The loading of CShell.dll is blocked via GetModuleHandleA / GetModuleHandleW from outside of an allowed thread.. Easy ways around this (: ( What I mean by this is that they block calls to GetModuleHandleA / GetModuleHandleW from outside of the allowed threads ) XTrap probably placed a ring0 hook on the NT Equivalent or something that the NT Equivalent calls ( Another ring0 function ) so either unhook or trace back or find a way around it (:
---------- Post added at 04:53 PM ---------- Previous post was at 04:52 PM ----------
Originally Posted by giniyat101
maybe.. but it wont kill a NtQueryInformationProcess call as everything uses this.. lol
but this function is not for newbies so no one here can use it
ring0 I like Glad to see you're getting a hold of it. If you need help don't be afraid to hit me up bro.
The loading of CShell.dll is blocked via GetModuleHandleA / GetModuleHandleW from outside of an allowed thread.. Easy ways around this (:
a litel tutorial or source code how to make it work i mean to not get blocked
Originally Posted by bandi12
a litel tutorial or source code how to make it work i mean to not get blocked
I already gave you a huge hint...
Originally Posted by ~FALLEN~
The loading of CShell.dll is blocked via GetModuleHandleA / GetModuleHandleW from outside of an allowed thread.. Easy ways around this (:
---------- Post added at 04:53 PM ---------- Previous post was at 04:52 PM ----------
ring0 I like Glad to see you're getting a hold of it. If you need help don't be afraid to hit me up bro.
okay.. thank you
WTF Crossfire no longer loads CShell ? Strange fucking game hahaha it always has before, this means new bases which means less detectable !
Fuck xtrap and z8
Originally Posted by {Banned}**HACKER**
WTF Crossfire no longer loads CShell ? Strange fucking game hahaha it always has before, this means new bases which means less detectable !
Fuck xtrap and z8
They still load it... you just don't have access to it from your thread ^_^
Just install a LoadLibraryA hook and get the handle from this.
Originally Posted by {Banned}**HACKER**
WTF Crossfire no longer loads CShell ? Strange fucking game hahaha it always has before, this means new bases which means less detectable !
Fuck xtrap and z8
the game would crash if CShell didn't loadd
Originally Posted by Zacherl
Just install a LoadLibraryA hook and get the handle from this.
ehhh ineffective, they could just put a kernel hook and check the return address for foreign ranges... or start scanning for hooks on the function all together
Originally Posted by ~FALLEN~
ehhh ineffective, they could just put a kernel hook and check the return address for foreign ranges... or start scanning for hooks on the function all together
i have an idea!
lets stop xtrap driver service!
look at this :
The XDva397 service was successfully sent a start control
haha kidding dont even try
Originally Posted by giniyat101
i have an idea!
lets stop xtrap driver service!
look at this :
The XDva397 service was successfully sent a start control
haha kidding dont even try
Killing XTrap is much easier than that... You would need to emulate the server heartbeat. ( If any )
so why just dont make a function that create thread and use hide module (so it wont be detected)... and actully i create my Dll main function...
BTW i cant test now...
Originally Posted by kmanev073
so why just dont make a function that create thread and use hide module (so it wont be detected)... and actully i create my Dll main function...