How to inject a DLL without being detected?

Question

I understand that DLL injection can be used to modify games, perhaps for the purposes of writing a bot. Last time i injected a DLL, it was detected. My injection method must have been detectable then, the question comes down to how do i avoid getting detected? Please help me out, multiple ways to do this would be greatly appreciated

Answer 1

how do i avoid getting detected

You can't know how to avoid getting detected if you don't know how the detection works. I'd recommend finding and reverse engineering the detection logic so that you can either disable it (patch it out) or better understand how to avoid detection.

That said, if you're looking for a generic alternative to "standard" DLL injection approaches, you may want to consider reflective DLL injection:

• Description
• Implementation

Note that reflective DLL injection is detectable as well, which again highlights the importance of knowing how the detection logic works for your scenario.

Answer 2

There are many forms of dll injection, the most common being to load code into the remote process that calls LoadLibrary in order to load the payload dll. Some anticheats hook LoadLibrary in order to catch or prevent such methods. To prevent this, you'd need to eliminate the call to LoadLibrary. This means you'd need to imitate the windows PE loader and prepare the dll yourself to be executed. This method is called "manual mapping", and you can find an example of code that achieves it here. The bare minimum of steps you need to perform is mapping base relocations and fixing imports, and my brief scanning of this code shows that it should achieve this.