
Originally Posted by
.::SCHiM::.
I have no personal experience with PB, but since it has been around long enough I think it's safe for me to assume that PB has all the usual base covered.
That means:
String detection things like 'aimbot' will get flagged. But it probably won't check for an md5 string, since dll files are not static in memory, it's more likely that they have a signature. To bypass this, remove your dll from the PEB->ldr or rebuild your dll each time it gets detected.
Next: hooks.
All usual hooks are probably detected/watched. Try a mid-function hook or a hardware breakpoint+exception handler combo.
That will probably keep you under the radar, if not you'll just have to try and see what works.
@
.::SCHiM::. first of all, thanks a lot for your answer
let me resume what you just said to see if i got it right:
strings, like if i name a variable aimbot=x then i will be detected;
PEB->ldr means Process Environment Block with a loader data connected to an ldr that some how i have to remove (or smth like that, i'm reading stuffs about it right now)
hooks i'm diggin into what you just said right now

and now the hardest stuff that i really cant find out by my self: how do i extract from memory x,y,z address of every player in the map?
so far i can get to this:
x y z is some what of an array, or atleast that will be in my dll, then in memory i should be able to find some addresses that referes to that kind of address class (enemy/friendly players or players with the value of enemy or friendly), but i really dont know how to do that... i tried it time ago to do that in some other games but without success.
my method is to open CE and scan for the addresses but even IF I may eventually find, i have no clue on how to offset them into a full array of right addresses that points their x or y or z values.
perhaps there are some more advanced ways to do that, i'd really love a point out
another thing came up to my mind about possible detection:
if pb detects strings, we may also talk about possible d3d detection?
as example to create some d3d stuffs we have, to bring a simple example, D3DXMatrixRotationY, this string is proper of the .lib from where its taken, so this means that if pb checks that i'd need to rewrite the lib, am i right?