RE: Anti Avast 5 SandBox Example [VB5/6/C#,VB.NET] 04-14-2013, 03:03 PM
#11
(04-12-2013, 06:20 AM)Psycho_Coder Wrote: Can you explain this a bit , I didn't get much in my head , but I know its something cool
GetModuleHandle is when it gets the 'handle' of the library being injected in the process itself. This is automatically injected. What means it will ask where it can be injected in what place in the memory etc.
Manual injection is when it injects the library in a randomly chose place or address (Not really 100% sure).
Have a look at this.
http://syprog.blogspot.com/2011/12/execu...sting.html
And as you may know cheats always use manual injection to not get found that easy. That is manually mapped and
Here are a few common ways of injecting.
- Standard(Automatic injection) – This is the injection technique used in nearly every injector out there. It uses CreateRemoteThread and LoadLibrary and is the most reliable injection technique.
- LdrLoadDll Stub – This is similar to the Standard injection technique except it goes 1 level deeper into LoadLibrary.
- Thread Hijacking – This was the “Alt” injection techinique. It is pretty stable and is not used by many injectors.
- Manual Map – This is the most secure injection technique. So secure that even Windows won’t even know about the injected DLL.
This injection technique may have problems with hacks that are packed with a packer so try another method if this doesn’t work.
So for a sandbox that does have to work with like any PE it uses Standard(Automatic injection). They can instead use other methods but they chosen to use the automatic way what makes it possible for us to see what gets injected.