[Release] XignCode Undetected Dll Injection

Quote:

Originally Posted by K1ramoX Alo, Recently I got in the mood to mess around with XignCode since it looks like this section is struggling with it. For now I just want to release a method that makes a singular .dll injection completely undetected. The technique is really cheap, simple, and it's awkward that it even works. It works by forwarding the exported x3.xem dispatcher. The xc3 dispatcher is basically a GetProcAddress interpretation for their (xc3) own purposes. To get my code working you just need to rename the dll "x3.xem" in the xigncode folder to "x3.dummy". Then simply rename your .dll to "x3.xem". You should also be able to do static, undetected, memory changes inside the client's memory because xigncode isn't loaded yet. Meaning it hasn't had the chance to generate memory page checksums.  Spoiler Code: #include <cstdint> #include <string> #include <windows.h> #define X3_NOT_INITIALIZED -536805375 typedef int32_t(__stdcall *t_x3_Dispatch)(OUT void *Function, IN uint32_t Type); static t_x3_Dispatch o_x3_Dispatch = nullptr; void __stdcall DllMain() { // add here your code } __declspec(dllexport) int32_t __stdcall x3_1(void *FunctionAddress, uint32_t Type) { if (o_x3_Dispatch == nullptr) { std::string ModulePath; ModulePath.resize(MAX_PATH); if (!GetModuleFileNameA(NULL, const_cast<LPSTR>(ModulePath.data()), MAX_PATH)) { MessageBoxA(0, "GetModuleFileNameA failed!", "Error", 0); return X3_NOT_INITIALIZED; } std::string S4_Folder = ModulePath.substr(0, ModulePath.find_last_of("\\")); S4_Folder += "\\xigncode\\x3.dummy"; HMODULE hX3 = LoadLibraryA(S4_Folder.c_str()); if (hX3 == nullptr) { MessageBoxA(0, "LoadLibraryA failed!", "Error", 0); return X3_NOT_INITIALIZED; } o_x3_Dispatch = reinterpret_cast<t_x3_Dispatch>(GetProcAddress(hX3, reinterpret_cast<LPCSTR>(1))); if (o_x3_Dispatch == nullptr) { MessageBoxA(0, "GetProcAddress failed!", "Error", 0); return X3_NOT_INITIALIZED; } DllMain(); } return o_x3_Dispatch(FunctionAddress, Type); } Regards, K1ramoX