Cheat Engine

[iPromise]

hey guys,

Recently i've been working on my driver and i've been brainstorming and testing ways on how to inject my library into a usermode application through a kernel mode driver.

Apparently, if I allocate and write my dll pathway in my process with my driver and call CreateRemoteThread it would work, but unfortunately CreateRemoteThread is hooked. I tried doing a basic hookhop to override a possible local hook on the function but it failed.

After that I decided to use PsCreateSystemThread to see if I can create a thread to loadlibrary with my kernel mode application but unfortunately, that function is only applicable for functions within the drivers address space. I would grab the address of LoadLibraryA with my usermode application and pass it to my driver, which then creates a thread but that doens't work.

So now i'm stumped with no idea on how I will inject my library. I do have access to the memory of an application and I can do a code injection on a specific function being called, and attempt to get my thread created there but there are constant CRC checks.

Can anybody help me out?

[Dark Byte]

you could try hooking the timer interrupt
When it triggers and it's inside your target process adjust the stack.
Make the return address of the interrupt call point to your injected usermode code, so when iret is called by the original interrupt handler it will jump to your function instead of the original code.

To be able to return to the original state of the usermode thread that got interrupted you will need to store some data.
The best spot would be to use the usermode's ESP address and decrease it with the amount of data you're going to save. (registers, floatdata if you use it, correct return address, etc...)

Tip: Make sure your code only runs once.

It of course requires at least one active thread.

--

You could also try using APC's (again, requires a thread that is executing/awake)