[RiperFish]

[TUT] How To Undetect Your MOdules [VB.net]

Let's Take These strings and will edit all together:

Code

GetWindowThreadProcessId
OpenProcess
WriteProcessMemory
CloseHandle
FindWindow
GetKeyPress
ReadProcessMem
WriteAByte
WriteAnInt
WriteALong
ReadAByte
ReadAnInt
ReadALong
ReadAFloat
WriteAFloat
hWnd
pid
phandle

Note: If you don't have all of the strings as shown, Then just edit the ones you do have.

Ok so these are some of the parts that need editing :

Code

Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal Classname As String, ByVal WindowName As String) AsLong
Public Declare Function GetKeyPress Lib "user32" Alias "GetAsyncKeyState" (ByVal key As Long) As Integer
Public Declare Function ReadProcessMem Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As

Lets start with the first line:

Code

Public Declare Function  GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long

After "user32" paste this code:

Code

Alias "GetWindowThreadProcessId"

the function name and your code will look like this:

Code

Public Declare Function [color=#FF0000]GWTPId [/color]Lib "user32" Alias "GetWindowThreadProcessId"(ByVal hWnd As Long, lpdwProcessId As Long) As Long

Do the exact same method with the following strings:

Code

OpenProcess
WriteProcessMemory
CloseHandle

But not these ones:

Code

FindWindow
GetKeyPress
ReadProcessMem

Because they already have the Alias parts added in their line of code so you would just edit the function names.

I Hope It Will help :).

[E.L.I.T.E]

Thanks, I will test this out a little later when I get the chance. Keep the tutorials coming! :ThumbsUp:

- E.L.I.T.E

[Ethereal]

Thanks for the share.

Try explaining what they keyword means though? All you said is that the Alias is already there.

[d3c0mpil3r]

Thanks for the share.

Try explaining what they keyword means though? All you said is that the Alias is already there.

With Alias you can tell the program the actual name of the function you are using from inside your DLL.
So you can change the function name you declared before to anything else.

For Ex :

Code

Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

If you are declaring the function as above, then there's no need to use the Alias keyword. And this won't work if you change any letter of the function name i.e CloseHandle. Now if you want to declare it with a different name you will use the Alias keyword like this:

Code

Public Declare Function Hello Lib "kernel32" Alias "CloseHandle" (ByVal hObject As Long) As Long

This will work.

[MrPixel]

Nice share, thanks mate ! (:

[RiperFish]

With Alias you can tell the program the actual name of the function you are using from inside your DLL.
So you can change the function name you declared before to anything else.

For Ex :

Code

Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long

If you are declaring the function as above, then there's no need to use the Alias keyword. And this won't work if you change any letter of the function name i.e CloseHandle. Now if you want to declare it with a different name you will use the Alias keyword like this:

Code

Public Declare Function Hello Lib "kernel32" Alias "CloseHandle" (ByVal hObject As Long) As Long

This will work.

Thannk's, and thank's all for the feedback :).