PEB - Process environment block
use - Hides process from warrock
Warrock scans and detects for attached Dynamic Linked Library files.
This is my first time hearing of PEB, and this has dramatically brain fucked me.
I know im not a complete newb when it comes to no menu hacks for warrock, but i am not the greatest either.
I have researched PEB and came across some people claiming something was Hiding PEB from warrock but it just placed me in more confusion.
Please show with open source how you would use this code with hiding the DLL from warrock.
Example of code i am using:
Quote:
Code:
#include <Windows.h>
#include <stdio.h>
#define ADR_PLAYERPOINTER 0x00A48E74
#define ADR_SERVERPOINTER 0x00A48E04
#define OFS_NFD 0x00102E8
void HackFunctions(){
for(;;){
[COLOR="#00FF00"]//DWORD Server = *(DWORD*)ADR_SERVERPOINTER;[/COLOR]
DWORD Player = *(DWORD*)ADR_PLAYERPOINTER;
[COLOR="#00FF00"]
/***************************[ No Fall Damage ]***************************/[/COLOR]
{
if( Player != 0 ){ //Player is in game
*(float*)( Player + OFS_NFD ) = -999999;
}
}
[COLOR="#00FF00"]/************************************************************************/[/COLOR]
Sleep(100);
}
}
BOOL WINAPI DllMain(HINSTANCE hModule,DWORD dwReason,LPVOID lpvReserved){
if( dwReason == DLL_PROCESS_ATTACH ){
CreateThread(0,0,(LPTHREAD_START_ROUTINE)HackFunctions,0,0, 0);
}
return true;
}
Quote:
Cyno__™
I want to thank you for your time
sooo i now have..
Quote:
Code:
#include <Windows.h>
#include <stdio.h>
#define ADR_PLAYERPOINTER 0x00A48E74
#define ADR_SERVERPOINTER 0x00A48E04
#define OFS_NFD 0x00102E8
VOID AntiDetection::PEBUnlinkModule(HINSTANCE hModule)
{
DWORD dwPEB_LDR_DATA = 0;
_asm
{
pushad;
pushfd;
mov eax, fs:[30h] // PEB
mov eax, [eax+0Ch] // PEB->ProcessModuleInfo
mov dwPEB_LDR_DATA, eax // Save ProcessModuleInfo
InLoadOrderModuleList:
mov esi, [eax+0Ch] // ProcessModuleInfo->InLoadOrderModuleList[FORWARD]
mov edx, [eax+10h] // ProcessModuleInfo->InLoadOrderModuleList[BACKWARD]
LoopInLoadOrderModuleList:
lodsd // Load First Module
mov esi, eax // ESI points to Next Module
mov ecx, [eax+18h] // LDR_MODULE->BaseAddress
cmp ecx, hModule // Is it Our Module ?
jne SkipA // If Not, Next Please (@f jumps to nearest Unamed Lable @@:)
mov ebx, [eax] // [FORWARD] Module
mov ecx, [eax+4] // [BACKWARD] Module
mov [ecx], ebx // Previous Module's [FORWARD] Notation, Points to us, Replace it with, Module++
mov [ebx+4], ecx // Next Modules, [BACKWARD] Notation, Points to us, Replace it with, Module--
jmp InMemoryOrderModuleList // Hidden, so Move onto Next Set
SkipA:
cmp edx, esi // Reached End of Modules ?
jne LoopInLoadOrderModuleList // If Not, Re Loop
InMemoryOrderModuleList:
mov eax, dwPEB_LDR_DATA // PEB->ProcessModuleInfo
mov esi, [eax+14h] // ProcessModuleInfo->InMemoryOrderModuleList[START]
mov edx, [eax+18h] // ProcessModuleInfo->InMemoryOrderModuleList[FINISH]
LoopInMemoryOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+10h]
cmp ecx, hModule
jne SkipB
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp InInitializationOrderModuleList
SkipB:
cmp edx, esi
jne LoopInMemoryOrderModuleList
InInitializationOrderModuleList:
mov eax, dwPEB_LDR_DATA // PEB->ProcessModuleInfo
mov esi, [eax+1Ch] // ProcessModuleInfo->InInitializationOrderModuleList[START]
mov edx, [eax+20h] // ProcessModuleInfo->InInitializationOrderModuleList[FINISH]
LoopInInitializationOrderModuleList:
lodsd
mov esi, eax
mov ecx, [eax+08h]
cmp ecx, hModule
jne SkipC
mov ebx, [eax]
mov ecx, [eax+4]
mov [ecx], ebx
mov [ebx+4], ecx
jmp Finished
SkipC:
cmp edx, esi
jne LoopInInitializationOrderModuleList
Finished:
popfd;
popad;
}
}
void HackFunctions(){
for(;;){
//DWORD Server = *(DWORD*)ADR_SERVERPOINTER;
DWORD Player = *(DWORD*)ADR_PLAYERPOINTER;
/***************************[ No Fall Damage ]***************************/
{
if( Player != 0 ){ //Player is in game
*(float*)( Player + OFS_NFD ) = -999999;
}
}
/************************************************************************/
Sleep(100);
}
}
BOOL WINAPI DllMain(HINSTANCE hModule,DWORD dwReason,LPVOID lpvReserved){
if( dwReason == DLL_PROCESS_ATTACH ){
CreateThread(0,0,(LPTHREAD_START_ROUTINE)HackFunctions,0,0, 0);
}
return true;
}
But where do i use the command to activate VOID AntiDetection::PEBUnlinkModule(HINSTANCE hModule) and with what parameters?
The PEB, which is listed at __readfsdword(0x30) on 32-bit-architecture or __readfsdword(0x60) on 64-bit-architecture, contains data about the process environment - that's why it's called Process Environment Block (= PEB). It contains an instance of the PEB_LDR_DATA structure providing information about loaded modules. By modifying this information you can easily hide your module from that list so that HackShield scanning for unknown modules cannot find it on the PEB.
The information can still be found on the VAD (Virtual Address Descriptor) Tree after editing the PEB, though.
It says 3rd party software found, disconnected..
So hackshield is finding it.. i also tried doing it this way
Quote:
Originally Posted by Yazzn (:
Close all background programs
HackShield detected VisualStudio some time ago as a 3rd party software modifying the game for VisualStudio being open whenever HackShield detected an actual cheat module. Most people don't know this, be careful about it.
HackShield detected VisualStudio some time ago as a 3rd party software modifying the game for VisualStudio being open whenever HackShield detected an actual cheat module. Most people don't know this, be careful about it.
I closed all other programs, still being detected.
