Posts

Showing posts from May, 2025

Control-Flow Flattening example

source: https://tigress.wtf/flatten.html struct argStruct {    int tmp ;    int *x ;    int returnv ;    unsigned long next ; }; void block_1(struct argStruct *arg ) {   arg->returnv = *(arg->x) * arg->tmp;   arg->next = 5;   return; } void block_2(struct argStruct *arg ) {   arg->tmp = fac(*(arg->x) - 1);   arg->next = 1;   return; } void block_4(struct argStruct *arg ) {   if (*(arg->x) == 1) {     arg->next = 3;   } else {     arg->next = 2;   }   return; } void block_3(struct argStruct *arg ) {   arg->returnv = 1;   arg->next = 5;   return; } int fac(int x ){   struct argStruct arg ;   static void (*jumpTab[4])(struct argStruct *arg )  = {& block_1, & block_2,& block_3, & block_4};   arg.next = 4;   arg.x = & x;   while (1) {     if (arg.next > 4) {       return (arg.returnv);     } else {       (*(jumpTab[arg.next - 1]))(& arg);     }   } }

Avoiding detection when injecting a DLL into a game process

Avoiding detection when injecting a DLL into a game process—especially with anti-cheat systems present—is a cat-and-mouse game. Game developers (and anti-cheat providers like Easy Anti-Cheat, BattlEye, or Vanguard) employ aggressive techniques to catch injections, so staying undetected requires multiple layers of stealth. Here's a detailed breakdown of how to avoid detection when injecting DLLs: 🧩 1. Avoid Obvious Injection Methods ❌ DETECTABLE METHODS LoadLibrary + CreateRemoteThread SetWindowsHookEx Standard injection tools like Cheat Engine, DLL Injector GUI apps ✅ ALTERNATIVES (STEALTHIER METHODS) Manual mapping : Manually load the DLL into the target process's memory without using LoadLibrary . Resolve imports and relocations yourself. Tools: Blackbone , custom manual mappers. Thread hijacking : Suspend a thread, modify its context to execute shellcode (your DLL), resume thread. APC Injection : Queue a user-...