New Injection Method 11.2.0

[Van152]

So, till the new patch i could not inject into wow.exe process.
I use a kernel mode manual map injector with new thread creation. I also tried thread hijacking in usermode but somehow the new thread got suspended (on the kernel injector) or the dll just didnt run.
does someone have similiar problems and found a fix for it? or can give me some hints to fix that problem?
I usually hide the created thread directly using VAD from the kernel.

[Sdelp]

Eidolon is hooking NtCreateThread

[Van152]

Eidolon is hooking NtCreateThread

yeah well, this does not explain why even the thread hijack does not work

[numerbo]

yeah well, this does not explain why even the thread hijack does not work

it does.

even load library injector works.

[Van152]

I tried SetWindowHookEx, LoadLib, Kernel ManualMap with threadhijacking, and it doesnt worked, i saw in a different thread here, that i t xould be the dependemcies probably of the DLL i want to inject, these have to be preloaded from the targetproc/Wow.exe 🤔

Could this be a thing? If so, I probably have to recode my whole unlocker i guess 😭

[Van152]

finally i got it working!
thanks for your help guys!

now i face a new issue, since Eidolon is encrypting the Memory Pages, i need to find the eidolon gadget in IDA and decrypt the pages, but is there any unpacker for wow out there that is working?