Open the dumped Engine.exe in IDA, or just simply attach olly to Engine.exe, after you stopped HS with a simply messagebox. Injct after hackshield loaded half.
Then, search for the following string: "ILTDrawPrim.Default".
You will get near an XREF, doubleclick on it.
Then you will jump to a new function, the device pointer (drawprim pointer) get pushed into the stack!
Example code:
The addy is from EU, sorry dont have current Engine dump, but this tutorial should be so easy that you can find the addy yourselfCode:push offset off_804974