Bypassing hackshield

[Rickyrudy]

Credits to DeadlyData of ************* forums.
Learning experience.

No questions will be answered by me this is just a cp and i say its rather simple >.>

Reason for writing this/Why I bypass it the way I do:
First my reason for writing this is the anti-cheat is really shitty and so far there has been no real documentation on it released online that I've found, besides my own.

Secondly the reason I bypass it the way I do, Is it's the easiest way I or any one else with less experience can.

A couple days to a week or so ago I hardly understood what a hook or detour would really do nor did I understand how system drivers worked... I've always been more of a web based person as far as security.

Any way to continue for some of you guys, I'm sure you could simply unload the driver and recreate the heart beat of the anti-cheat so that hack shield is just simply no longer resident on your system.

That how ever isn't my way around it I've found several and will explain the ways I've taken so far below.

How hack shield works(From my view):
So far the way I see hack shield works(And try not to bash me if I say something incorrectly just correct it)...

Your game client will load upon your game client loading it will load a external library which is usually hack shield's interface dll "EhSvc.dll".

From this point I wasn't able to do much analysis my self on account of "EhSvc.dll" was packed with themida in my game target.

From here though "EhSvc.dll" will continue by loading several other things one of those things being the system driver "EagleNT.sys".

EagleNT.sys creates several SSDT hooks preventing a user from using things like WriteProcessMemory() or ReadProcessMemory() on the target game it's protecting.

How ever there are memory searching utilities out there like cheat engine that are open source and people decide to modify these using different calls to avoid the hooks.

When using one of these you will how ever still get detected if you manage to get around the SSDT hooks.

The detection is passed either from the driver or the dll into the game's main exe from there the game will give you the message like "Illegal Memory Access Detected".

So bassicly it's a system driver and a dll interacting with each other thats pretty much how it works to sum it up things are also passed and controlled by the game as far as detection goes though.

Bypassing it(My way):
Since things are just passed through the games exe I usually just unpack the games exe(Usually hack shield targets come packed with "UPX" - Of all things).

Open the games unpacked exe in IDA find the string which I received - E.X. "Illegal Memory Access Detected".

And head above the the string to the main jump that pretty much goes through all of the different detection messages.

It's usually always a JG once this is nopped it no longer shows the detection messages nor attempts to close your game if detected...

More in depth with the method below.

Bypassing (More In depth/Tutorial):
Start by going through the string table in IDA until you see the "detected" string that was in the message box.

https://www.thedefaced.org/DD/hshield/memoryaccess.PNG

From there double click on it...

https://www.thedefaced.org/DD/hshield/memoryaccess2.png

Then go to the reference of it (The push of the offset):


https://www.thedefaced.org/DD/hshield/memoryaccess3.PNG

Go to the reference of the push... which is a jmp.


https://www.thedefaced.org/DD/hshield/memoryaccess4.PNG

Go to the reference of that jmp which is another jmp just a jump if greater...


https://www.thedefaced.org/DD/hshield/memoryaccess5.PNG

And last the reference to that JG(Jump if greater) is where you set your 2 byte nop... bypassing the detection completely.


https://www.thedefaced.org/DD/hshield/memoryaccess6.PNG

Yeah it's completely played out this way for every game it's in... so this will work on most games using hack shield.

Hope this helps some of you guys...

[gbitz]

Stop repeating your big words. Egotistical. El oh El.

[Banshou]

Stop repeating your big words. Egotistical. El oh El.

lolz, you're not a very complex person, it's about all I could find to point out. You're not really worth my creativity.

[gbitz]

Go utilize your ingenuity elsewhere.

[daddyi]

This was already posted.

[hakufu]

Go seemliss Go Hot Avatar of seemliss aha aha
Your 100% Right..

PS: Hot Avatar...
btw. Hot Avatar..

Thanked you for your reply,
AND YOUR HOT AVATAR

=P

ahahaha
u really want a gf eh? or atleast a hot one,
suggestion.. read "The Game"
oh and hint, dont be a tool

no offense, just trying to help out the AFCs out there

So fucking what? He copied it so people here could see it. Fuck off you egotistical retard, seriously. You're worthless.


Stop repeating your big words. Egotistical. El oh El.

lolz, you're not a very complex person, it's about all I could find to point out. You're not really worth my creativity.

ahahaha, kids are so fun :]
i like the creative words, and style of choice of statements,
just less emotion guys, lets keep this a discussion not an arguement
nice to see ppl attempting to use their vocabulary

[blackpepper]

thx for this im going to try when i get home from work

[CyberStriker]

I found the addy, but I can't nop it. HS hooks that.

[silent1990]

there is an easier way^^

[*Marneus901*]

https://www.mpgh.net/forum/3-general/...us_laszlo.html
Unpacking UPX Pl0x?

[NetSuspsend]

Yeah, following that tut I can't find "61 E9 87 92 FD FF 00 00 00 00" :\

[gudsoldier]

I'm feeling fat and sassy. Anyways, I'm pretty sure the people we're trying not to spoon feed will not be able to eat from this spoon considering the food being fed is a little too complicated.

[Rickyrudy]

I'm feeling fat and sassy. Anyways, I'm pretty sure the people we're trying not to spoon feed will not be able to eat from this spoon considering the food being fed is a little too complicated.

Exactly only problem i'm having is rapidsharing hating on me >.> Dling IDA at some 5kbps rofl.. and its 74mb...

[NetSuspsend]

IDA is 15mb, well the freeware version unless you're getting a crack >_>

[gudsoldier]

Exactly on what, me feeling fat and sassy, or people being spoon fed too much at a time so they can't process what to do with it all.

[Rickyrudy]

Lol netsuspnder i never go without crack