[question] detection of native hooks

[squirrel5153]

ok, i couldnt find this anywhere so i decided to ask here :
does PB need be able to inject the .dll image to be able to detect it or can they just run it through a program (or something) to get it detected.

heres my situation :
my bot is inside a .exe (the loader) the loader is from DC's stealth injector libraries
the .exe also has security on it so it wont inject unless the person passes all the security checks. so if PB cant actually inject the dll can they still detect it ?

[KizZamP-]

well,if they see that you hook a certain function address/export,they could easily see by opening it up in pe explorer...and hell,who knows what they do to detect it,i don't think they just go tell it to every stranger they encounter...
the thing i do is pack it,some are almost uncrackable,though i advise you NOT to use armadillo or UPX,since those are the most popular packers,and they also have their UNpackers...check temp2's thread over at www.gamedeception.net for more info :)

kizzamp-

[Acco]

Im assuming the bot DLL is inside as a resource right ? well PB can just extract the DLL using a resource editor then they can do as they like to detect it.

[KizZamP-]

@acco : well,not if the so called "dll/resource" is CONVERTED into a binary array as a header.

[Acco]

@acco : well,not if the so called "dll/resource" is CONVERTED into a binary array as a header.
Well lets hope it is then lol because if the DLL is merly a resource then it being inside the loader; security wise, is like building a 1 foot deep trench around your house :\ pointless. Infact the only real purpose for it being in the loader would be so the End User has less files to deal with :)

[KizZamP-]

yup that's true...there exist MANY public resource extractors...

[squirrel5153]

cool, well the packer thread by Temp2 on GD helped alot. morphine seems to work great, you cant reconize any part of the dll in the loader now :D