XTrap Memory Detection

[Forbidi]

Hello, so i tried many time to bypass memory détection using fake scan page method but i get always a crash. i added an infinite loop before return original page then xcrap call the function without any return, well i dont get a crash only after few minutes. So i was asking if the method is patched or if i'm doing something wrong and if i need to detours another func.

[cheyester10]

It's a lot better to remove the xtrap driver. You can do that by preventing it from starting up(You have to make it look like xtrap is still there). You can also hook functions. There are several other methods.

[Forbidi]

Originally Posted by cheyester10

You can also hook functions. There are several other methods.

Thats what i'm doing. I set a jmp to my page.

[cheyester10]

Originally Posted by Forbidi

Thats what i'm doing. I set a jmp to my page.

did you inc the original opcode?

[Forbidi]

Originally Posted by cheyester10

did you inc the original opcode?

i think i have the right calling convention.

[snow]

Make sure you don't have any multithreading related issues, multiple threads use this function.
Also make sure your hook includes if (size <= 0).

[Forbidi]

Originally Posted by snow911

Make sure you don't have any multithreading related issues, multiple threads use this function.
Also make sure your hook includes if (size < 0).

Im not using multithreading, i will add the conditions and see thx.
Edit : still get crash :S

[K1ramoX]

Originally Posted by cheyester10

It's a lot better to remove the xtrap driver. You can do that by preventing it from starting up(You have to make it look like xtrap is still there). You can also hook functions. There are several other methods.

xtrap driver != memorydetection ;o

Originally Posted by Forbidi

Hello, so i tried many time to bypass memory détection using fake scan page method but i get always a crash. i added an infinite loop before return original page then xcrap call the function without any return, well i dont get a crash only after few minutes. So i was asking if the method is patched or if i'm doing something wrong and if i need to detours another func.

thats cause xtrap has a new check for this function. you can bypass it by hooking some functions before it and using maybe a vtable hook ;o

Originally Posted by snow911

Also make sure your hook includes if (size < 0).

size cant be <0. just check:

if (!size)
{
	return 0;
}

[Omdi]

Originally Posted by K1ramoX

if (!size)
{
	return 0;
}

Well comparing 'size' for being smaller than zero is actually much safer than expecting that 'size' would never be smaller than zero. Be prepared for the worst case scenario

[Forbidi]

Originally Posted by K1ramoX

thats cause xtrap has a new check for this function. you can bypass it by hooking some functions before it and using maybe a vtable hook ;o

What func you mean Oo

[snow]

Originally Posted by Forbidi

What func you mean Oo

I don't think it's a good idea to share everything we know about XTrap with the wide public, you were able to find the memory detection by yourself so you should be able to find other functions as well.

Im not using multithreading, i will add the conditions and see thx.

No, you aren't using multithreading, XTrap uses multithreading and you're hooking a XTrap function.
std::mutex might be something for you.

Oh, and you should return TRUE in your DllMain, return FALSE will free the allocated memory thus your hook jumps to some random / empty memory.

[K1ramoX]

Originally Posted by Omdihar

Well comparing 'size' for being smaller than zero is actually much safer than expecting that 'size' would never be smaller than zero. Be prepared for the worst case scenario

xtrap is checking if its zero too =P

Originally Posted by Forbidi

What func you mean Oo

just backtrace

Originally Posted by snow911

No, you aren't using multithreading, XTrap uses multithreading and you're hooking a XTrap function.
std::mutex might be something for you.

if you let xtrap scan in copied pages you dont need a mutex d:

[Omdi]

Originally Posted by K1ramoX

xtrap is checking if its zero too =P

XTrap also gets the address of GetProcAddress with calling GetProcAddress instead of doing &GetProcAddress.

if you let xtrap scan in copied pages you dont need a mutex d:

This is only the case if there's only one thread checking the page

[K1ramoX]

Originally Posted by Omdihar

XTrap also gets the address of GetProcAddress with calling GetProcAddress instead of doing &GetProcAddress.

advanced code obfuscation, Y U NO KNOW THAT

Originally Posted by Omdihar

This is only the case if there's only one thread checking the page

mutex for read? theres no write or run ;o