 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
kot1990
Expert Cheater
 Reputation: 1
Joined: 06 Sep 2009
Posts: 131
Location: Greece
|
 Posted: Sat Dec 24, 2011 9:58 am Post subject: Hidden process , how??? |
 |
|
Well I am playing an online game where the main executable is launched by a protection launcher, but what happens is that when the createprocess() call is made to create it, the main executable is not in the task manager, none of the ulilities like process explorer, WPE PRO, or cheat engine can find it. Help me please. When the game is launched, I can close the laucher and the game continues to play normally so its not injected or something similar, cause it takes up to 500-700MB of ram and no process in the task manager takes so much memory :S  I can give you some clues about the call and the parameters..
|
|
| Back to top |
|
 |
xeratal
Advanced Cheater
![]() Reputation: 1
Joined: 05 Nov 2005
Posts: 93
|
| Posted: Sat Dec 24, 2011 10:16 am Post subject: |
|
|
Cheat engine -> Process list -> Process watch
(You might need to enable it by -> Settings -> Extra -> Enable process watcher
|
|
| Back to top |
|
|
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25830
Location: The netherlands
|
| Posted: Sat Dec 24, 2011 10:29 am Post subject: |
|
|
And run ce before the game starts
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
kot1990
Expert Cheater
Reputation: 1
Joined: 06 Sep 2009
Posts: 131
Location: Greece
|
| Posted: Sat Dec 24, 2011 10:45 am Post subject: |
|
|
| xeratal wrote: | Cheat engine -> Process list -> Process watch
(You might need to enable it by -> Settings -> Extra -> Enable process watcher |
haha  , that did work , but I need to make it visible in other programs also, do I have to change the way the creation call is made? I found the call, here it is:
| Code: |
CreateProcessW 0x7c802336 0x00002336 103 (0x67) kernel32.dll C:\WINDOWS\system32\kernel32.dll Exported Function
CPU Stack
Address Value ASCII Comments
00DFFBA4 /00000000 .... ; ApplicationName = NULL
00DFFBA8 |00BBDE60 `. ; CommandLine = ""..\system\l2.exe" account=abcdefg password=abc-defghi"
00DFFBAC |00000000 .... ; pProcessSecurity = NULL
00DFFBB0 |00000000 .... ; pThreadSecurity = NULL
00DFFBB4 |00000000 .... ; InheritHandles = FALSE
00DFFBB8 |08000004 .. ; CreationFlags = CREATE_SUSPENDED|CREATE_NO_WINDOW
00DFFBBC |00000000 .... ; pEnvironment = NULL
00DFFBC0 |00BBA9D8 ة. ; CurrentDirectory = "..\system\"
00DFFBC4 |00DFFC6C l. ; pStartupInfo = 00DFFC6C -> STARTUPINFOW {Size=68., Reserved1=NULL, Desktop=NULL, Title=NULL, X=0, Y=0, Width=0, Height=0, XCountChars=0, YCountChars=0, FillAttribute=0, Flags=0, ShowWindow=SW_HIDE, Reserved2=0, Reserved3=NULL, hStdInput=NULL, hStdOutput=N
00DFFBC8 |00DFFCDC . ; pProcessInformation = 00DFFCDC -> PROCESS_INFORMATION {hProcess=NULL, hThread=NULL, ProcessID=0, ThreadID=0}
|
EDIT: Well, I tried to change the
CreationFlags = CREATE_SUSPENDED|CREATE_NO_WINDOW
to
CreationFlags = CREATE_NEW_PROCESS_GROUP 0x00000200
and ShowWindow=SW_HIDE
ShowWindow=SW_SHOW.
The process now runs and is not suspended but is still invisible in process list. Maybe it inherits something from its parent laucher ?
Forgot to mention that the process starts suspended and then a call to ReleaseThread() is made to resume the process.
I put instead of l2.exe , the calculator and renamed it to l2.exe , and it when CreateProcessW is executed the calculator runs just fine but there's no l2.exe in the process list :S. I did this to make it more clear.
|
|
| Back to top |
|
|
Kavvman
Master Cheater
![]() Reputation: 2
Joined: 17 Apr 2004
Posts: 316
|
| Posted: Sat Dec 24, 2011 12:06 pm Post subject: |
|
|
The parent process could be hiding it using rootkits or something like that. Why don't you attach to the window instead or that is invisible too.
_________________
... |
|
| Back to top |
|
|
kot1990
Expert Cheater
Reputation: 1
Joined: 06 Sep 2009
Posts: 131
Location: Greece
|
| Posted: Sat Dec 24, 2011 12:25 pm Post subject: |
|
|
| Kavvman wrote: | | The parent process could be hiding it using rootkits or something like that. Why don't you attach to the window instead or that is invisible too. |
The window is visible, but what I want to do is to use WPE PRO to edit a packet and send it but WPE doesn't have find process by window function but it seems I 've found a solution to this. The launcher will not call directly l2.exe but first will launch my own process which creates the real l2.exe and it seems to be working . My process becomes hidden but l2.exe created by my process is visible.
| Code: |
#include <windows.h>
#include <stdio.h>
int main(int nNumberofArgs, char* pszArgs[])
{
for (int i=1; i<nNumberofArgs; i++)
{
printf("%s",pszArgs[i]);
}
char exename[100];
STARTUPINFOA si = { 0 };
PROCESS_INFORMATION pi;
si.cb = sizeof(STARTUPINFOA);
wsprintfA(exename,"D:\\Games\\L2_GOD_RU_CLIENT\\system\\l2.exe %s %s",pszArgs[1],pszArgs[2]);
int res = CreateProcessA(0,exename,0,0,FALSE,NORMAL_PRIORITY_CLASS,0,0,&si,&pi);
int error = GetLastError();
if (!res)
{
printf("%d",error);
getchar();
}
}
|
Now I have to change the call made by the launcher so it launches my process.
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
