[Release] XignCode Undetected Dll Injection

[Cyrex']

Originally Posted by mortal3540

PLS

 Spoiler

or: Project->Properties->C/C++->Precompiled Headers
or2: Just include it lol and put header includes in there.

[K1ramoX]

Originally Posted by mortal3540

PLS

You're about to compile a .dll source as a console application.

----

btw: Further ITC requests will be warned.

[_set]

Good Job K1ramoX ♥

[tuaprimadd]

Originally Posted by Cyrex'

 Spoiler

or: Project->Properties->C/C++->Precompiled Headers
or2: Just include it lol and put header includes in there.

If he's compiling a dll as console, he probably will not know how to use this (or the use of this) or understand what you just said

[Ana7oda3li]

How i can you it lol ?

[VeriuzArtz]

Nice Work
I will try it out

[- Avrex -]

what does ITC means?

[Nitsubabite]

Item creator

[CritWay]

i dont unerstand ?

[RazexSkillz]

 Spoiler

Originally Posted by K1ramoX

Alo,

Recently I got in the mood to mess around with XignCode since it looks like this section is struggling with it. For now I just want to release a method that makes a singular .dll injection completely undetected.

The technique is really cheap, simple, and it's awkward that it even works. It works by forwarding the exported x3.xem dispatcher. The xc3 dispatcher is basically a GetProcAddress interpretation for their (xc3) own purposes.

To get my code working you just need to rename the dll "x3.xem" in the xigncode folder to "x3.dummy". Then simply rename your .dll to "x3.xem".

You should also be able to do static, undetected, memory changes inside the client's memory because xigncode isn't loaded yet. Meaning it hasn't had the chance to generate memory page checksums.

 Spoiler

#include <cstdint>
#include <string>
#include <windows.h>

#define X3_NOT_INITIALIZED -536805375

typedef int32_t(__stdcall *t_x3_Dispatch)(OUT void *Function, IN uint32_t Type);
static t_x3_Dispatch o_x3_Dispatch = nullptr;

void __stdcall DllMain()
{
	// add here your code
}

__declspec(dllexport) int32_t __stdcall x3_1(void *FunctionAddress, uint32_t Type)
{
	if (o_x3_Dispatch == nullptr)
	{
		std::string ModulePath;
		ModulePath.resize(MAX_PATH);

		if (!GetModuleFileNameA(NULL, const_cast<LPSTR>(ModulePath.data()), MAX_PATH))
		{
			MessageBoxA(0, "GetModuleFileNameA failed!", "Error", 0);
			return X3_NOT_INITIALIZED;
		}

		std::string S4_Folder = ModulePath.substr(0, ModulePath.find_last_of("\\"));
		S4_Folder += "\\xigncode\\x3.dummy";

		HMODULE hX3 = LoadLibraryA(S4_Folder.c_str());
		if (hX3 == nullptr)
		{
			MessageBoxA(0, "LoadLibraryA failed!", "Error", 0);
			return X3_NOT_INITIALIZED;
		}

		o_x3_Dispatch = reinterpret_cast<t_x3_Dispatch>(GetProcAddress(hX3, reinterpret_cast<LPCSTR>(1)));
		if (o_x3_Dispatch == nullptr)
		{
			MessageBoxA(0, "GetProcAddress failed!", "Error", 0);
			return X3_NOT_INITIALIZED;
		}

		DllMain();
	}

	return o_x3_Dispatch(FunctionAddress, Type);
}

Regards,
K1ramoX

soo.. itc?

[CpCosti]

Hey man i followed all your steps but it's not working, i made sure to rename the file and when I inject the .dll to S4client.exe I still get detected by xin

[Zaony]

No respect here "ant. is a noob" in tags xd

[ruzgar123]

C:\Users\Beyhan>bcdedit /set IncreaseUserVa 3072

[Highlited mind]

Thanks, nice tag btw mdrrr

[SonAfg1996]

i need injector bypass