[Question] Safety of various injection techniques

[yossarian87]

I've spent the last week or so reading about how to inject/hook/etc in the WoW process. It seems like there are multiple approaches, and while any kind of injection is detectable, I was hoping the experts here could give their opinion on what is safest or reasonably safe.

To get your code into the WoW process you can either load DLLs, or inject ASM using memory writing. Clearly loading DLLs is more detectable, but is there any evidence that WoW cares if you load DLLs?

Also, to gain control in the WoW process space, you can hook WoW functions (EndScene seems to be the preferred hook point) or spawn your own threads. I know that you have to hook the main WoW thread to call WoW functions, and that hooking EndScene is considered safe because it's done by other legal software, but what I don't know is whether starting up new threads remotely is dangerous or not (clearly WoW can detect new threads appearing in its process).

[streppel]

As far as i know,you can go either way without worrying too much.
Like you said,both ways are detectable, while at the same time,as long as you stay private/have just a small userbase,it is no problem to go for the way you want.

I personally would suggest hooking endscene and doing your stuff there, but it's really up to you

[homer91]

I just dont understand why they dont implent that thing like in Punkbuster that scanns for white listed hooks in endscene like fraps, like Apoc said it before.
It's confusing.

[Cypher]

I just dont understand why they dont implent that thing like in Punkbuster that scanns for white listed hooks in endscene like fraps, like Apoc said it before.
It's confusing.

Not every single EndScene hook is a cheat, so all they could do in the case of a detection is kick you (which is all PB does), which doesn't really accomplish anything. The real hackers will just bypass the check, and the legitimate users caught in the crossfire will be frustrated.

It might help them catch/block some 'low hanging fruit', but other than that, nobody wins.