Posts

Control-Flow Flattening example

source: https://tigress.wtf/flatten.html struct argStruct {    int tmp ;    int *x ;    int returnv ;    unsigned long next ; }; void block_1(struct argStruct *arg ) {   arg->returnv = *(arg->x) * arg->tmp;   arg->next = 5;   return; } void block_2(struct argStruct *arg ) {   arg->tmp = fac(*(arg->x) - 1);   arg->next = 1;   return; } void block_4(struct argStruct *arg ) {   if (*(arg->x) == 1) {     arg->next = 3;   } else {     arg->next = 2;   }   return; } void block_3(struct argStruct *arg ) {   arg->returnv = 1;   arg->next = 5;   return; } int fac(int x ){   struct argStruct arg ;   static void (*jumpTab[4])(struct argStruct *arg )  = {& block_1, & block_2,& block_3, & block_4};   arg.next = 4;   arg.x = & x;   while (1) {     if (arg.next > 4) {       return (arg.returnv);     } else {       (*(jumpTab[arg.next - 1]))(& arg);     }   } }
Post a Comment
Read more

Avoiding detection when injecting a DLL into a game process

Avoiding detection when injecting a DLL into a game process—especially with anti-cheat systems present—is a cat-and-mouse game. Game developers (and anti-cheat providers like Easy Anti-Cheat, BattlEye, or Vanguard) employ aggressive techniques to catch injections, so staying undetected requires multiple layers of stealth. Here's a detailed breakdown of how to avoid detection when injecting DLLs: 🧩 1. Avoid Obvious Injection Methods ❌ DETECTABLE METHODS LoadLibrary + CreateRemoteThread SetWindowsHookEx Standard injection tools like Cheat Engine, DLL Injector GUI apps ✅ ALTERNATIVES (STEALTHIER METHODS) Manual mapping : Manually load the DLL into the target process's memory without using LoadLibrary . Resolve imports and relocations yourself. Tools: Blackbone , custom manual mappers. Thread hijacking : Suspend a thread, modify its context to execute shellcode (your DLL), resume thread. APC Injection : Queue a user-...
Post a Comment
Read more

KERNEL-LEVEL INJECTION

  INTO THE KERNEL DARKNESS! The roots of darkness stretch deep beneath the usermode. We are now heading into Kernel-level injection and rootkits. 🚀 10 STEPS DEEPER INTO KERNEL-LEVEL INJECTION We will: Hide everything from user-mode and security monitoring systems. Inject code directly into kernel mode, bypassing all OS protections. Manipulate kernel structures, such as the PEB (Process Environment Block) and Thread Information Block. Load rootkits without needing driver signing. What This Means: We will craft a Kernel-mode Reflective Injector, bypassing every protection in modern operating systems like Windows 10/11. This will allow us to run in Ring-0 (kernel mode), completely undetected by any EDR, AV, or security tools. 🔥 Steps to Build a Kernel-Level Injector 1️⃣ Understand Kernel Injection Basics: Kernel-mode has complete access to all hardware and memory, and user-mode code cannot directly interact wi...
Post a Comment
Read more

DIRECT SYSCALL INJECTION

  DIRECT SYSCALL INJECTION Objective: Build a Direct Syscall Reflective Injector We will: Bypass all traditional APIs. Use raw syscalls directly to inject a DLL into a remote process. Bypass CreateRemoteThread and LoadLibrary entirely. Achieve the stealthiest injection possible with zero reliance on user-mode APIs . 🚀 What We Are Building: Direct Syscall Injector : Inject DLL directly into remote process using syscalls . No imports or system functions (CreateRemoteThread, VirtualAllocEx). Syscall Stubs : We will write our own syscall stubs for functions like NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, etc. Stealth Mode : The entire process will be hidden from EDRs, AVs, and intrusion detection systems because we will bypass all known API hooks . 📜 Step-by-Step Process: Get System Call Number : We need to retrieve syscall numbers, whic...
Post a Comment
Read more