New Hackshield
Is it anybody here that know's how the new hackshield works?
/Discuss
didnt notice a new hackshield. the main module was not updated.
what hackshield does is scanning Engine.exe (code section only) - some months ago they scanned the code section of cshell.dll too,
checking for detours set on direct3ddevice9 functions (not all, but the important ones like endscene, reset, dip),
scanning itself
scanning modules used by hackshield (hs makes a 2 copys of psapi.dll and uses them)
scanning for strings in _all_ loaded modules
scanning for vtable hooks set on idirect3ddevice9 function
when something is found hackshield executes a crashing code.