DLL Hiding

[namreeb]

Hahahahahahahahahaha

[Apoc]

I think I just shit myself laughing.

Rofl. The compiler IS good at optimizing. However; human intervention can quite often make that optimization many times better. (Eg; inlining functions)

Stop being a damned retard, and actually go read up on what inlining is actually used for, then find some DECENT examples. Next time I see you post some stupid shit like that; it's going to be infractions. (Also; asking a GameDev.net's late-hour group on IRC about stuff like that [and getting only 2 other idiots agreeing] is by no means any form of agreement. Go ask an MS developer, or any of the *nix contributors.)

[flo8464]

Lets see what 2girls1dog.com has to say about you:

[23:33] <Rambo666> I know where your house lives !
[23:33] <K1ll4> My cat is a dog lol
[23:33] <flo8464> Yo guyz what do you think about inlining and Dmxsbb ?
[23:34] <M0nsterc0ck> Me heared this is very good really
[23:34] <Boobs4free> Get your free XXX pass at OpenDNS FOR FREE !
[23:34] <K1ll4> Cool a free XX pass
[23:34] <Rambo666> Inlining is good and the compiler still decides if it makes sense to inline smth
[23:34] <AmazingHorse> Yeah, he is a retard !

Srsly.

[namreeb]

I think I just shit myself laughing.

Rofl. The compiler IS good at optimizing. However; human intervention can quite often make that optimization many times better. (Eg; inlining functions)

Stop being a damned retard, and actually go read up on what inlining is actually used for, then find some DECENT examples. Next time I see you post some stupid shit like that; it's going to be infractions. (Also; asking a GameDev.net's late-hour group on IRC about stuff like that [and getting only 2 other idiots agreeing] is by no means any form of agreement. Go ask an MS developer, or any of the *nix contributors.)

<- is a freebsd kernel developer.. and yeah that guy is wrong.

[Cypher]

Cypher, Inlining functions are stupid, and shouldnt even be used. If you look at the code at the top where the #defines are, the preprocessor commands, you should try to avoid using those, and they can sometimes cause errors. My apologies for offending you in anyway?

You're retarded.

Whilst I've stated over and over again in this section that premature optimization is evil, marking functions as inline doesn't always come under this umbrella.

The compiler isn't always right, and often giving it a nudge in the right direction can give it a performance boost.

Besides, marking a function as inline doesn't even mean it will actually get inlined, it's just a SUGGESTION to the compiler. If the compiler disagrees, it will just ignore your suggestion. Most compilers have a __forcinline or similar keyword, but that's a diferent story altogether.

Sometimes code MUST be inlined in order for it to work, other times it must NOT be inlined. You've obviously never really worked on low level projects before that require a certain degree of control over the resulting binary code.

Furthermore, inline functions are the only way to pull off certain library 'tricks' such as header-only libraries.

Lastly, yes, macro's are evil, but you don't seem to understand why. In all your posts you just seem to be spouting a bunch of stuff to try and make yourself seem intelligent, when in fact most of it makes little sense.

Unless you actually know what you're talking about, it's probably best you just sit in the corner and shut the **** up.

[Dmxsbb]

[edited by admin because dmxsbb is leet undercover]

[kynox]

[edited by admin because dmxsbb is leet undercover]

Typical retort of someone who's been publicly humiliated beyond come back.

Good day to you sir.

*edit*

Pro, he changed his post. It was "Cypher, when was the last time you touched a pair of titties?"

[Cypher]

Ahahaha.

Let me grab my 'Retard to English' dictionary... Hrm yep, just as I expected, that translates to "I can't make a response on an intellectual level so I'm going to start projecting in order to try and mask my failure".

[Cypher]

I present to you:
WinNinja Module Hiding Code

Enjoy your delicious copypasta.



Moderator Note:
Kurios, if you remove that image I will send a big black man named Bubba over to your house to sodomize you repeatedly.

[kynox]

I present to you:
WinNinja Module Hiding Code

Enjoy your delicious copypasta.



Moderator Note:
Kurios, if you remove that image I will send a big black man named Bubba over to your house to sodomize you repeatedly.

Lambda goodness ftw!

[flo8464]

Fav'd that image !

Thank you Cypher for that code.
I am sure the Mimic guys are downloading it right now :P

What I don't understand...why is that helping? I mean, you don't need API-functions to inspect your own code.
Dereferencing some memory here and there could do a similar job to detect injected hacks I guess.

[lanman92]

Is there any chance that the warden wiki will be updated in the near future? It says that you can hide your modules by hooking Module32First/Next, which doesn't seem accurate anymore.

[kynox]

Is there any chance that the warden wiki will be updated in the near future? It says that you can hide your modules by hooking Module32First/Next, which doesn't seem accurate anymore.

I've no reason to do it, other than giving out freebies to the scum suckers (eg: Mimic).

Sorry, but thats just how it is.

[Cypher]

Fav'd that image !

Thank you Cypher for that code.
I am sure the Mimic guys are downloading it right now :P

What I don't understand...why is that helping? I mean, you don't need API-functions to inspect your own code.
Dereferencing some memory here and there could do a similar job to detect injected hacks I guess.

Because, you don't use NtQueryVirtualMemory to inspect the contents of memory, you use it to inspect the PROPERTIES of the memory.

The properties of the memory region (i.e. file mapping info, and VAD info) are stored in the kernel, and hence it requires an API call.

You can't just "[dereference] some memory here and there" in order to retrieve the file mapping path or VAD info.

[flo8464]

I have to admit, I didn't really lookup what NtQueryVirtualMemory does in general, had problems finding a good documentation.

But I still don't really understand why they don't scan for signatures of known hacks.