Thread: Hook Detected

Page 1 of 4 123 ... LastLast
Results 1 to 15 of 48
  1. #1
    .::SCHiM::.'s Avatar
    Join Date
    Sep 2010
    Gender
    male
    Posts
    733
    Reputation
    180
    Thanks
    880
    My Mood
    Twisted

    Hook Detected

    Hey guys,

    You don't see me around here very often, but I have a question.
    I have a hack (of my own making, thank you) and it's all working perfectly, it works on any game for any given length of time that doesn't have any AC protection. However I've run into trouble with hackshield. The hook works fine for about 0.30/5 minutes, after that (or after being killed) the game d/c's. I'm sure that ca doesn't signature scan my hook yet because the hack is only 3 days old and because I can stay in-game when the hook is turned off. Do you guys have any idea on how it's being detected?

    Should I change my method (it's a jump right now) or should I move it deeper into the d3d code (it's a mid function already)

    Thanks,
    Last edited by .::SCHiM::.; 05-25-2011 at 12:56 PM.

    I'm SCHiM

    Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.

    Polymorphic engine
    Interprocess callback class
    SIN
    Infinite-precision arithmetic
    Hooking dynamic linkage
    (sloppy)Kernel mode Disassembler!!!

    Semi debugger




  2. #2
    NOOB's Avatar
    Join Date
    Apr 2010
    Gender
    male
    Posts
    3,843
    Reputation
    425
    Thanks
    8,616
    Try packing your compiled .dll with a compressor like mpress or PECompact and then test in game.

  3. #3
    whit's Avatar
    Join Date
    Jan 2010
    Gender
    male
    Posts
    7,159
    Reputation
    490
    Thanks
    2,253
    Prolly Just Your Detour....Single JMP is easily Detected...

  4. #4
    .::SCHiM::.'s Avatar
    Join Date
    Sep 2010
    Gender
    male
    Posts
    733
    Reputation
    180
    Thanks
    880
    My Mood
    Twisted
    Quote Originally Posted by whit View Post
    Prolly Just Your Detour....Single JMP is easily Detected...
    Yea but it's mid function, does HC scan every god-dam byte in the d3d functions?

    @NOOB

    It's not signature scanned, it's my detour/hook that's wrong, I'll try though maybe it works.

    I'm SCHiM

    Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.

    Polymorphic engine
    Interprocess callback class
    SIN
    Infinite-precision arithmetic
    Hooking dynamic linkage
    (sloppy)Kernel mode Disassembler!!!

    Semi debugger




  5. #5
    SNal2F's Avatar
    Join Date
    Jul 2009
    Gender
    male
    Posts
    175
    Reputation
    30
    Thanks
    99
    Quote Originally Posted by NOOB View Post
    Try packing your compiled .dll with a compressor like mpress or PECompact and then test in game.
    you do realize once your dll is loaded it is unpacked......if anything virtualizing and adding random instructions and a simple string encryption would be better.


    @ hook ya you can hook lower eventually they may end up scanning the whole function who knows , just always have a plan b , fyi there are alot of functions in sync with drawing, many undocumented but easy to see also engine functions you can draw in

  6. The Following User Says Thank You to SNal2F For This Useful Post:

    topblast (05-25-2011)

  7. #6
    Se lutar tú vai além, humilde igual Jesus.
    MPGH Member
    Turbulence's Avatar
    Join Date
    Aug 2010
    Gender
    male
    Posts
    2,181
    Reputation
    10
    Thanks
    742
    My Mood
    Pensive
    My detour is JMP, and works fine...

    With packer not works..

    Without packer = Works Fine

  8. #7
    Crash's Avatar
    Join Date
    Aug 2009
    Gender
    male
    Location
    JAville
    Posts
    2,881
    Reputation
    163
    Thanks
    3,291
    My Mood
    Sleepy
    Quote Originally Posted by SNal2F View Post
    you do realize once your dll is loaded it is unpacked......if anything virtualizing and adding random instructions and a simple string encryption would be better.


    @ hook ya you can hook lower eventually they may end up scanning the whole function who knows , just always have a plan b , fyi there are alot of functions in sync with drawing, many undocumented but easy to see also engine functions you can draw in
    For hooks like End3D do they scan the vtable when you enter a game ?

  9. #8
    .::SCHiM::.'s Avatar
    Join Date
    Sep 2010
    Gender
    male
    Posts
    733
    Reputation
    180
    Thanks
    880
    My Mood
    Twisted
    Quote Originally Posted by Turbulence View Post
    My detour is JMP, and works fine...

    With packer not works..

    Without packer = Works Fine
    On what function do you have your hook, and what method?

    @ALL

    Thanks for the attention too

    EDDIT:

    I'm hooking DrawIndexedPrimitive() btw, for chams
    Last edited by .::SCHiM::.; 05-25-2011 at 01:10 PM.

    I'm SCHiM

    Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.

    Polymorphic engine
    Interprocess callback class
    SIN
    Infinite-precision arithmetic
    Hooking dynamic linkage
    (sloppy)Kernel mode Disassembler!!!

    Semi debugger




  10. #9
    SNal2F's Avatar
    Join Date
    Jul 2009
    Gender
    male
    Posts
    175
    Reputation
    30
    Thanks
    99
    Quote Originally Posted by Crash View Post
    For hooks like End3D do they scan the vtable when you enter a game ?
    when i played no , i hooked flipscreen & the console function, no detections

  11. #10
    Se lutar tú vai além, humilde igual Jesus.
    MPGH Member
    Turbulence's Avatar
    Join Date
    Aug 2010
    Gender
    male
    Posts
    2,181
    Reputation
    10
    Thanks
    742
    My Mood
    Pensive
    Quote Originally Posted by whit View Post
    Your Brazilian so no one cares
    My hack is for Combat arms North America ...
    Combat arms Brazil = Shit..


    Update today, use private :P
    @whit

  12. #11
    .::SCHiM::.'s Avatar
    Join Date
    Sep 2010
    Gender
    male
    Posts
    733
    Reputation
    180
    Thanks
    880
    My Mood
    Twisted
    Quote Originally Posted by Turbulence View Post
    My hack is for Combat arms North America ...
    Combat arms Brazil = Shit..


    Update today, use private :P
    @whit
    would you please answer my question, I don't even need to see source:
    On which function have you placed your hook, and with what method?

    And everyone please stay on topic, don't make this into a flame war :O

    I'm SCHiM

    Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.

    Polymorphic engine
    Interprocess callback class
    SIN
    Infinite-precision arithmetic
    Hooking dynamic linkage
    (sloppy)Kernel mode Disassembler!!!

    Semi debugger




  13. #12
    Se lutar tú vai além, humilde igual Jesus.
    MPGH Member
    Turbulence's Avatar
    Join Date
    Aug 2010
    Gender
    male
    Posts
    2,181
    Reputation
    10
    Thanks
    742
    My Mood
    Pensive
    i use Virtual Protect...
    and JMP function!

    i use two methods :
    Detourcreate and after DetourRemove!

  14. #13
    .::SCHiM::.'s Avatar
    Join Date
    Sep 2010
    Gender
    male
    Posts
    733
    Reputation
    180
    Thanks
    880
    My Mood
    Twisted
    Quote Originally Posted by Turbulence View Post
    i use Virtual Protect...
    and JMP function!

    i use two methods :
    Detourcreate and after DetourRemove!
    I mean which d3d function do you hook

    I'm SCHiM

    Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.

    Polymorphic engine
    Interprocess callback class
    SIN
    Infinite-precision arithmetic
    Hooking dynamic linkage
    (sloppy)Kernel mode Disassembler!!!

    Semi debugger




  15. #14
    Se lutar tú vai além, humilde igual Jesus.
    MPGH Member
    Turbulence's Avatar
    Join Date
    Aug 2010
    Gender
    male
    Posts
    2,181
    Reputation
    10
    Thanks
    742
    My Mood
    Pensive
    Quote Originally Posted by .::SCHiM::. View Post
    I mean which d3d function do you hook
    Is, but this makes with that give DC with Packers..

  16. #15
    whit's Avatar
    Join Date
    Jan 2010
    Gender
    male
    Posts
    7,159
    Reputation
    490
    Thanks
    2,253
    Quote Originally Posted by .::SCHiM::. View Post
    I mean which d3d function do you hook
    He hooks Present & Reset i Believe....

Page 1 of 4 123 ... LastLast