Page 1 of 5 123 ... LastLast
Results 1 to 15 of 64
  1. #1
    Rickyrudy's Avatar
    Join Date
    Feb 2008
    Gender
    male
    Posts
    277
    Reputation
    10
    Thanks
    26

    Bypassing hackshield

    Credits to DeadlyData of ************* forums.
    Learning experience.

    No questions will be answered by me this is just a cp and i say its rather simple >.>

    Reason for writing this/Why I bypass it the way I do:
    First my reason for writing this is the anti-cheat is really shitty and so far there has been no real documentation on it released online that I've found, besides my own.

    Secondly the reason I bypass it the way I do, Is it's the easiest way I or any one else with less experience can.

    A couple days to a week or so ago I hardly understood what a hook or detour would really do nor did I understand how system drivers worked... I've always been more of a web based person as far as security.

    Any way to continue for some of you guys, I'm sure you could simply unload the driver and recreate the heart beat of the anti-cheat so that hack shield is just simply no longer resident on your system.

    That how ever isn't my way around it I've found several and will explain the ways I've taken so far below.

    How hack shield works(From my view):
    So far the way I see hack shield works(And try not to bash me if I say something incorrectly just correct it)...

    Your game client will load upon your game client loading it will load a external library which is usually hack shield's interface dll "EhSvc.dll".

    From this point I wasn't able to do much analysis my self on account of "EhSvc.dll" was packed with themida in my game target.

    From here though "EhSvc.dll" will continue by loading several other things one of those things being the system driver "EagleNT.sys".

    EagleNT.sys creates several SSDT hooks preventing a user from using things like WriteProcessMemory() or ReadProcessMemory() on the target game it's protecting.

    How ever there are memory searching utilities out there like cheat engine that are open source and people decide to modify these using different calls to avoid the hooks.

    When using one of these you will how ever still get detected if you manage to get around the SSDT hooks.

    The detection is passed either from the driver or the dll into the game's main exe from there the game will give you the message like "Illegal Memory Access Detected".

    So bassicly it's a system driver and a dll interacting with each other thats pretty much how it works to sum it up things are also passed and controlled by the game as far as detection goes though.

    Bypassing it(My way):
    Since things are just passed through the games exe I usually just unpack the games exe(Usually hack shield targets come packed with "UPX" - Of all things).

    Open the games unpacked exe in IDA find the string which I received - E.X. "Illegal Memory Access Detected".

    And head above the the string to the main jump that pretty much goes through all of the different detection messages.

    It's usually always a JG once this is nopped it no longer shows the detection messages nor attempts to close your game if detected...

    More in depth with the method below.

    Bypassing (More In depth/Tutorial):
    Start by going through the string table in IDA until you see the "detected" string that was in the message box.

    http://www.thedefaced.org/DD/hshieldmoryaccess.PNG

    From there double click on it...

    http://www.thedefaced.org/DD/hshieldmoryaccess2.png

    Then go to the reference of it (The push of the offset):


    http://www.thedefaced.org/DD/hshieldmoryaccess3.PNG

    Go to the reference of the push... which is a jmp.


    http://www.thedefaced.org/DD/hshieldmoryaccess4.PNG

    Go to the reference of that jmp which is another jmp just a jump if greater...


    http://www.thedefaced.org/DD/hshieldmoryaccess5.PNG

    And last the reference to that JG(Jump if greater) is where you set your 2 byte nop... bypassing the detection completely.


    http://www.thedefaced.org/DD/hshieldmoryaccess6.PNG

    Yeah it's completely played out this way for every game it's in... so this will work on most games using hack shield.

    Hope this helps some of you guys...
    Last edited by Rickyrudy; 08-01-2008 at 02:25 PM.

  2. The Following 5 Users Say Thank You to Rickyrudy For This Useful Post:

    CyberStriker (08-01-2008),darkvieja (10-15-2008),gerben498 (10-26-2008),minorutono (08-02-2008),nzjustin (10-05-2009)

  3. #2
    apezwijn's Avatar
    Join Date
    Feb 2007
    Gender
    male
    Location
    The Netherlands
    Posts
    1,521
    Reputation
    22
    Thanks
    679
    YaY I make a topic about not putting in tutorials cos it will get patched. And i get back a BYPASS!! YAY... MY TOPIC HELPED... Not..

    omg... Thanks for the bypass but was it really needed?

  4. #3
    Rickyrudy's Avatar
    Join Date
    Feb 2008
    Gender
    male
    Posts
    277
    Reputation
    10
    Thanks
    26
    Yes :S >.> most people wont Unpack the client >.> So stop complaining about the bypass being released
    And seemliss said you are going to need to disable hack shield if you want chams to work O.O
    Last edited by Rickyrudy; 08-01-2008 at 12:37 PM.

  5. #4
    Windshadow's Avatar
    Join Date
    Oct 2007
    Gender
    male
    Posts
    149
    Reputation
    10
    Thanks
    15
    I have a unpacked client but I got stuck at some part since I dont know much about asm.

  6. #5
    Rickyrudy's Avatar
    Join Date
    Feb 2008
    Gender
    male
    Posts
    277
    Reputation
    10
    Thanks
    26
    xD keep the client to yourself

    @The haters such as ape and diddyi ..This is how its meant to be >.> learning experiences for people if they never learn how do you expect them to get better >.>

  7. #6
    gbitz's Avatar
    Join Date
    Mar 2008
    Gender
    male
    Posts
    3,004
    Reputation
    152
    Thanks
    223
    It was nice, but all the experienced members knew this. Now the people who have no idea how to hack are being spoon-fed on how to bypass. What the fuck is wrong with people?

  8. The Following User Says Thank You to gbitz For This Useful Post:

    apezwijn (08-01-2008)

  9. #7
    apezwijn's Avatar
    Join Date
    Feb 2007
    Gender
    male
    Location
    The Netherlands
    Posts
    1,521
    Reputation
    22
    Thanks
    679
    Go seemliss Go Hot Avatar of seemliss aha aha
    Your 100% Right..

    PS: Hot Avatar...
    btw. Hot Avatar..

    Thanked you for your reply,
    AND YOUR HOT AVATAR

    =P

  10. #8
    gbitz's Avatar
    Join Date
    Mar 2008
    Gender
    male
    Posts
    3,004
    Reputation
    152
    Thanks
    223
    0_o.

    Thanks, I guess ...

  11. #9
    Rickyrudy's Avatar
    Join Date
    Feb 2008
    Gender
    male
    Posts
    277
    Reputation
    10
    Thanks
    26
    Keep crying and the next thing I'll do is post a tut on how to upack the client :3 Its all public. You say the experienced members know it what about others? If we never learn we can't be considered as "experienced members" and this is for learning.. Most people will not read because its too long.. Funny how people complain about public things.

  12. #10
    NetSuspsend's Avatar
    Join Date
    Jul 2008
    Posts
    161
    Reputation
    10
    Thanks
    16
    I tried unpacking some stuff with IDA and I couldn't find the error message at all D:

  13. #11
    Windshadow's Avatar
    Join Date
    Oct 2007
    Gender
    male
    Posts
    149
    Reputation
    10
    Thanks
    15
    Quote Originally Posted by NetSuspsend View Post
    I tried unpacking some stuff with IDA and I couldn't find the error message at all D:
    You dont unpack it with IDA.

    You unpack it with UPX.

  14. #12
    gbitz's Avatar
    Join Date
    Mar 2008
    Gender
    male
    Posts
    3,004
    Reputation
    152
    Thanks
    223
    They can search this for themselves if they really want to know, don't get it to the 90k+ members of MPGH that know nothing.

  15. #13
    Banshou's Avatar
    Join Date
    Jul 2008
    Posts
    15
    Reputation
    10
    Thanks
    1
    Quote Originally Posted by seemliss View Post
    They can search this for themselves if they really want to know, don't get it to the 90k+ members of MPGH that know nothing.
    And what if nobody posted it elsewhere?

    You're a selfish egotistic person, people need to learn from somewhere, it doesn't matter where. The chances are all this stuff will be patched eventually anyways, and there's absolutely no reason to think of anyone as lower then you. You're nothing special.

  16. #14
    gbitz's Avatar
    Join Date
    Mar 2008
    Gender
    male
    Posts
    3,004
    Reputation
    152
    Thanks
    223
    He didn't write it, you fucking tard. He copied it from Game Deception, as you could see in the first post. Point proven.

  17. #15
    Banshou's Avatar
    Join Date
    Jul 2008
    Posts
    15
    Reputation
    10
    Thanks
    1
    Quote Originally Posted by seemliss View Post
    He didn't write it, you fucking tard. He copied it from Game Deception, as you could see in the first post. Point proven.
    So fucking what? He copied it so people here could see it. Fuck off you egotistical retard, seriously. You're worthless.

Page 1 of 5 123 ... LastLast

Similar Threads

  1. """""How To Bypass Hackshield"""""
    By leonard208 in forum WarRock - International Hacks
    Replies: 3
    Last Post: 04-11-2009, 01:24 AM
  2. How to bypass hackshield? PLEASE ANSWER!
    By ploxide in forum Combat Arms Hacks & Cheats
    Replies: 0
    Last Post: 12-25-2008, 08:55 PM
  3. [Request] how to bypass hackshield?
    By XxKylePwnsxX in forum Anti-Cheat
    Replies: 3
    Last Post: 10-25-2008, 01:01 PM
  4. [Request] how to bypass hackshield?
    By XxKylePwnsxX in forum Anti-Cheat
    Replies: 0
    Last Post: 08-28-2008, 08:09 PM
  5. how do i bypass hackshield?
    By m010011 in forum Combat Arms Hacks & Cheats
    Replies: 9
    Last Post: 08-14-2008, 10:36 PM

Tags for this Thread