Source Code Kernel Mode Communication with user mode NO IOCTL

Hexui Undetected CSGO Cheats Sinkicheat PUBG Cheat

neonplanet

Newbie
Meme Tier VIP
Dank Tier Donator
Sep 7, 2017
245
3,048
12
How long you been coding/hacking?
2 years
Hello all, I've been working on this project for about a week now.

Let me start by saying I DON'T BELIEVE THIS 1000000% bypasses EAC or BE I only believe it'll be undetected if you tweak the driver and um application heavily.


I would like to share my method of communicating to kernel without any system threads, and user mode doesn't even touch the driver in any way shape or form.


So this method I'm about to share, to my knowledge, has not been posted on UC or GH. I'm 100% sure someone has thought of this method before so I don't claim any "title" or "I found this!" etc.


This communication method occurs using the windows REGISTRY!

Here is a video on the driver in action:


Sorry for the black screen UAC makes obs bug out.



But as you can see in the video the kernel successfully grabs the health of the player.



Here is the source code on github:

tawnix/SickKernelComm



Here is a run down of the code if you're too lazy to read the code:

  • Kernel creates 2 registry keys called "Code" and "Address"
  • Usermode program will send an address to the registry key "Address"
  • ex. LocalPlayer + Client.dll
  • then user mode program changes the "Code" key to 1 telling the driver "Hey read the address key now and plug it into RPM.
  • Kernel takes Address code plugs it into RtlCopyMemory function
  • Kernel then writes the address that it read to user mode
  • and usermode reads address back from the registry and bam you now have your local player address!




PS. this code is very bad, I suggest you don't use this, I suggest you all to read and tweak to your needs / fix things / improve it, I would love to see how ya'll can improve this project.


I wont be updating this project from here. I plan on creating a different version of this for personal use maybe, or using a different comm method.

Happy learning
 

dretax

CIL Expert
Meme Tier VIP
Fleep Tier Donator
Mar 28, 2020
81
3,273
0
You would not be the first one to do communications through registry or by hooking something.
Good job achieving It by yourself though, research is always important (y) . The "major" anti-cheats would have a major issue on "validating" what is touching the registry (When the last time I was trying to attempt this on FairPlayKD I found no actual way to achieve It, and It kinda makes sense) unlike at IOCTL.

So as of right now I would say there is no way to know what driver is modifying the registry, reading, etc...
@mambda papa might be able to either verify, or wreck me on that line. :foreveralone::ressleeper:
 

neonplanet

Newbie
Meme Tier VIP
Dank Tier Donator
Sep 7, 2017
245
3,048
12
You would not be the first one to do communications through registry or by hooking something.
Good job achieving It by yourself though, research is always important (y) . The "major" anti-cheats would have a major issue on "validating" what is touching the registry (When the last time I was trying to attempt this on FairPlayKD I found no actual way to achieve It, and It kinda makes sense) unlike at IOCTL.

So as of right now I would say there is no way to know what driver is modifying the registry, reading, etc...
@mambda papa might be able to either verify, or wreck me on that line. :foreveralone::ressleeper:
Awesome, I knew I wasn’t the only one to come up with this idea just surprised I haven't seen much info on it.

I thought it would be hard to detect because there are countless programs editing registry keys in usermode and driver mode.

Thanks for the info though man,.
 
Attention! Before you post:

Read the How to Ask Questions Guide
99% of questions are answered in the Beginner's Guide, do it before asking a question.

No Hack Requests. Post in the correct section.  Search the forum first. Read the rules.

How to make a good post:

  • Fill out the form correctly
  • Tell us the game name & coding language
  • Post everything we need to know to help you
  • Ask specific questions, be descriptive
  • Post errors, line numbers & screenshots
  • Post code snippets using code tags
  • If it's a large project, zip it up and attach it

If you do not comply, your post may be deleted.  We want to help, please make a good post and we will do our best to help you.

Community Mods League of Legends Accounts