DLL injection vs hooking?
DLL injection vs hooking?
Could someone elaborate these 2 terms? Should I focus on mastering hooking or DLL injection if trying to remain undetected when manipulating a game's process? Hooking is more undetectable, right? Or do you use a combination of both DLL injection and hooking? What's best? Hooking is closer to Assembly language I presume, so even though that is probably the hardest, it must be more undetectable at the same time.
DLL Injection is merely you "forcing" the executable to load and execute your code. It has nothing in common with hooking, save that you may implement a hook in a DLL which, when executed by the process, will allow you to override/remove/modify the process's code.
Hooking can be done without a DLL but would require you to inject pure assembly into the process then create a thread that points to the code to execute it.
As for how undetectable it is, that mainly depends on what the process is checking for. If it does hashes on its own .text section and you hook anywhere there, it'll always be detected unless you hook whatever function you want before the hash function initializes.
Usually people create hooking functions inside a DLL and then inject it since it's less complicated. There's no "best" way to hook a function. The only "undetectable" way would be to use a driver itself to hide your DLL and hooked locations ( Aka fake the memory at the overwritten address, hide allocated pages, unlink the DLL from the PEB etc. )
Hooking can be done without a DLL but would require you to inject pure assembly into the process then create a thread that points to the code to execute it.
As for how undetectable it is, that mainly depends on what the process is checking for. If it does hashes on its own .text section and you hook anywhere there, it'll always be detected unless you hook whatever function you want before the hash function initializes.
Usually people create hooking functions inside a DLL and then inject it since it's less complicated. There's no "best" way to hook a function. The only "undetectable" way would be to use a driver itself to hide your DLL and hooked locations ( Aka fake the memory at the overwritten address, hide allocated pages, unlink the DLL from the PEB etc. )
Originally Posted by Kalist
