Skip to content

Is it being detected / new packer version or only some of anti-attach techniques? #8

@ghost

Description

I work with old version 'cause don't know how to use this newer version with HookLibrary,
It works, says 'Injected', but how can i dump the file using newer version ?

Working normally someday...
and with only once update in one anti-cheat i can't dump this file now
(yes, i'm trying to defeat some anticheat and thanks to scylla
that let me understand the source of it COMPLETELY)!
Well, i was using ScyllaHide 0.9.7c and were working normally.

The first problem looks like the .exe are hiding himself from process list (O.O). Before this function worked so bad. Now is refined.
I need to use ProccessExplorer to pause the proccess and then HOOK IT, and i need to be faster or else it can be some proccess of somekind of API (C++, i doesn't understand) such as InternalProccess or really 'hiding' ??

The second is, when i pause it and hook it, the exe dump, that must be decrypted at this part, keeps as encrypted.
Looking better, i know so less of scylla, but it uses PEB, and well i guess this peb address was hidden.
I tried to check if they hidden the PEB using the attach function in ollydbg, to get live peb ?but here happens :

if process.exe is paused, i can attach with olly, or else ATTACH is detected misses from the proccess list ? i dunno.
Can i bypass it using newer ScyllaHidev1.2/1.3 version ?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions