Results 1 to 5 of 5
  1. #1
    Kalist's Avatar
    Join Date
    Apr 2013
    Gender
    male
    Posts
    17
    Reputation
    10
    Thanks
    1

    DLL injection vs hooking?

    Could someone elaborate these 2 terms? Should I focus on mastering hooking or DLL injection if trying to remain undetected when manipulating a game's process? Hooking is more undetectable, right? Or do you use a combination of both DLL injection and hooking? What's best? Hooking is closer to Assembly language I presume, so even though that is probably the hardest, it must be more undetectable at the same time.

  2. #2
    殺す必要がある唯一のものは殺されるために準備され人 々である。
    Premium Member
    Hitokiri~'s Avatar
    Join Date
    Oct 2012
    Gender
    female
    Location
    Cancer.
    Posts
    1,201
    Reputation
    24
    Thanks
    937
    My Mood
    Bitchy
    DLL Injection is merely you "forcing" the executable to load and execute your code. It has nothing in common with hooking, save that you may implement a hook in a DLL which, when executed by the process, will allow you to override/remove/modify the process's code.

    Hooking can be done without a DLL but would require you to inject pure assembly into the process then create a thread that points to the code to execute it.
    As for how undetectable it is, that mainly depends on what the process is checking for. If it does hashes on its own .text section and you hook anywhere there, it'll always be detected unless you hook whatever function you want before the hash function initializes.

    Usually people create hooking functions inside a DLL and then inject it since it's less complicated. There's no "best" way to hook a function. The only "undetectable" way would be to use a driver itself to hide your DLL and hooked locations ( Aka fake the memory at the overwritten address, hide allocated pages, unlink the DLL from the PEB etc. )

  3. #3
    ZER0MEM0RY's Avatar
    Join Date
    Feb 2015
    Gender
    male
    Location
    \\\\.\\PhysicalDrive0
    Posts
    94
    Reputation
    10
    Thanks
    4,218
    My Mood
    Cold
    Atleast for VAC, does not matter what method you use in the userspace, if any process reads/writes the game's memory, vac will get interested.

  4. #4
    Kalist's Avatar
    Join Date
    Apr 2013
    Gender
    male
    Posts
    17
    Reputation
    10
    Thanks
    1
    As I can understand it by what's been written, DLL injection is actually a part of hooking? DLL injection is simply a hooking method? Hooking is kind of a general term for it? So hooking basically means any kind of successful attempt to alter a process' behavior.

    What about if you use DLL injection but write the actual DLL content in assembly (the code to execute). Would that make it more undetectable? Like if you write the source code of the DLL itself in Assembly. Or does it only matter HOW you inject it and not WHAT you inject, and how it's written?
    Last edited by Kalist; 07-03-2015 at 11:45 AM.

  5. #5
    ZER0MEM0RY's Avatar
    Join Date
    Feb 2015
    Gender
    male
    Location
    \\\\.\\PhysicalDrive0
    Posts
    94
    Reputation
    10
    Thanks
    4,218
    My Mood
    Cold
    Quote Originally Posted by Kalist View Post
    As I can understand it by what's been written, DLL injection is actually a part of hooking? DLL injection is simply a hooking method? Hooking is kind of a general term for it? So hooking basically means any kind of successful attempt to alter a process' behavior.

    What about if you use DLL injection but write the actual DLL content in assembly (the code to execute). Would that make it more undetectable? Like if you write the source code of the DLL itself in Assembly. Or does it only matter HOW you inject it and not WHAT you inject, and how it's written?
    Writing your code in assembly does not change anything, assembly is simply just translated to machine code just like C++, or any statically typed native language.

    Dll injection works like so: A remote injector, allocates memory to the target process just enough it can create there a new thread, call a function from that thread (loadlibrary) with the parameter of the dll's path, then the operating system just loads the dll to the target process and calls it's main function.

    And, yes it does matter how you inject it, if you manually map the dll to your target process', the image of the dll is DIRECTLY written to the address space of the remote program, so that the dll won't be listed as a module in the process' Process Environment Block (PEB), thuis making the detection even harder.

Similar Threads

  1. DLL injection
    By Lynie in forum C++/C Programming
    Replies: 3
    Last Post: 10-30-2008, 11:44 AM
  2. [HELP] - DLL Injection
    By pelonzudo in forum C++/C Programming
    Replies: 1
    Last Post: 09-10-2008, 02:27 AM
  3. Crash at Dll inject
    By CyberStriker in forum WarRock - International Hacks
    Replies: 1
    Last Post: 08-13-2008, 06:51 AM
  4. [Help!] CA crash on dll inject
    By CyberStriker in forum Combat Arms Hacks & Cheats
    Replies: 9
    Last Post: 08-12-2008, 09:23 PM
  5. DLL injection Failled
    By aynal in forum WarRock - International Hacks
    Replies: 1
    Last Post: 01-15-2006, 09:41 PM