Xtrap memory protection ?

[Akius]

Resolved, thanks

[snow]

DWORD Scan = (DWORD)GetProcAddress(GetModuleHandleA("XtrapVa.dl l"), "XtrapVa.dll+3A9A7");

You try to retrieve the exported function XtrapVa.dll+3A9A7 but there is no such function. Therefore the result should be 0 (== nullptr). Detouring 0 will fail.

Apart from that there are other measures to prevent hacking, you'll have to disable them too (thread detection, driver and so on).

[Akius]

Originally Posted by snow911

DWORD Scan = (DWORD)GetProcAddress(GetModuleHandleA("XtrapVa.dl l"), "XtrapVa.dll+3A9A7");

You try to retrieve the exported function XtrapVa.dll+3A9A7 but there is no such function. Therefore the result should be 0 (== nullptr). Detouring 0 will fail.

Thanks for you answer, i will see that but i already tried by findpattern, i get the same results :S

Originally Posted by snow911

Apart from that there are other measures to prevent hacking, you'll have to disable them too (thread detection, driver and so on).

Allready bypassed other func, the problem now is the memory protection ^^


Any other answers ?

[snow]

Did you check the addresses? Are they correct? Calling convention should be correct.

This line might be another neckbreaker:
memcpy((void*)&page,(void*)0x00401000,Buffer.Regio nSize);

"page" is already your pointer, you're passing its address and memcpy tries to write to your stack or whatever but not to your allocated memory. reinterpret_cast<LPVOID>(page) should do it.

[​Tension]

You are able to prevent XTrap from detecting Threads and disable the Driver but you can't create a fake ScanPage function?

btw XtrapVa.dll+3A9A7 => XtrapVa.dll Base Address + 3A9A7

[Akius]

Originally Posted by Ten$ion

You are able to prevent XTrap from detecting Threads and disable the Driver but you can't create a fake ScanPage function?

btw XtrapVa.dll +3A9A7 => XtrapVa.dll Base Address + 3A9A7

no it's not the base address but the addy
And disable terminatethread was just a simple api hook --'

[Padmak]

I think you got him wrong, the address for your function should be the base address of XtrapVa.dll + 0x3A9A7

Padmak

[Akius]

I found the problem, thanks for your answers ^_^