-
Notifications
You must be signed in to change notification settings - Fork 57
Description
I work with old version 'cause don't know how to use this newer version with HookLibrary,
It works, says 'Injected', but how can i dump the file using newer version ?
Working normally someday...
and with only once update in one anti-cheat i can't dump this file now
(yes, i'm trying to defeat some anticheat and thanks to scylla
that let me understand the source of it COMPLETELY)!
Well, i was using ScyllaHide 0.9.7c and were working normally.
The first problem looks like the .exe are hiding himself from process list (O.O). Before this function worked so bad. Now is refined.
I need to use ProccessExplorer to pause the proccess and then HOOK IT, and i need to be faster or else it can be some proccess of somekind of API (C++, i doesn't understand) such as InternalProccess or really 'hiding' ??
The second is, when i pause it and hook it, the exe dump, that must be decrypted at this part, keeps as encrypted.
Looking better, i know so less of scylla, but it uses PEB, and well i guess this peb address was hidden.
I tried to check if they hidden the PEB using the attach function in ollydbg, to get live peb ?but here happens :
if process.exe is paused, i can attach with olly, or else ATTACH is detected misses from the proccess list ? i dunno.
Can i bypass it using newer ScyllaHidev1.2/1.3 version ?