Hackshield Bypass

I've been working on a full blown hackshield bypass for a few days now and I'm having trouble understanding what to do exactly. At first I tried a trial and error of nulling random Eagle.sys functions;

** ** ** ** ** ** ** ** //ZwAllocateVirtualMemory

** ** ** ** ** ** ** ** //NtQueryInformationProcess

** ** ** ** ** ** ** ** //NTWriteVirtualMemory

** ** ** ** ** ** ** ** //ZwReadVirtualMemory

** ** ** ** ** ** ** ** //ZwTerminateProcess

** ** ** ** ** ** ** ** //ZwProtectVirtualMemory

** ** ** ** ** ** ** ** //ZwTerminateThread

Etc.

My results were that when I NOP'd then in certain orders and groups I'd get general HS errors such as;

Cannot Update Hackshield
Cannot Execute Hackshield
Cannot Terminate Hackshield

I then went on to try and detour the system functions with what little knowledge I had at the time and it resulted in the client instantly crashing. After some more research I understood that the Eagle.sys functions were called by EHSVC ( I already knew of it but didn't put to much mind to it ), ultimately causing them to function as such. My current question standing is :

What should I detour? Which EHSVC function's correspond to what? Is there a analysis of them anywhere?

IE ;

jg EHSvc.dll+E879D
EHSvc.dll+E87BF

I know those jump to certain addresses but what am I supposed to do with what? The game I'm working with has a fairly simple HS so I can read the clients memory flawlessly.

PS : I've tried having HS simply not run with the client but after a minute or so I'm kicked from the server ( disconnected ), I've tried searching for the command/function causing that but my results were nothing. I've also tried just going for a CRC bypass but I again don't understand what to modify or how to even find the CRC addresses.

//======================================================================================// //================================ Hackshield Addys ====================================// //======================================================================================// #define EhsvcSelfCrC 0x00F36109FC #define Detection 0x00097D0 #define HSAntiCrash 0x00F35D455E #define AsmDetection 0x00EFFFFFFE #define NanoCheck1 0x00344EE #define NanoCheck2 0x00F35D1B2F #define NanoCheck3 0x00F35D3A2B //#define HackMalfunction1 0x0043EE3D //#define HackMalfunction2 0x0068D605 //======================================================================================// //=================================== Bypass Function ==================================// //======================================================================================// INT BypassMain() { //New Method DWORD dwEhSvc; do{ dwEhSvc = (DWORD)GetModuleHandleA("EhSvc.dll"); Sleep(100); }while(!dwEhSvc); MEMwrite((VOID*)(dwEhSvc+NanoCheck1),(PBYTE)"\xB8\x01\x00\x00\x00\xC3",6); //EHSVC NANO CHECK MEMwrite((VOID*)(dwEhSvc+NanoCheck2),(PBYTE)"\xB8\x01\x00\x00\x00\xC3",6); //EHSVC NANO CHECK MEMwrite((VOID*)(dwEhSvc+NanoCheck3),(PBYTE)"\xB8\x01\x00\x00\x00\xC3",6); //EHSVC NANO CHECK MEMwrite((VOID*)(dwEhSvc+EhsvcSelfCrC),(PBYTE)"\xC2\x04\x00",3); // CRC CHECK MEMwrite((VOID*)(dwEhSvc+Detection),(PBYTE)"\x90\x90",2); // ASM DETECTION CHECK MEMwrite((VOID*)(dwEhSvc+AsmDetection),(PBYTE)"\x90\x90",2); // ASM DETECTION CHECK MEMwrite((VOID*)(dwEhSvc+HSAntiCrash),(PBYTE)"\x90\x90",2); // ANTI CRASH //MEMwrite((VOID*)0x0043EE40,(PBYTE)"\x90\x90",2); // MALFUNCTION2 //MEMwrite((VOID*)(HackMalfunction1),(PBYTE)"\x7F\x34\x50\x68\x68\xD5\x68\x00\xEB\xA4\x56\x68\xA0\xD5\x68\x00",16) ; // MALFUNCTION1 return (1); }

Hackshield Bypass

Post a Reply

Similar Threads

Tags for this Thread