Cheat Engine

rapion124 · Posted: Sat Jun 14, 2008 1:19 pm Post subject: [RLS] CreateProcessHook Beta

I just started on a small project. It's called "PMon." It's going to be a usermode process monitor. It monitors a process via hooking. This is only the start. Right now, it hooks CreateProcess(A/W) and notifies you via DebugView of any new processes created.

To use: Inject into any process you wish to monitor.

If you find any bugs, just post here.

Cx · Posted: Sat Jun 14, 2008 6:16 pm Post subject:

This is actually pretty nice.
I like your style of coding.

Flyte · Posted: Sun Jun 15, 2008 1:02 am Post subject:

Zand · Posted: Sun Jun 15, 2008 1:39 am Post subject:

I've managed to define things after includes.

Zand · Posted: Sun Jun 15, 2008 4:18 am Post subject:

Right. I'm just saying you don't have to have define before includes, except for certain things ie. lean & mean

rapion124 · Posted: Sun Jun 15, 2008 11:50 am Post subject:

I'm still working on it. Next version will have a way to unload the DLL and a GUI control application.

I'll look into Microsoft's Detour library.

How do I fix the problem of it not working before XP SP2? The preamble is only 3 bytes instead of the 5 on SP2.

Ferocious · Posted: Sun Jun 15, 2008 11:55 am Post subject:

#if (WINVER =< 400) ?

Cx · Posted: Sun Jun 15, 2008 5:18 pm Post subject:

rapion124 · Posted: Sun Jun 15, 2008 6:32 pm Post subject:

I know there's 2 bytes less on pre-SP2, but how do I fix it? I don't wanna write a whole new routine to hook especially for pre-SP2. For example, I would have to disassemble the command(s) after mov ebp, esp and copy that to my trampoline proc.