Since people have been asking me how to do what I said up there, here's some simple C++ talk on how to do it:
First download the detours package from microsoft ( google "microsoft detours" ). Include the detour header & C++ file accompanying that into your .dll project.
In the first .dll project, use the CreateProcess API ( google "msdn CreateProcess" ) to launch silkroad.exe ( the silkroad loader ) and make sure the CREATE_SUSPENDED flag is specified as a flag in the dwCreationFlags parameters. An example of this CreateProcess call would look like this:
Code:
PROCESS_INFORMATION pi;
ZeroMemory( pi, sizeof( PROCESS_INFORMATION ) );
if( FALSE == CreateProcessW( NULL, L"C:\\Program Files\\Silkroad\\silkroad.exe", NULL, NULL, FALSE, CREATE_SUSPENDED, NULL, NULL, NULL, &pi ) )
{
MessageBoxW( NULL, L"Unable to create the silkroad process.", L"Silkbot Error.", MB_OK );
return FALSE;
}
Next, since the process is created in a suspended state and not even the first byte has been executed and the PROCESS_INFORMATION structure has been filled with a handle to the process & the primary thread, you can proceed to inject the .dll you want into the suspended process and finally resume the process.
Code:
//Write the buffer/parameter to LoadLibraryW
wchar_t* LibraryFile = L"C:\\Program Files\\Silkroad\\Silkbot\\silkroadhijack.dll";
//First allocate the memory
void* DataPointer = VirtualAllocEx( pi.hProcess, NULL, MAX_PATH * sizeof( wchar_t ), MEM_COMMIT, PAGE_READWRITE );
if( DataPointer == NULL )
{
MessageBoxW( NULL, L"Unable to allocate memory in the target process. Closing process.", L"Silkbot Error.", MB_OK );
TerminateProcess( pi.hProcess, 0 );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
return FALSE;
}
//Next write the data in
DWORD Written = 0;
if( FALSE == WriteProcessMemory( pi.hProcess, DataPointer, (void*)LibraryFile, lstrlenW( LibraryFile ) * sizeof( wchar_t ), &Written ) || Written != ( lstrlenW( LibraryFile ) * sizeof( wchar_t ) ) )
{
MessageBoxW( NULL, L"Unable to write library file name into allocated memory. Closing process.", L"Silkbot Error.", MB_OK );
TerminateProcess( pi.hProcess, 0 );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
return FALSE;
}
//Next load the library
DWORD LibraryThreadId = 0;
HANDLE LibraryThread = CreateRemoteThread( pi.hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)LoadLibraryW, DataPointer, 0, &LibraryThreadId );
if( LibraryThread == NULL )
{
MessageBoxW( NULL, L"Unable to create thread. Closing process.", L"Silkbot Error", MB_OK );
TerminateProcess( pi.hProcess, 0 );
CloseHandle( pi.hProcess );
CloseHandle( pi.hThread );
return FALSE;
}
//Wait for the thread to terminate so we can clean up
WaitForSingleObject( LibraryThread, INFINITE );
//Clean up
VirtualFreeEx( pi.hProcess, DataPointer, MAX_PATH * sizeof( wchar_t ), MEM_DECOMMIT );
//Close unneeded handles
CloseHandle( LibraryThread );
CloseHandle( pi.hProcess );
//Resume the process we created in a suspended state
ResumeThread( pi.hThread );
//Close handle
CloseHandle( pi.hThread );
=o.
A similar method ( use the detours to create a detour on CreateProcess ( i believe the loader will use CreateProcessA but you can detour both A and W ) then append the CREATE_SUSPENDED flag onto the attributes using the or ( |= ) operand ) can be used to keep the sro_client.exe process suspended until the user presses a certain key at which time the process will resume and load gameguard.