no luck.

I've coded this injector that maps my dll in CA memory and start a remote thread in it's entry point.
The dll in question just creates another thread that sends some messages to my app for debugging. NO HOOKING yet.
The simple presence of my injected code makes CA close after a few minutes

What I'm missing?

Thanks.

Probably hs detecting something on your dll , and making your game to crash .

You should pack your dll with upx , mpress , aspack , these 3 packers worked fine for me , just use one of them.

Greets , xC.

[imnotsorry]

I changed some bits of the dll and now game runs fine, but I couldn't identify the exact reason.

Now the good stuff! What's the recommended hooking method?

[donoob]

Now the good stuff! What's the recommended hooking method?

Find something into Engine.exe than is always called and do your stuff.
Personally, I finded my own way of hooking into CShell.dll by finding a function than is called everyframe.

Good luck.

[imnotsorry]

Originally Posted by donoob

Find something into Engine.exe than is always called and do your stuff.
Personally, I finded my own way of hooking into CShell.dll by finding a function than is called everyframe.

Good luck.

Trying to hook directx is a deadend then?

[zoomgod]

Originally Posted by imnotsorry

Trying to hook directx is a deadend then?

If you hook a game function that's called once per scene and it gets called between BeginScene and EndScene you can render just fine from there. You just have to get the device pointer yourself form the game. Of course if you use your own rendering objects you'll need to handle device resets somehow.

[donoob]

If you hook a game function that's called once per scene and it gets called between BeginScene and EndScene you can render just fine from there. You just have to get the device pointer yourself form the game. Of course if you use your own rendering objects you'll need to handle device resets somehow.

Yeah, you right. There is engine font than do his work
Anyway, for who need, that's my actual sigscan for device pointer.

    dwDevicePointer = Tools.FindPattern(Engine, (DWORD)Engine,(PBYTE)"\xA1\x00\x00\x00\x00\x85\xC0\x74\x00\x8B\x00\x8B\x08\x8B\x51\x00\x50", "x????xxx?x?xxxx?x", 1, true);

[imnotsorry]

Well, it's me again, with the same problem. I must be missing something.
Every dll I try to inject makes game closes after a few mins.
Over the last 3 days I tried every possible combination of dll and injetor but the game always closes after a few mins. I must be stupid.

[zoomgod]

Have to inject before HS starts up...
Any hooks should be in place ASAP as well if they require a call to VirtualProtect or use WPM.

[donoob]

... Hehe

I had same problems. When I inject something(without create any thread) H.S was detecting my DLL.

I finded out the scan and I bypassed it.... but there are few methods without touching H.S, for example, just pack DLL with UPX packer.