Quote:
Originally Posted by Excellio
[You must be logged in to view images. Log in or Register.]
Good point. The thing that gave up those who were allegedly hacking, is that thing a specific fingerprint of prohibited 3rd party programs? Is it possible that such a fingerprint might exist for other reasons, like hacking on another game, or hacking on your live account or something?
|
No, they're just checking your EQGame.exe to see what other files might have been injected.
Here, from Wikipedia;
In computer programming, DLL injection is a technique used to run code within the address space of another process by forcing it to load a dynamic-link library.[1] DLL injection is often used by third-party developers to influence the behavior of a program in a way its authors did not anticipate or intend.[1][2][3] For example, the injected code could trap system function calls,[4][5] or read the contents of password textboxes, which cannot be done the usual way.[6]
http://en.wikipedia.org/wiki/DLL_injection
Quote:
There are at least four ways to force a program to load a DLL on Microsoft Windows:
DLLs listed under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs will be loaded into every process that links to User32.dll as that DLL attaches itself to the process.[5][7][8][9]
Process manipulation functions such as CreateRemoteThread can be used to inject a DLL into a program after it has started.[5][6][10][11][12][13]
Get a handle to the target process. This can be done by spawning the process[14][15] or by keying off something created by that process that is known to exist – for instance, a window with a predictable title,[16] or by obtaining a list of running processes[17] and scanning for the target executable's filename.[18]
Allocate some memory in the target process,[19] and the name of the DLL to be injected is written to it.[10][20]
This step can be skipped if a suitable DLL name is already available in the target process. For example, if a process links to ‘User32.dll’, ‘GDI32.dll’, ‘Kernel32.dll’ or any other library whose name ends in ‘32.dll’, it would be possible to load a library named ‘32.dll’. This technique has in the past been demonstrated to be effective against a method of guarding processes against DLL injection.[21]
Create a new thread in the target process[22] with the thread's start address set to be the address of LoadLibrary and the argument set to the address of the string just uploaded into the target.[10][23]
Instead of writing the name of a DLL-to-load to the target and starting the new thread at LoadLibrary, one can write the code-to-be-executed to the target and start the thread at that code.[6]
The operating system will now call DllMain in the injected DLL.[10][24]
Note that without precautions, this approach can be detected by the target process due to the DLL_THREAD_ATTACH notifications sent to every loaded module as a thread starts.[24]
Windows hooking calls such as SetWindowsHookEx.[2][5][6][25][26][27]
Use the debugging functions to pause all threads, and then hijack an existing thread in the application to execute injected code, that in turn could load a DLL.[4][28][29]
|
08-27-2011, 07:51 PM
Linear Mode
