[Help] injection methods against VAC

injection methods against VAC

How can I code an injector VAC ud?
(beside own signature)
What can cause untrusted/etc?
LoadLibrary? Manual map? Was looking into some sources and 1 person said that his injector was detected and was causing untrusted (it was loadlib).
Could anyone explain?

Originally Posted by fajung

How can I code an injector VAC ud?
(beside own signature)
What can cause untrusted/etc?
LoadLibrary? Manual map? Was looking into some sources and 1 person said that his injector was detected and was causing untrusted (it was loadlib).
Could anyone explain?

Loadlibrary should work too, but u better use manual map.

LoadLibrary injection works fine if your injector will be used privately.

Another way you could LoadLibrary would be to inject a DLL into a different process which will LoadLibrary your DLL into the target process.

Manual Map if done right is another way you could inject your DLL, however, LoadLibrary works fine if your injector is used privately.

Originally Posted by WasserEsser

LoadLibrary injection works fine if your injector will be used privately.

Manual Map if done right is another way you could inject your DLL, however, LoadLibrary works fine if your injector is used privately.

Manual Mapping isn't that secure either, since VAC scans each page of memory of the protected process, and if certain unknown patterns are found = BanPlayer();

Another way you could LoadLibrary would be to inject a DLL into a different process which will LoadLibrary your DLL into the target process.

I really don't think that the injector makes any difference, I know that VAC scans for open handles of all processes (handle is opened on injection) but the handle is open for just a split second, and injector is usually closed when operation finishes.

VAC scans the PEB, which will list all the modules loaded by LdrLoadDll(LoadLibrary), and VAC can just

Code:

char szFilePath[1024];
GetModuleFileNameA(PEB.Module[LoadedModule], LPSTR(szFilePath), 1024);
if (IsBlacklisted(szFilePath)) BanPlayer();

Originally Posted by nullptr_t

Manual Mapping isn't that secure either, since VAC scans each page of memory of the protected process, and if certain unknown patterns are found = BanPlayer();

I never said it's secure, i said it's another way you can inject your DLL.

Originally Posted by nullptr_t

I really don't think that the injector makes any difference, I know that VAC scans for open handles of all processes (handle is opened on injection) but the handle is open for just a split second, and injector is usually closed when operation finishes.

VAC scans the PEB, which will list all the modules loaded by LdrLoadDll(LoadLibrary), and VAC can just

Code:

char szFilePath[1024];
GetModuleFileNameA(PEB.Module[LoadedModule], LPSTR(szFilePath), 1024);
if (IsBlacklisted(szFilePath)) BanPlayer();

VAC can't ban you for a file named after a certain cheat, and they never will.

I never said it's secure, i said it's another way you can inject your DLL.

Sorry, my intention was not to make it look like that. Just want to spread awareness.

Originally Posted by WasserEsser

VAC can't ban you for a file named after a certain cheat, and they never will.

That was just a small example obviously, I know that they use patterns & signatures to recognize certain cheats & trainers.

Originally Posted by nullptr_t

Sorry, my intention was not to make it look like that. Just want to spread awareness.

That was just a small example obviously, I know that they use patterns & signatures to recognize certain cheats & trainers.

Manual mapping won't help against signature scanning, that's right. They can just scan their memory pages and find your file.
But yet again, as long as the injector is used privately, he should be on the safe side with all of the 3 methods mentioned here.

Originally Posted by WasserEsser

Manual mapping won't help against signature scanning, that's right. They can just scan their memory pages and find your file.
But yet again, as long as the injector is used privately, he should be on the safe side with all of the 3 methods mentioned here.

I agree //2short

And what if injector causes untrusted? I saw interesting one in de_stroyer source, but i dont know how. It's just loadlibrarya injector, but author said that it will get me untrusted. Making sig unique will make it safe again, or is it this exact method dll is injected that makes trouble there?

I never played with injectables, but want to start making some simple ones.

Originally Posted by fajung

And what if injector causes untrusted? I saw interesting one in de_stroyer source, but i dont know how. It's just loadlibrarya injector, but author said that it will get me untrusted. Making sig unique will make it safe again, or is it this exact method dll is injected that makes trouble there?

I never played with injectables, but want to start making some simple ones.

LoadLibrary doesn't get you untrusted yet alone.

Thank you guys for explanation. Everything's clear now

Waiting for that "Solved and closed" :P

/Solved & closed.

Helpinjection methods against VAC

Similar Threads

Tags for this Thread