Anti-hack shields

PUNKBUSTER

It is attached to the game as pbcl.dll. It reads game memory directly.
Next time that make hashes of scanned memory. It generates few hashes
and next it hashes all generated hashes to and sends to game server.
Server compare hash and select game violation from database. Once
if you changed d3d8 you should be kicked for Dissalowed Program/Driver.
It don't hooks any api functions that you can normally write to game memory.
That uses server to check memory

HACKSHIELD

by AhnLab

It is attached to the game as ehsvc.dll and may loads other modules
like hsupdate.dll. It scans memory directly like pb and compares that
on client . So you can simply edit the compare from jne to jmp
and you got memory scan bypassed.
It hooks low-level memory manipulation functions and some process-functions
with kernelmode via EagleNT.sys : NtOpenProcess, NtWriteVirtualMemory
NtTerminateProcess, NtReadVirtualMemory, NtMapViewOfSection.
It injects dll into all processes: ERGNAPX2.DLL and hooks some function from that.
Note: When i tried to hook Direct3DCreate8 thats alllow me to hack lol.
That not using server to check memory

XTRAP

by WiseLogic

It is working with external process Xtrap.xt what controls the game.
It hooks low-level memory manipulation functions and some process-functions
with kernelmode via XDva.sys : NtOpenProcess, NtWriteVirtualMemory
NtTerminateProcess, NtReadVirtualMemory, NtMapViewOfSection.
It injects dll into all processes: XTrapVa.DLL and hooks some function from that.

GAMEGUARD

by INCA

It is working with external process GameMon.des what controls the game.
Idk more about it. I know that scans memory through the driver.
It hooks all memory manipulation functions, keattachprocess and
some GUI functions like GetPixel, FindWindow, GetWindowThreadProcessID
with kernelmode and usermode. It generate hashes and sends to ggserver
what compare that with hashes stored in GameGuard database.
It injects dll into all processes: npggNT.des (ON NT SYSTEMs) and
npgg9x.des (ON 9x kernel based systems) and hooks some function from that.
That uses server to check memory