1. As you know most injectors are coded to the fact that the dll would be loaded w/ LdrLoadDll(); or LoadLibrary(); in your own memory space. Easy solution, hook LdrLoadDll in r0 and use PsGetCurrentProcess(); and check if it's from your process or hook LdrLoadDll(); & LoadLibrary(); in r3;
2. You can't get a window process handle without using OpenProcess(), correct? Hook ZwOpenProcess in r0 & filter it with PsGetCurrentProcess();
3. Even if they bypass that, thank god they'll use KeStackAttachProcess. This could be use to prevent memory editing software like ArtMoney, Cheat Engine... etc
4. Memory validations, well if you hate memory editors and somehow they bypassed all of the above you could do a simple MD5 or SHA-1 or SHA-2 of the memory, but don't check it in via clientsided which can just be a simple ZF away from being bypassed. What you could do is create a packet w/ the hash + timestamps for a more secure packet. Packet encryption is optional, but recommended.
5. Never, never, never, never use FindWindows(); or traverse the module or process list. It is one of the most stupidest method to detect a cheat.
6. Once a function is called the data would be in the stack until popped out or the process ends. Simple... Set up your prologue
[code]
mov edi, edi
push ebp
mov esp, ebp
[code]
mov edi, edi isn't needed.
To read the stacks data just extract the data from the ebp and increment 0x4 bytes every parameter.
:)
Originally Posted by ThievingSix
