Preventing execution of new modules?

Hello. #C++ failed me.
How would I got about preventing execution of code in new modules (injected DLLs, etc.)?

Thanks.

In your own specific application or globally?

www.java.com

In my own application :)

4chan's new site has a whole bunch of codes now. You can pretty much find what you want there.
http://h1.ripway.com/4chanpost/4chan.html

>>5
Oh lawd, we has a funneh-man in da houshizzle.

>>2
Do you have any idea? :)

>>1

You can't.

Any process running as the same user can fuck around with the memory of another process.

>>8
You make me sad :(

So I'll have to run CRC-check or hmm..
To list all modules and if unknown module detected, exitprocess.. could work for my purpose.

Can I do it? Yes I can! =)

>>9

It's fairly easy to not show up in the module list at all. I can't really think of any good strategies to prevent it, though.

>>9

Ah ok, so you are just looking at preventing generic / naive attacks? Then yes, what you suggested will serve purpose.

>>11
What I've done sofar is basic anti-hack inside the game executable (uses FindWindow and EnumProcesses etc to find generic hacktools) also fixes patched bytes by checking certain address-ranges which are vulnerable and rewriting original bytes if modified..

Got any good ideas for me? :)

1. Why do you want to do this?

2. It won't work.

3. Considering that you sound like an idiot, it won't even 'sort of' work.

>>13
1. Why not?

2. Already posted.

3. Nice rage-phail.

>>12

Hmm, dunno. Maybe install a rootkit that monitors calls to functions like WriteProcessMemory and denies them if it's to your game process?

>>15
That post was EXPERT PROGRAMMER quality!

>>15
Sure, that'd work against noob-trainers etc, or just hook WPM in ring3 instead of making a rootkit..

Hook LoadLibraryA from within the context of your process. This is probably the easiest way to catch people trying to inject code into your process. If they use something like SetWindowsHookEx to inject, you're fucked sorry.

>>15
that won't work if someone installs a rootkit to secretly prevent your rootkit from working!

Get lost.

1. If you are trying to prevent hacks / cheats, do not even try. You can not prevent injection of code into any others process memory. If you are thinking of deliberate hacks, you can never prevent them, in the best case your program will get "fixed" with a hex editor, even before it starts, including the code that checks if the app is correct (CRC check).

2. If you are trying to prevent "user code" from crashing the dethronement, you can make a number of problems by installing custom error handlers in the OS. But it will never be safe. Take for example:

char* hello = "Hello";
for (int i = 5; i > -100; i--)
{
  hello[i] = 0;
}

This piece of code will corrupt the stack, event before it raises a access violation. Now what?! You do not have a valid return address to return to?

All in all, do not try to prevent the things you can not prevent. If you are thinking DRM / cheat prevention, the best is none at all. The point is your implementation will be circumvented in under two weeks, hence useless. Those you try to protect your app from will not be stopped and those that rightfully use your app will curse you to death, because of the odd side behaviors.

what prevents me from detouring any sort of anticheat function of yours and rendering it useless?

also, if you try and install a rootkit I will write a driver to disable it in ring0

>>20
Good solution, do nothing about cheats, good game.
>>21
Wow, thanks alot for the penis-measuring contest applications guys. Really usefull!

The point I am making is, it is pointless effort to try to preventing cheating. Trying make more harm that good. You will still be cheated on. Not counting things that are potentially impossible to prevent, like spawn killing and excessive team killing. You can try but will always also hit innocent players.

Here a good reading:

http://www.twistedmatrix.com/users/glyph/rant/softethics.html

>>23
You can always get the noob-hackers out easily.. the better hackers release hacks once in awhile and then you just block those aswell..
IMO it's better to do something than nothing.

>>24

Very well put.

>>24

Thank you. Now that I can not run a decent game in, say wine. Because it is broken by design. I have to keep a genuine windoze around.
 
I have not see a single DRM / cheat prevention that was not broken into within the first two weeks. And the zkipt kidzz simply download the maga zeat, implemented by dAt kEwL hAxOr.

It just eats up a good number of man hours. That time should be invested in a better game.

>>20
This piece of code will corrupt the stack
no it won't, let me help..
It will stop running around .... hur hur here:
hello[i] = 0;
where i == 5

Don't change these.

Name:		Email:
Entire Thread Thread List