Yo Everyone, so recently i am facing problems against Xigncode , I've made researches and found that it scans for DLL(S) that was loaded using the default way [loadlibrary] , so i've tried to make a manual mapping injection [so i can hide my dll ] since When i tried using Extreme injector v3.3 and injected my dll using Manual Mapping , the DLL worked perfectly & Xigncode couldn't detect it , However
When i tried my manual mapping injection code , it makes the game freeze , So i need a Source code for a manual mapping Injection in C++
Please keep in mind , that i didn't want to make it in .NET since the game i am hacking is using SSDT Protection ~ Ring0 [4 Hooks] Which prevents RPM & WPM . so .NET apps won't work at all .. [unless i've rehooked the memory MANUALLY using a software.]
Also ,if you are going to ask [ and you expect that C++ injector will work for that game ?] , well Yes!
I've found an exlpoit for the game's loader , which loads all files that has an extension of '.asi' , but loading my dll hack directly won't work [ i must code another dll with .asi extension to load the first ] , since the game loads the .asi files for seconds then gets rid of them..
So what i want , is a Manual Mapping Injector in C++ that could be in a DLL way [instead of .exe ] .
How about you post your own Manual Mapping implementation so we could actually tell you what's wrong with it and you could understand what you did wrong instead of asking for C&P code? :/
You stated it scans for dlls that were loaded using LoadLibrary.
Have you tried LdrLoadDll?
Is it really scanning for the dlls or did it just hook those functions and did an integrity check on the modules?
If it is scanning for the dlls you can try removing it from the loaded module list found in the PEB.
Originally Posted by stdio
Have you tried LdrLoadDll?
LdrLoadDll or LdrpLoadDll isn't manual mapping.
They're just lower level NT apis.
Originally Posted by Hitokiri~
LdrLoadDll or LdrpLoadDll isn't manual mapping.
They're just lower level NT apis.
Yes. I had never claimed it was manual mapping.
But the OP said the anticheat detected LoadLibrary.
My solution was to at least try a lower API.
Originally Posted by stdio
Yes. I had never claimed it was manual mapping.
But the OP said the anticheat detected LoadLibrary.
My solution was to at least try a lower API.
Pretty sure they'd check lower level APIs.
If it were me, I'd simply hook the call gate and throw in a CRC check.
Originally Posted by Hitokiri~
Pretty sure they'd check lower level APIs.
If it were me, I'd simply hook the call gate and throw in a CRC check.
I'm not positive to what privileges this anticheat runs under. If it is in the kernel then it's most likely they placed SSDT hooks.
If it runs in usermode however then there are many alternative to getting around hooks. KiFastSystemCall is one alternative.
Originally Posted by stdio
I'm not positive to what privileges this anticheat runs under. If it is in the kernel then it's most likely they placed SSDT hooks.
If it runs in usermode however then there are many alternative to getting around hooks. KiFastSystemCall is one alternative.
KiFastSystemCall is usually hooked by antiviruses anyways. Better to hook the callgate if you're under x86 apps.
@OP manual mapping is simply:
-> Parsing PE headers & Signatures ( IMAGE_DOS_HEADER->e_magic, IMAGE_NT_HEADERS->Signature )
-> Allocating IMAGE_OPTIONAL_HEADER->ImageBase by IMAGE_OPTIONAL_HEADER->SizeOfImage
-> Copying the headers to the ImageBase ( Optional )
-> Iterating through each DATA_DIRECTORY ( section ) and mapping them to their RVA
-> Fixing base relocations if the image wasn't mapped to it's ImageBase ( ONLY IF )
-> Applying correct virtual protections to each section
-> Executing the TLS if it exists
-> Calling IMAGE_OPTIONAL_HEADER->AddressOfEntryPoint with DLL_PROCESS_ATTACH ( If the image is a DLL )