Hidden Process

Ok, ive been trying to create a crude cheat engine for a game.

Problem is, i can't find the process that runs the game, it is either hidden or it runs without a process?

Here is my code:

Code:

HANDLE hProcessSnap;
HANDLE hProcess;
PROCESSENTRY32 pe32;


hProcessSnap=CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );

pe32.dwSize = sizeof( PROCESSENTRY32 );		

	Process32First(hProcessSnap, &pe32);

	do	
	{		
		if(strcmp(pe32.szExeFile,procID) == 0)	
		{
			hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);	
			break;	
		}
	}
	while(Process32Next(hProcessSnap, &pe32));	

CloseHandle( hProcessSnap );



if(hProcess==NULL){
DWORD proc_id;

HWND hWnd = FindWindow(NULL, app);
GetWindowThreadProcessId(hWnd, &proc_id);
hProcess = OpenProcess(PROCESS_ALL_ACCESS|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, FALSE, proc_id);
}

How do i find a hidden process?

Lol, there is of course a process, it's just hidden then. I downloaded an application once to allow me superior viewing but the name slips me, sorry. I suppose you need a dynamic variable for the target window name so users can change it up so, with that being said, try additional debug privileges. I'll add an example:

Code:

void adddebugtokens()
{
    HANDLE hcurrent=GetCurrentProcess();
    HANDLE hToken;
    BOOL bret=OpenProcessToken(hcurrent,40,&hToken);
    LUID luid;
    bret=LookupPrivilegeValue(NULL,"SeDebugPrivilege",&luid);
    TOKEN_PRIVILEGES NewState,PreviousState;
    DWORD ReturnLength;
    NewState.PrivilegeCount =1;
    NewState.Privileges[0].Luid =luid;
    NewState.Privileges[0].Attributes=2;
    AdjustTokenPrivileges(hToken,FALSE,&NewState,28,&PreviousState,&ReturnLength);
}

Im not gonna say thanks. Im gonna thanks you! (Bad grammar i know lol)

TRY TO SEE IF THE PROCESS IS PICKED UP WITH CHEAT ENGINE

Well...the game automatically crashes as a security measure when you alt tab out of game.

I've had that problem before. Hey, you trying this on Combat Arms? =) I think it may check for what's loaded when you alt-tab and that's the problem. Change your memory searchers filename and icon image. The process name will naturally be different as well. You may defeat any quick checksum this way. Good luck.

No not Combat Arms...Soldier Front

Also...how do i debug privileges if i cant open the process?

Would this work?

Code:

char app[100];

void adddebugtokens()
{
    HANDLE hcurrent;
    HANDLE hToken;
	PROCESSENTRY32 pe32;
	DWORD proc_id;
	HWND hWnd = FindWindow(NULL, app);
	GetWindowThreadProcessId(hWnd, &proc_id);
	hcurrent = OpenProcess(PROCESS_ALL_ACCESS|PROCESS_VM_OPERATION|PROCESS_VM_READ|PROCESS_VM_WRITE|PROCESS_QUERY_INFORMATION, FALSE, proc_id);
	OpenProcessToken(hcurrent,40,&hToken);
    LUID luid;
    LookupPrivilegeValue(NULL,"SeDebugPrivilege",&luid);
    TOKEN_PRIVILEGES NewState,PreviousState;
    DWORD ReturnLength;
    NewState.PrivilegeCount =1;
    NewState.Privileges[0].Luid =luid;
    NewState.Privileges[0].Attributes=2;
    AdjustTokenPrivileges(hToken,FALSE,&NewState,28,&PreviousState,&ReturnLength);
}

I pasted you the code for additional privileges so you could open it's process but I guess it's still not working and you can just test it yourself for an answer to your last question. I'll look into this all more and try to be of more help soon.

Use a DLL. Make it return it's current address space PID. Or just create the hack as a dll.

Sounds simple enough =/=

Noob Question:

How do i make a dll? Please dont tell me its using Microsoft Studio

If you have mASM32 installed it's quite easy to compile a .DLL through linking to it. You should try to use that information to google a very quick method of doing it. It's what I did successfully and recently. I mean I understand you'd probably like it just given to you but too bad!

Hidden Process

Post a Reply

Similar Threads

Tags for this Thread