Results 1 to 6 of 6
  1. #1
    hack4me's Avatar
    Join Date
    Feb 2011
    Gender
    male
    Location
    Colorado
    Posts
    34
    Reputation
    9
    Thanks
    37
    My Mood
    Cool

    Exclamation Hackshield Reverse Engineers

    I would like to hear from good Hackshield reverse engineers. I have extracted the AnhLab Hackshield driver from the EHsvc.dll. Looking for a few good people with kernel level driver hacking or custom bypass experience. If you feel you have the skills PM me.

  2. #2
    freedompeace's Avatar
    Join Date
    Jul 2010
    Gender
    female
    Posts
    3,035
    Reputation
    340
    Thanks
    2,784
    My Mood
    Sad
    You could have, alternatively, copy-pasted the driver from your drivers directory under Windows. Windows requires that it there in order to execute it

  3. #3
    hack4me's Avatar
    Join Date
    Feb 2011
    Gender
    male
    Location
    Colorado
    Posts
    34
    Reputation
    9
    Thanks
    37
    My Mood
    Cool
    Quote Originally Posted by freedompeace View Post
    You could have, alternatively, copy-pasted the driver from your drivers directory under Windows. Windows requires that it there in order to execute it
    Freedompeace... It is not that simple. The driver is extracted from the memory resident EHsvc.dll and then copied to windows system 32, executed and then deleted. This happens so fast normally that you cannot get a copy of the driver.....

  4. #4
    flameswor10's Avatar
    Join Date
    Jul 2009
    Gender
    male
    Posts
    12,528
    Reputation
    981
    Thanks
    10,404
    My Mood
    In Love
    Quote Originally Posted by hack4me View Post
    Freedompeace... It is not that simple. The driver is extracted from the memory resident EHsvc.dll and then copied to windows system 32, executed and then deleted. This happens so fast normally that you cannot get a copy of the driver.....
    Why not Pause hackshield using a debugger.
    Also, Please post in the correct section next time @hack4me
    No I do not make game hacks anymore, please stop asking.


    Been MPGH Minion: 6 July 2011 - 1 August 2012

  5. #5
    freedompeace's Avatar
    Join Date
    Jul 2010
    Gender
    female
    Posts
    3,035
    Reputation
    340
    Thanks
    2,784
    My Mood
    Sad
    Quote Originally Posted by hack4me View Post
    Freedompeace... It is not that simple. The driver is extracted from the memory resident EHsvc.dll and then copied to windows system 32, executed and then deleted. This happens so fast normally that you cannot get a copy of the driver.....
    Uhm, a little question: why are we doing this manually?

    It's common to find many people use monitors, especially around the security industry. Download or make one so you can get the updated driver rather than spend 5 minutes each update getting the driver and diffing it to see if its changed.

    Also, I was under the impression that you're not able to delete drivers that are in use, just as you aren't able to with executables, modules and files that are in use. I'll check up on this tomorrow.


    Quote Originally Posted by flameswor10 View Post
    Why not Pause hackshield using a debugger.
    Also, Please post in the correct section next time @hack4me
    HackShield won't let you do that, iirc, unless you magically pause it at the right time (before its loaded its anti-debug things but not before HackShield has loaded), which can have a timespan of mere nanoseconds.
    Last edited by freedompeace; 10-09-2011 at 04:41 AM.

  6. The Following 2 Users Say Thank You to freedompeace For This Useful Post:

    Drake (10-09-2011),[MPGH]flameswor10 (10-09-2011)

  7. #6
    hack4me's Avatar
    Join Date
    Feb 2011
    Gender
    male
    Location
    Colorado
    Posts
    34
    Reputation
    9
    Thanks
    37
    My Mood
    Cool
    Quote Originally Posted by flameswor10 View Post
    Why not Pause hackshield using a debugger.
    Also, Please post in the correct section next time @hack4me
    Flameswor10,

    I did pause the EHsvc.dll in the debugger to be able to extract the EagleNT.sys hackshield kernel driver. But in order to step through and debug the code you have to Unpack the EHsvc.dll (themida) and defeat the Winlicense macro tricks otherwise the debugger freaks!

    Sorry about posting in the wrong section. I defeat Hackshield for Combat Arms so I thought it was appropriate.

    Quote Originally Posted by freedompeace View Post


    Uhm, a little question: why are we doing this manually?

    It's common to find many people use monitors, especially around the security industry. Download or make one so you can get the updated driver rather than spend 5 minutes each update getting the driver and diffing it to see if its changed.

    Also, I was under the impression that you're not able to delete drivers that are in use, just as you aren't able to with executables, modules and files that are in use. I'll check up on this tomorrow.




    HackShield won't let you do that, iirc, unless you magically pause it at the right time (before its loaded its anti-debug things but not before HackShield has loaded), which can have a timespan of mere nanoseconds.
    Freedompeace,

    I am doing this manually because that is the only way to do it at this time. I do not know of anyone else who has done this? You can see the Eagle kernel driver loaded using a
    rootkit detector etc.

    A kernel mode driver can be launched and deleted from disk if you do it correctly. This is what the hackshield coders did. Try and stop the service or find it while the game is running.....you will find it difficult as the windows OS does not know where it is.

    Exactly right....I have magically pause it at the right time...when Hackshield inits the
    Kernel mode driver...
    Last edited by hack4me; 10-09-2011 at 02:35 PM.

Similar Threads

  1. [Assembly Tutorial] 40 Reverse Engineering
    By radnomguywfq3 in forum Programming Tutorials
    Replies: 22
    Last Post: 04-19-2016, 08:49 PM
  2. [Help] VIP REVERSE ENGINEERING
    By scar-l in forum CrossFire Hacks & Cheats
    Replies: 7
    Last Post: 03-06-2010, 12:54 PM
  3. "fuk u lol 2"s aimbot - reverse engineered
    By NeverBorn in forum Combat Arms Hacks & Cheats
    Replies: 29
    Last Post: 06-13-2009, 10:26 PM
  4. Replies: 0
    Last Post: 10-18-2008, 07:06 PM
  5. Reverse Engineering!
    By Jeckels in forum WarRock - International Hacks
    Replies: 13
    Last Post: 11-06-2007, 10:45 PM