Basic Help need

[rabir007]

I'm new at Visual C++
So i want to find the idiot CShell:

DWORD FindCShell( )
{
    if( EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
    {
        for (int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
        {
            TCHAR szModName[MAX_PATH];
            // Get the full path to the module's file.
            if ( GetModuleFileNameEx( hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR)) != NULL)
            {
                std::string ModuleName;
                TcharToString(ModuleName,szModName);
                if ( EndWith(ModuleName, "CShell.dll")) return (DWORD)hMods[i];
            }
        }
    }
    return 0;
}

But i got this error:

error LNK2001: unresolved external symbol _EnumProcessModules@16
error LNK2001: unresolved external symbol _GetModuleFileNameExW@16

Anyone would help me, how to fix it ?

[3D]

Try to ask pingo ...

[ctpsolo]

Make sure you include Psapi.h and also the lib

Like this

#include<Psapi.h>
#pragma comment(lib, "Psapi")

Also why make it so complicated for yourself? If you want to do dump cshell just load cshell using LoadLibrary and attach olly to your program. If you need a handle to cshell for your hack you can also use the regular way. For instance

DWORD Cshell = (DWORD)GetModuleHandleA("Cshell.dll");

However you need to encrypt the cshell string. "Cshell.dll" will trigger xtrap detection.

[rabir007]

Make sure you include Psapi.h and also the lib

Like this

#include<Psapi.h>
#pragma comment(lib, "Psapi")

Also why make it so complicated for yourself? If you want to do dump cshell just load cshell using LoadLibrary and attach olly to your program. If you need a handle to cshell for your hack you can also use the regular way. For instance

DWORD Cshell = (DWORD)GetModuleHandleA("Cshell.dll");

However you need to encrypt the cshell string. "Cshell.dll" will trigger xtrap detection.

So, thats why the idiot Xtrap detect... I thought its detect the GetModuleHandle...

[bandi12]

I'm new at Visual C++
So i want to find the idiot CShell:

DWORD FindCShell( )
{
    if( EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded))
    {
        for (int i = 0; i < (cbNeeded / sizeof(HMODULE)); i++ )
        {
            TCHAR szModName[MAX_PATH];
            // Get the full path to the module's file.
            if ( GetModuleFileNameEx( hProcess, hMods[i], szModName, sizeof(szModName) / sizeof(TCHAR)) != NULL)
            {
                std::string ModuleName;
                TcharToString(ModuleName,szModName);
                if ( EndWith(ModuleName, "CShell.dll")) return (DWORD)hMods[i];
            }
        }
    }
    return 0;
}

But i got this error:

error LNK2001: unresolved external symbol _EnumProcessModules@16
error LNK2001: unresolved external symbol _GetModuleFileNameExW@16

Anyone would help me, how to fix it ?

it will be detected

[giniyat101]

add psapi.lib to your linked libraries :
#pragma comment(lib, "psapi.lib")
also, use #define PSAPI_VERSION 1 before including psapi.h.

[rabir007]

it will be detected

I fixed with encrypting the "CShell.dll"

---------- Post added at 08:48 PM ---------- Previous post was at 08:47 PM ----------

add psapi.lib to your linked libraries :
#pragma comment(lib, "psapi.lib")
also, use #define PSAPI_VERSION 1 before including psapi.h.

I fixed the GetModuleHandle

[Arcton]

So, is this fixed ?

[rabir007]

So, is this fixed ?

Yep...
/msg2short