I currently have written a program that will implement both kernel device driver and user level control

so far i have completed the undetectable injection sequence (tested)

now the only problem lies to what i should hook/intercept

currently my target is Hackshield

the attempt to stop hackshield from terminating process is futile since the termination comes after disconnection to the server
my aim to stop the hackshield from working is to interrupt the windows message invoked when hack is detected, so the game itself will always receive "everything is ok" message

but my ability of reversing the process has limited the understanding of how the message is broadcasted by Hackshield itself

I know there are various ways for hackshield to notify main program when hack is detected
but how can i detect which method is hackshield using?