HS's DLL in CombatArms

[AlexSleyore]

OK well i was like... ok so according to that thing the easiest way to bypass it is to stop it form loading.. then i got another idea.. what if i closed it?.. well i looked and their was no EXE for it.. then i found

ehsvc.dll

in the Folder for Hshield and IN combat arms meaning Hshield injected it..(this comes by if you stop Hshield from loading - if combat arms loaded it, it would still load it)... thus i began my tests..

some basic tips

Dont use ollydbg to debug this dll.. it cause a system wide no-bsod crash (lost like 2 hours of work..)

apparently the following things fail:
1. Unloading it once its made the D3d
2. Replacing the whole thing with NOP once its loaded the D3d
3. Editing the name - HS compiles it from scratch that it loads from the internet on every load.

not sure what else their is cause i cant see its ASM or watch its functions cause its EVIL.. (also this means odds are you can just stop it from being able to inject the dll.. this is MUCH more up the allies of a lot of you hackers seeing, you do stuff with injectors and their sources all the time.)

any more ideas feel free to share them.. (will work on it some more tomorrow night.. i got school in like.. 4 hours and need 4 hours of sleep very badly)

[95king]

wow you stay up real late dude sorry i got no ideas

[FatEmoLLaMa]

Try editing the HSUpdate.exe and telling it that the same .dll is there.

Just a little idea :P

[knappy]

as i understand it, there is no way to actually bypass hackshield completely with this last update. if you disable it then the game wont load now. so the next best thing is to disable its error msgs and do your work that way.
problem with that is, its a real bitch to debug. since you cant attach the debugger. and that makes it alot more difficult to find pointers. since cshell cant be accessed directly while hacksheild is running.
good idea though, if that actually works then great

[Rajinn]

you can find the load point for the dll but it doesnt help.
disabling hsupdate is the same as disabling the dll... either way the game wont launch, you end up with a transform and lighting error.

you can disable the dll from loading, but its a waste of time. error error error.

you cant really "unload" a dll. you would have to find every instance/reference to it and correct it.
setting the whole ehsvc to nop will = crash
any call to ehsvc will = crash
calls to ehsvc are a few thousand a second. goodluck?
why are you trying to disable it anyways?

for the record i've successfully removed hackshield 100%, corrected all the errors, and have no problems playing.

[assason99]

as i understand it, there is no way to actually bypass hackshield completely with this last update. if you disable it then the game wont load now. so the next best thing is to disable its error msgs and do your work that way.
problem with that is, its a real bitch to debug. since you cant attach the debugger. and that makes it alot more difficult to find pointers. since cshell cant be accessed directly while hacksheild is running.
good idea though, if that actually works then great

yea i agree, found that out when i was trying to make some hacks

[Iwin]

you can find the load point for the dll but it doesnt help.
disabling hsupdate is the same as disabling the dll... either way the game wont launch, you end up with a transform and lighting error.

you can disable the dll from loading, but its a waste of time. error error error.

you cant really "unload" a dll. you would have to find every instance/reference to it and correct it.
setting the whole ehsvc to nop will = crash
any call to ehsvc will = crash
calls to ehsvc are a few thousand a second. goodluck?
why are you trying to disable it anyways?

for the record i've successfully removed hackshield 100%, corrected all the errors, and have no problems playing.

Did you pass the D3D error?

[Rajinn]

Did you pass the D3D error?

please read the full post. the last sentence to be exact.

[Iwin]

please read the full post. the last sentence to be exact.

Well than I guess you did. Congratulations lol

[Rajinn]

Well than I guess you did. Congratulations lol

thanks.
a little bit offtopic though arent we?

[Kreeg]

What are you using instead of Olly?

[mariokiller64]

What are you using instead of Olly?

Maybe Hex Workshop lol

[Kreeg]

Hex workshop does debugging?

[Rajinn]

i use olly for everything.

[rwkeith]

Nice tut (message too short)