[Detected] XIGNCODE BLOCK INJECT DLL

XIGNCODE BLOCK INJECT DLL

Since I haven't noticed DLL injection in CROSSFIRE for a long time, but today I tried and failed because the process pID could not be detected, can anyone explain, I can just skip XIGNCODE and use CHEAT ENGINE for injection? Sorry, I use GOOGLE TRANSLator so it can be confusing

Just block the start of the XignCode driver (Xhunter1.sys), there are several ways to do this, such as tools on the internet or the application's permission.

simple way ------ windows kernel explorer -> Miscellaneous -> System Srttings -> Prohibit Loading Driver -> open crossfire

Originally Posted by Joaoemariana

simple way ------ windows kernel explorer -> Miscellaneous -> System Srttings -> Prohibit Loading Driver -> open crossfire

blocking driver xhunter1.sys it wouldn't work.. what i've seen here xigncode hooked writeprocessmemory and the other stuff and i think they use this way to prevent injecting dll's? well i'm not sure about that sorry for being so dumb but its just my theory.

Edit: well you can try it as freely so you will see it

Originally Posted by MemoryThePast

blocking driver xhunter1.sys it wouldn't work.. what i've seen here xigncode hooked writeprocessmemory and the other stuff and i think they use this way to prevent injecting dll's? well i'm not sure about that sorry for being so dumb but its just my theory.

Edit: well you can try it as freely so you will see it

well, I don't use it that way. but it works in cfbr.
I don't know in other regions how it works, but here xigncode only works to "protect" the game memory and nothing else.
it is very unlikely that xigncode will hook WPM as many other processes like some AVs use it...

but if it actually does that, you could just unhook it and inject the dll

remembering that all you need is WriteProcessMemory(or Nt function), VirtualAllocEx(or Nt function), and some function that starts a remote thread, such as CreateThreadEx, RtlCreateUserThread, etc...

so just look if some of these are hooked, and unhook again

there are many ways to do this

sorry for the bad english

Originally Posted by Joaoemariana

well, I don't use it that way. but it works in cfbr.
I don't know in other regions how it works, but here xigncode only works to "protect" the game memory and nothing else.
it is very unlikely that xigncode will hook WPM as many other processes like some AVs use it...

but if it actually does that, you could just unhook it and inject the dll

remembering that all you need is WriteProcessMemory(or Nt function), VirtualAllocEx(or Nt function), and some function that starts a remote thread, such as CreateThreadEx, RtlCreateUserThread, etc...

so just look if some of these are hooked, and unhook again

there are many ways to do this

sorry for the bad english

yup i know that and i tried to unhook it but it doesn't work because maybe they check it if its hooked or not. but yeah only way to inject in the game just need a undetected manual map to make through it and other public injectors don't work maybe since its public sources so they detect it

Originally Posted by MemoryThePast

yup i know that and i tried to unhook it but it doesn't work because maybe they check it if its hooked or not. but yeah only way to inject in the game just need a undetected manual map to make through it and other public injectors don't work maybe since its public sources so they detect it

hmm, look interesting? which region of the cf does this?

Originally Posted by Joaoemariana

simple way ------ windows kernel explorer -> Miscellaneous -> System Srttings -> Prohibit Loading Driver -> open crossfire

It's working

Originally Posted by Joaoemariana

hmm, look interesting? which region of the cf does this?

CFPH

you can create your own rwp driver for cf

Xigncode never hooked WPM,(hooking the game WPM for what the injector is external?) it's just the anti-cheat strips the handle from the injector so whenever you try to inject it will fail. to OP either bypass the xigncode completely or do this ghetto way,
1. Inject the hack before the xigncode loads
2. Create a program that will delete, create and then access the driver (Preventing the game from accessing the driver thus it will only strip once)
pseudo :

Code:

if(fileexist("C:\\xhunter1.sys")){
delete("xhunter1.sys");
}
auto Handle = CreateFile("C:\\xhunter1.sys");
while(true){
WriteFile(Handle, ...);
Sleep(10);
}

Originally Posted by ronoazoro1231

Xigncode never hooked WPM,(hooking the game WPM for what the injector is external?) it's just the anti-cheat strips the handle from the injector so whenever you try to inject it will fail. to OP either bypass the xigncode completely or do this ghetto way,
1. Inject the hack before the xigncode loads
2. Create a program that will delete, create and then access the driver (Preventing the game from accessing the driver thus it will only strip once)
pseudo :

Code:

if(fileexist("C:\\xhunter1.sys")){
delete("xhunter1.sys");
}
auto Handle = CreateFile("C:\\xhunter1.sys");
while(true){
WriteFile(Handle, ...);
Sleep(10);
}

well idk but in CFPH but they hooked this API what i've seen on it

WriteProcessMemory
ReadProcessMemory
MessageBox
IsWow64Process
GetAsyncKeyState
GetKeyState
GetMailSlotInfo
ReadFile

just like i said up here blocking xhunter1.sys won't work still you can't inject manual map and loalibrary unless if you have a undetected private manual map injector and you are good to go with that

For CrossFireVN
they have 2 more drivers loaded before start crossfire.exe/dat
One xigncode3 driver,another smilegate deiver.
xigncode3 block you openprocess.

Originally Posted by ronoazoro1231

Xigncode never hooked WPM,(hooking the game WPM for what the injector is external?) it's just the anti-cheat strips the handle from the injector so whenever you try to inject it will fail. to OP either bypass the xigncode completely or do this ghetto way,
1. Inject the hack before the xigncode loads
2. Create a program that will delete, create and then access the driver (Preventing the game from accessing the driver thus it will only strip once)
pseudo :

Code:

if(fileexist("C:\\xhunter1.sys")){
delete("xhunter1.sys");
}
auto Handle = CreateFile("C:\\xhunter1.sys");
while(true){
WriteFile(Handle, ...);
Sleep(10);
}

Wrong, There is simple way to do it..
No coding, no process hacker, no dll bypasses.

so does anyone know how to bypass this error xigncode when it injects??

DetectedXIGNCODE BLOCK INJECT DLL

Post a Reply

Similar Threads

Tags for this Thread