Cheat Engine

Synapse · Posted: Mon Apr 24, 2006 4:46 pm Post subject: OpenProcess() Hooked

I know CE has been able to fix this problem (by using the kernel somehow), so what would I do (in psuedo code) to be able to pass by a hook on OpenProcess() down to the SDT entry?

I tried SYSCALLing it, but unfortunately it seems the hooking service operates even beyond that - which is beyond my knowledge.

And the lack of nt kernel documenation is disheartening...

Dark Byte · Posted: Tue Apr 25, 2006 12:56 am Post subject:

you could save the original address of ZwOpenProcess in the SDT and when you wsant to call ZwOpenProcess you qickly set it back, call it and then restore back to the original.

Another method would be using ObOpenObjectByPointer and open the process by using the peprocess

Also, even if openprocess fails ce can still read/write the memory (uses the peprocess, not a handle)

Synapse · Posted: Tue Apr 25, 2006 3:13 am Post subject:

Interesting... Hmm - Thanks DB.

And #1 would probably work as the protection method I'm conquering I believe only sets it back after it's been called, and it "sees" that it's wrong (? lol).

And #2 might be a better option, of course if #1 fails ;P

hack0r · How do I cheat? Reputation: 0 Joined: 03 Sep 2007 Posts: 6

did u fix this problem? how?