Taiga74164 / SLA-Cheeto

Solo Leveling:ARISE Cheat
GNU General Public License v3.0
160 stars 586 forks source link

seeking informations #25

Closed ELJoOker2004 closed 4 months ago

ELJoOker2004 commented 4 months ago

can i ask you about the logic of this program? what is dll proxying and how do you make the game auto-load this dll. I'd really be grateful if you mentioned any sources that talk about this topic

ELJoOker2004 commented 4 months ago

because the unknowncheats forum was closed, I didn't find another place to ask, sorry if this isn't the suitable place to ask about this

emoisback-again commented 4 months ago

dll proxying , is you make a proxy between dll that game loaded..

Game need to load winhttp.dll, because its try to find at the same folder as exe first and not found, they tried to find it on windows system32 folder and load it, what you do, you proxied the dll by place dll same as exe folder, so when he tried to find needed dll at the same folder its found, then you dll load original needed dll and export it function to let game use original function through your dll..

ELJoOker2004 commented 4 months ago

dll proxying , is you make a proxy between dll that game loaded..

Game need to load winhttp.dll, because its try to find at the same folder as exe first and not found, they tried to find it on windows system32 folder and load it, what you do, you proxied the dll by place dll same as exe folder, so when he tried to find needed dll at the same folder its found, then you dll load original needed dll and export it function to let game use original function through your dll..

so basically we recreate the winhttp.dll with all it's functions but we add other functions so we can use also right?

ELJoOker2004 commented 4 months ago

that actually looks undetectable, why don't we see this technique used much?

emoisback-again commented 4 months ago

it is detectable, just see what dll that exe loaded and find where it come from, not from system32 then its a hack,.

Dreant910 commented 4 months ago

bro use google its your friend not here

ELJoOker2004 commented 4 months ago

bro use google its your friend not here

where is the problem in asking? i already searched google and got the concept but I needed further info

ELJoOker2004 commented 4 months ago

it is detectable, just see what dll that exe loaded and find where it come from, not from system32 then its a hack,.

can't we just do the same by kernel32.dll?

emoisback-again commented 4 months ago

you can do with any dll that have export function and have a vulnerable on the exe loading it not absolute path to system32

Taiga74164 commented 4 months ago

@ELJoOker2004 you seem familiar 💀

ELJoOker2004 commented 4 months ago

@ELJoOker2004 you seem familiar 💀

I'm an old fan XD, didn't know you will remember