|
Lsass injection code
#include "stdafx.h" using namespace std; DWORDLONG STATUS_INFO_LENGTH_MISMATCH; typedef NTSTATUS(NTAPI* NtQuerySystemInformationFn)(ULONG, PVOID, ULONG, PULONG); static HANDLE GetProcessHandle(uint64_t targetProcessId) auto NtQuerySystemInformation = reinterpret_cast auto handleInfo = reinterpret_cast while ((status = NtQuerySystemInformation(SystemHandleInformation, handleInfo, handleInfoSize, nullptr)) == STATUS_INFO_LENGTH_MISMATCH) if (!NT_SUCCESS(status)) for (auto i = 0; i < handleInfo->HandleCount; i++) const auto process = reinterpret_cast free(handleInfo); return nullptr; if (Process32First(snapshot, &pe)) { Can Someone tell me what is the problem with these PSYSTEM_HANDLE_INFORMATION I dont understand what can i do to make it work like i define it or what sorry i am noob + after that what should i do just cout and how should i get the game info like just these ->
Sorry guys these is my first bypass and i want to make it to work any help from you would be so much appreciated +Thanks in advance 🙂
scimmy: I’m going to assume that you have not done this research, so I will lay it out as spoonfeedable as possible. 1. You’re interested in the handles that lsass.exe gets access to, presumably, because your game anti-cheat does not strip the access bits of its handles. 2. You want to enumerate these handles by using which returns you a pointer to a SYSTEM_HANDLE_INFORMATION struct. 3. I did a google search and found this struct definition: typedef struct _SYSTEM_HANDLE_INFORMATION 4. Great. Now you know how to enumerate the handles of the system. As shown in the code you pasted, there exists a for loop that iterates HandleCount number of times over the SYSTEM_HANDLE array. Accessing each of these handles allows you to figure out the PID and GrantedAccess flags of the handle you are currently iterating over. 5. Do a simple PID check to see if the handle you are looking at matches the game’s PID. You can figure out the game’s PID by using the CreateToolhelp32Snapshot API call. Then, you will want to make sure that the GrantedAccess value matches what you want (probably at least VM_READ | VM_WRITE). 6. Now you can use that handle that you found which matches your criteria, and RPM/WPM to all your liking. This method is heavily documented and all source code to make it work has been posted everywhere. That being said, I would suggest you understand how to program before tackling something like this. |
|