From 09627e33ef03ce20c53d8b56d0ab2fe99afc3495 Mon Sep 17 00:00:00 2001 From: _xeroxz Date: Fri, 18 Dec 2020 03:27:11 +0000 Subject: [PATCH] Update README.md --- README.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index f7ad4d2..fab65d9 100644 --- a/README.md +++ b/README.md @@ -18,4 +18,10 @@ to point to the internal.dll entry point. This makes it so when you stream the game in discord or OBS the rendering is stream proof because we draw after discord and OBS captures the screen. - \ No newline at end of file + + +# Detection + +This project can easily be detected by checking for dxgi.dll IAT hooks on EtwEventWrite and stack walking of threads that execute EtwEventWrite. Inserting +a pml4e into a pml4 is also detected as the PFN database contains all of the PFNs for a specific process and if a new PML4E is inserted it will +be pointing at other processes PFNs. \ No newline at end of file