HideDLL

Posts 1–15 of 52 · Page 1 of 4
HideDLL
So I got my hook that was detected, and with this it wasn't detected anymore.
It basicly hide's your dll injection, not the functions inside it.
Don't call me a leecher, don't say:"dude thats totally not helpful" or something...
If you don't like it, go away.
Code:
void HideDLL(HINSTANCE hModule)
{
    DWORD dwPEB_LDR_DATA = 0;
    _asm
    {
        pushad;
        pushfd;
        mov eax, fs:[30h]             
        mov eax, [eax+0Ch]               
        mov dwPEB_LDR_DATA, eax    

        InLoadOrderModuleList:
            mov esi, [eax+0Ch]         
            mov edx, [eax+10h]         

        LoopInLoadOrderModuleList: 
            lodsd                 
            mov esi, eax    
            mov ecx, [eax+18h]  
            cmp ecx, hModule    
            jne SkipA         
            mov ebx, [eax]      
            mov ecx, [eax+4]  
            mov [ecx], ebx    
            mov [ebx+4], ecx      
            jmp InMemoryOrderModuleList 

        SkipA:
            cmp edx, esi     
            jne LoopInLoadOrderModuleList

        InMemoryOrderModuleList:
            mov eax, dwPEB_LDR_DATA
            mov esi, [eax+14h]
            mov edx, [eax+18h]

        LoopInMemoryOrderModuleList: 
            lodsd
            mov esi, eax
            mov ecx, [eax+10h]
            cmp ecx, hModule
            jne SkipB
            mov ebx, [eax] 
            mov ecx, [eax+4]
            mov [ecx], ebx
            mov [ebx+4], ecx
            jmp InInitializationOrderModuleList

        SkipB:
            cmp edx, esi
            jne LoopInMemoryOrderModuleList

        InInitializationOrderModuleList:
            mov eax, dwPEB_LDR_DATA
            mov esi, [eax+1Ch]      
            mov edx, [eax+20h]      

        LoopInInitializationOrderModuleList: 
            lodsd
            mov esi, eax        
            mov ecx, [eax+08h]
            cmp ecx, hModule        
            jne SkipC
            mov ebx, [eax] 
            mov ecx, [eax+4]
            mov [ecx], ebx
            mov [ebx+4], ecx
            jmp Finished

        SkipC:
            cmp edx, esi
            jne LoopInInitializationOrderModuleList

        Finished:
            popfd;
            popad;
    }
}

Credits:Gellin.
nice and good job ..
Quote Originally Posted by XarutoUsoCrack View Post
Original Credits: @gellin. JUST @gellin
Aww fail...Found it on another forum with thos credits, just placed my name in it because changed some features.
Nice copy and paste skills from Combat arms section
I don't get what's your fucking problem. He copied and pasted it - Where is the point? He shared it and it is a contribution.
Quote Originally Posted by A$IAN View Post
I don't get what's your fucking problem. He copied and pasted it - Where is the point? He shared it and it is a contribution.
REALITY Always cry's when I release something, we are just to sexy for him


---------- Post added at 10:29 PM ---------- Previous post was at 10:28 PM ----------

Quote Originally Posted by Dragon(H)ell View Post
@RobinC take it advice from me,never share any codes here (your codes nor codes you found and want to share) all here are leechers and NQQBS
As long as they put credits @gellin Im okay with it.
@RobinC take it advice from me,never share any codes here (your codes nor codes you found and want to share) all here are leechers and NQQBS
Quote Originally Posted by Dragon(H)ell View Post
@RobinC take it advice from me,never share any codes here (your codes nor codes you found and want to share) all here are leechers and NQQBS
Sharing is caring!
Nice of you to share, thanks for crediting Gellin
@ REALITY™ Thanks :-) Your DIP hook was also Nice C&P.
The credits are wrong it was made by PizzaPan from GD.
thank you aloooooooot
Posts 1–15 of 52 · Page 1 of 4

Post a Reply

Similar Threads

Tags for this Thread

None

Talk with us