for all you game hackers that want to hide your injected dlls (or executable modules).
[PHP]
void HideModule(HMODULE module)
{
PEB* peb;
LDR_MODULE* ldr;
peb = (PEB*)__readfsdword(0x30);
ldr = (LDR_MODULE*)peb->Ldr->InLoadOrderModuleList.Flink;
while( ldr->BaseAddress != 0 )
{
if( ldr->BaseAddress == module )
{
if(ldr->InLoadOrderModuleList.Blink != 0)
(ldr->InLoadOrderModuleList.Blink)->Flink = ldr->InLoadOrderModuleList.Flink;
if(ldr->InLoadOrderModuleList.Blink != 0)
(ldr->InLoadOrderModuleList.Flink)->Blink = ldr->InLoadOrderModuleList.Blink;
if(ldr->InInitializationOrderModuleList.Blink != 0)
(ldr->InInitializationOrderModuleList.Blink)->Flink = ldr->InInitializationOrderModuleList.Flink;
if(ldr->InInitializationOrderModuleList.Flink != 0)
(ldr->InInitializationOrderModuleList.Flink)->Blink = ldr->InInitializationOrderModuleList.Blink;
if(ldr->InMemoryOrderModuleList.Flink != 0)
(ldr->InMemoryOrderModuleList.Blink)->Flink = ldr->InMemoryOrderModuleList.Flink;
if(ldr->InMemoryOrderModuleList.Flink != 0)
(ldr->InMemoryOrderModuleList.Flink)->Blink = ldr->InMemoryOrderModuleList.Blink;
}
ldr = (LDR_MODULE*)ldr->InLoadOrderModuleList.Flink;
}
}
[/PHP]
youll need the structures ofc
LDR_MODULE
[PHP]
typedef struct _LDR_MODULE {
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
PVOID BaseAddress;
PVOID EntryPoint;
ULONG SizeOfImage;
}LDR_MODULE, *PLDR_MODULE;
[/PHP]
PEB_LDR_DATA
[PHP]
typedef struct _PEB_LDR_DATA {
ULONG Length;
BOOLEAN Initialized;
PVOID SsHandle;
LIST_ENTRY InLoadOrderModuleList;
LIST_ENTRY InMemoryOrderModuleList;
LIST_ENTRY InInitializationOrderModuleList;
}PEB_LDR_DATA, *PPEB_LDR_DATA;
[/PHP]
PEB
[PHP]
typedef struct _PEB {
BYTE Reserved1[2];
BYTE BeingDebugged;
BYTE Reserved2[1];
PVOID Reserved3[2];
PPEB_LDR_DATA Ldr;
}PEB, *PPEB;
[/PHP]
the structures arnt full, i took what i needed for this
ex of use:
[PHP]
int main()
{
HideModule(GetModuleHandle("ntdll.dll"));
MODULEENTRY32* pEntry;
pEntry->dwSize = sizeof( MODULEENTRY32 );
HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPALL,NULL);
Module32First(snapshot,pEntry);
do {
cout << pEntry->szModule << endl;
}while(Module32Next(snapshot,pEntry));
cin.get();
return 0;
}
[/PHP]
ntdll does not show whilst all other modules are listed
Yes I think I heard something about Hiding code by manipulating the Process Environment Block or PEB. In anycase I never looked into it, but Im gonna take ur word its correct. One more thing though.
I found one mistake I think
Should beCode:if(ldr->InLoadOrderModuleList.Blink != 0) (ldr->InLoadOrderModuleList.Blink)->Flink = ldr->InLoadOrderModuleList.Flink; if(ldr->InLoadOrderModuleList.Blink != 0) (ldr->InLoadOrderModuleList.Flink)->Blink = ldr->InLoadOrderModuleList.Blink;
Thanks for the share.Code:if(ldr->InLoadOrderModuleList.Blink != 0) (ldr->InLoadOrderModuleList.Blink)->Flink = ldr->InLoadOrderModuleList.Flink; if(ldr->InLoadOrderModuleList.Flink != 0) (ldr->InLoadOrderModuleList.Flink)->Blink = ldr->InLoadOrderModuleList.Blink;
Last edited by why06; 01-07-2011 at 05:33 AM.
"Every gun that is made, every warship launched, every rocket fired signifies, in the final sense, a theft from those who hunger and are not fed, those who are cold and are not clothed. This world in arms is not spending money alone. It is spending the sweat of its laborers, the genius of its scientists, the hopes of its children. The cost of one modern heavy bomber is this: a modern brick school in more than 30 cities. It is two electric power plants, each serving a town of 60,000 population. It is two fine, fully equipped hospitals. It is some fifty miles of concrete pavement. We pay for a single fighter plane with a half million bushels of wheat. We pay for a single destroyer with new homes that could have housed more than 8,000 people. This is, I repeat, the best way of life to be found on the road the world has been taking. This is not a way of life at all, in any true sense. Under the cloud of threatening war, it is humanity hanging from a cross of iron."- Dwight D. Eisenhower
manual mapping > this =p
good share tho
Ah we-a blaze the fyah, make it bun dem!
oh, sorry about that why, i guess i missed that. ;P