Thread Checking

Hello guys,
Well i bypassed the thread killing but now i get hack tool bcs of not finished thread... i hooked some functions but i fucked my display driver when i injected...

So does some one know what scans the threads and which functions does it use ?

0o why not hooking TerminateThread and returning true xD ?

Originally Posted by pceumel

0o why not hooking TerminateThread and returning true xD ?

i return 0

but hack tool remains...

Originally Posted by pceumel

0o why not hooking TerminateThread and returning true xD ?

I was thinking of trying that myself.

Originally Posted by kmanev073

Hello guys,
Well i bypassed the thread killing but now i get hack tool bcs of not finished thread... i hooked some functions but i fucked my display driver when i injected...

So does some one know what scans the threads and which functions does it use ?

i´m not sure but they maybe patched (with the last xtrap update) the whole client gaps, my thread hook & d3d hook (hooked into the client) are detected ( it was undetected for more than one year, lol ) becouse of a noob on another forum whitch posted also an method to hook into the it.
But i don´t worry about this becouse a good friend told me that the xtrap-bypass is easy to update

Originally Posted by pceumel

0o why not hooking TerminateThread and returning true xD ?

hooking NtTerminateThread looks like going to make better results

you will need to use NtQueryInformationThread to check the thread id..
http://msdn.microsof*****m/en-us/libr...(v=vs.85).aspx

some useful shit:

Code:

typedef LONG NTSTATUS, CLIENT_ID, KAFFINITY,  KPRIORITY;

Code:

typedef enum _THREADINFOCLASS {

    ThreadBasicInformation,
    ThreadTimes,
    ThreadPriority,
    ThreadBasePriority,
    ThreadAffinityMask,
    ThreadImpersonationToken,
    ThreadDescriptorTableEntry,
    ThreadEnableAlignmentFaultFixup,
    ThreadEventPair,
    ThreadQuerySetWin32StartAddress,
    ThreadZeroTlsCell,
    ThreadPerformanceCount,
    ThreadAmILastThread,
    ThreadIdealProcessor,
    ThreadPriorityBoost,
    ThreadSetTlsArrayAddress,
    ThreadIsIoPending,
    ThreadHideFromDebugger

} THREADINFOCLASS, *PTHREADINFOCLASS;

Code:

typedef struct _THREAD_BASIC_INFORMATION {
  NTSTATUS                ExitStatus;
  PVOID                   TebBaseAddress;
  CLIENT_ID               ClientId;
  KAFFINITY               AffinityMask;
  KPRIORITY               Priority;
  KPRIORITY               BasePriority;

Code:

NTSTATUS WINAPI NtQueryInformationThread(
  _In_       HANDLE ThreadHandle,
  _In_       THREADINFOCLASS ThreadInformationClass,
  _Inout_    PVOID ThreadInformation,
  _In_       ULONG ThreadInformationLength,
  _Out_opt_  PULONG ReturnLength
)

{

    typedef NTSTATUS (WINAPI* __NtQueryInformationThread)(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
    static __NtQueryInformationThread _NtQueryInformationThread = NULL;

    if (!_NtQueryInformationThread)
    {
        HMODULE NtDll = LoadLibrary(TEXT("NTDLL.DLL"));
        if (NtDll)
        {
            _NtQueryInformationThread = (__NtQueryInformationThread)GetProcAddress(NtDll, "NtQueryInformationThread");
        if (!_NtQueryInformationThread) return 0;
        }
    }
    
    return _NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength);
}

Originally Posted by giniyat101

hooking NtTerminateThread looks like going to make better results

you will need to use NtQueryInformationThread to check the thread id..
NtQueryInformationThread function

some useful shit:

Code:

typedef LONG NTSTATUS, CLIENT_ID, KAFFINITY,  KPRIORITY;

Code:

typedef enum _THREADINFOCLASS {

    ThreadBasicInformation,
    ThreadTimes,
    ThreadPriority,
    ThreadBasePriority,
    ThreadAffinityMask,
    ThreadImpersonationToken,
    ThreadDescriptorTableEntry,
    ThreadEnableAlignmentFaultFixup,
    ThreadEventPair,
    ThreadQuerySetWin32StartAddress,
    ThreadZeroTlsCell,
    ThreadPerformanceCount,
    ThreadAmILastThread,
    ThreadIdealProcessor,
    ThreadPriorityBoost,
    ThreadSetTlsArrayAddress,
    ThreadIsIoPending,
    ThreadHideFromDebugger

} THREADINFOCLASS, *PTHREADINFOCLASS;

Code:

typedef struct _THREAD_BASIC_INFORMATION {
  NTSTATUS                ExitStatus;
  PVOID                   TebBaseAddress;
  CLIENT_ID               ClientId;
  KAFFINITY               AffinityMask;
  KPRIORITY               Priority;
  KPRIORITY               BasePriority;

Code:

NTSTATUS WINAPI NtQueryInformationThread(
  _In_       HANDLE ThreadHandle,
  _In_       THREADINFOCLASS ThreadInformationClass,
  _Inout_    PVOID ThreadInformation,
  _In_       ULONG ThreadInformationLength,
  _Out_opt_  PULONG ReturnLength
)

{

    typedef NTSTATUS (WINAPI* __NtQueryInformationThread)(HANDLE,THREADINFOCLASS,PVOID,ULONG,PULONG);
    static __NtQueryInformationThread _NtQueryInformationThread = NULL;

    if (!_NtQueryInformationThread)
    {
        HMODULE NtDll = LoadLibrary(TEXT("NTDLL.DLL"));
        if (NtDll)
        {
            _NtQueryInformationThread = (__NtQueryInformationThread)GetProcAddress(NtDll, "NtQueryInformationThread");
        if (!_NtQueryInformationThread) return 0;
        }
    }
    
    return _NtQueryInformationThread(ThreadHandle, ThreadInformationClass, ThreadInformation, ThreadInformationLength, ReturnLength);
}

i hooked in normal terinate thread... the thread is alive but it makes some strange CRC checksums i was wondering which function does it use... so i will make it allways return different value

today they detect the TerminateThread hooking -.- spy here?

Originally Posted by pceumel

today they detect the TerminateThread hooking -.- spy here?

what they really detect it ?
how :S

i hooked with simple e9 and today they detected it :/ ^^

Originally Posted by pceumel

i hooked with simple e9 and today they detected it :/ ^^

yea they really detected it i tried hooking it from external app but not worked

Hmm Injectors use CreateRemoteThread, if those are not detected....
Why not create an application that Hooks the game using CreateRemoteThread, then go on ur marry way

---------- Post added at 07:00 PM ---------- Previous post was at 07:00 PM ----------

OR
Try CreateRemoteThread

Originally Posted by topblast

xtrap is probably checking ZwCreateThread using the driver lol

Originally Posted by topblast

This is used before xtrap loads. The same way we use writeprocessmemory to write the path in memory.

Thread Checking

Post a Reply

Similar Threads

Tags for this Thread