finding a running DLL

[Ontani]

I am creating an anticheat program for a game.

now the game should exit if someone trys to load the file

opengl32.dll but since windows has that file standard running in need to

 

check if its running

if its running check the size of the file and close the game if the size is not equal to the windows opengl32.dll.

 

any ideas how to find the dll's that are running on your system

[IngisKahn]

How would opengl have anything to do with cheating?

 

Anyway, DLLs don't "run", they are loaded into the memory of the calling app.

[Ontani]

cause the dll contains an aimbot for the game.

 

is there a way to check your memory for dll's that are loading then?

[DiverDan]

Why can't you have the dll write a file to disk and check for that file?

[Wile]

That would be impossible, opengl32.dll is part of the video driver, used for open gl (3d graphics standard) rendering. I dont think that the opengl spec requires the driver to export a specific type of file, if it did, the cheaters would implement that in their own drivers.

 

But I was under the impression that the opengl32.dll was replaced by driver specific implementations. That at least ATI and nVidia had their own implementation that could change with new driver versions. That is why asus received a lot of criticism a few years back when they build wallhack like behaviour into their (beta) drivers. Luckily they removed that functionality, but it shows that the vid drivers that are distributed by the manufacturers are involved. As both have a pretty high ratio of updates (ATI at least 1 x per month, dont know about nVidia) that would require a lot of regular updating of your application.

 

Anyway, as it is a dll, it should be loaded in the process of the game that is using the opengl rendering. Dlls are always (*) loaded in the process of the application that uses them.

 

(*) there are some exceptions to this, but as far as i know they only apply to COM dll's that are used in a very specific way. Not something you have to worry about in this scenario.

[Ontani]

the dll is placed in the same folder as the game

 

this is easy to check if the file exists the game can't be started.

 

but i heard something about dll loaders, programs that load a dll into the memory; so that would give the ablility to start the game without the dll and load it afterwards into the memory, bypassing my anti-cheat program.

 

thats why i "constantly" want to check which dll's are loaded into the memory.

 

and offcourse there are graphicall card hacks that i can't prevent cause there hardwarematic changed.

[coldfusion244]

Wile, most cheaters, though, edit the file and replace the current one with their new one so that it allows their loader to inject code into it. This is at least how most of the cheaters in Americas Army Operations do it. It's had to even say verify it with a MD5 checksum as some of the more advanced cheaters can use the hole in md5 to make it seem like the original. Just some FYI.

[Ontani]

the file opengl32.dll isn't normaly in the folder.

if it is it means there using cheats, its that simple i just need to prevent them to load that dll into there memory