API’s that GameGuard hook (Debugging)

Posted in Debugging,Gamehacking by Mr. Novocain on September 8, 2007 at 03:04

API’s that GameGuard hook

This might interest you: Beginning C++ Through Game Programming, Second Edition

A complete list of the Windows API’s that GameGuard hook in Ring3 (usermode) and Ring0 (kernelmode)..

..atleast I think I got them all in here ;P

Ring3

advapi32.dll
CreateProcessWithLogonW

gdi32.dll
GetPixel

kernel32.dll
CreateProcessInternalW
DebugActiveProcess
DeviceIoControl
GetProcAddress
LoadLibraryExW
MapViewOfFile
MapViewOfFileEx
MoveFileW
OpenProcess
ReadProcessMemory
VirtualProtect
VirtualProtectEx
WriteProcessMemory

ntdll.dll
NtLoadDriver
NtOpenProcess
NtProtectVirtualMemory
NtQuerySystemInformatio
NtReadVirtualMemory
NtSuspendProcess
NtSuspendThread
NtTerminateProcess
NtTerminateThread
NtWriteVirtualMemory
RtlGetNativeSystemInfor
ZwLoadDriver
ZwOpenProcess
ZwProtectVirtualMemory
ZwQuerySystemInformatio
ZwReadVirtualMemory
ZwSuspendProcess
ZwSuspendThread
ZwTerminateProcess
ZwTerminateThread
ZwWriteVirtualMemory

user32.dll
GetWindowThreadProcessI
PostMessageA
PostMessageW
SendInput
SendMessageA
SendMessageW
SetCursorPos
SetWindowsHookExA
SetWindowsHookExW
keybd_event
mouse_event

Ring0
NtConnectPort
ZwConnectPort
NtOpenProcess
ZwOpenProcess
NtProtectVirtualMemory
ZwProtectVirtualMemory
NtReadVirtualMemory
ZwReadVirtualMemory
NtWriteVirtualMemory
ZwWriteVirtualMemory
SendInput

Incoming search terms for the article:

4 Comments for this post

September 20th, 2007 at 16:23

Great, thank you:)

December 23rd, 2007 at 08:55

Wut rev is that?

August 20th, 2008 at 17:14

MapViewOfFile is not hooked by gameguard.

April 18th, 2009 at 05:18

“MapViewOfFile is not hooked by gameguard.”

That actually depends on the rev.