Using rootkits to hide a process.

[CracKPod]

Hey, I was just wondering if thats really still possible.
I read a thread about using Hxdef to hide Cheat Engine and
Co. but that thread is about a year old.

That isnt really possible anymore, is it?

[cuteharez]

Rootkit no longer tricks any anti-cheat programs. And this should go to the
Anti-Cheat Program Discussion section.

[CracKPod]

Thank you.

[MapGenCreator]

Rootkit no longer tricks any anti-cheat programs. And this should go to the
Anti-Cheat Program Discussion section.

Not nescessary. Depends if you are writing a rootkit in kernel mode or user mode. If you write a kernel rootkit, you can completely hide the rootkit and the process (from anything in user mode) by intercepting enough system calls and since a user mode application cannot read kernel mode memory, it makes checksums impossible on the rootkit code. However if the anti-cheat writes its own code within kernel, then it is harder to protect the rootkit.

This is the concept as to why anti-viruses implement their main scanning core within a driver (.sys) file within kernel. If they were all written from user mode, they would be doomed.

[Undergamer]

One cool thing you should keep in mind are techniques like Bluepill or Bootroot. The advantage of using KVM is that you can intercept punkbuster calls direct to hardware and return bogus results. :) The ultimate anti-hw ban workaround will be a KVM (or a paravirtualized vm).

[screen317]

I hope you all realize...

If someone in the anti-cheat world were to catch on to this, GameGuard and other anti-cheats would implement anti-rootkit tools (can you say Catch-me from Gmer?), therefore rendering your rootkit identified and disabled.

[atlantisx]

you can always use / write your own kernel driver and add this
http://www.vitoplantamura.com/index.aspx?page=readwriteprocmem