HS Bypass Programming

02/13/2010 00:59 zkuddy#1
Hi,

I'm a programmer who has never tried hacking. I am currently trying to write a bypass for HackShield, mainly for educational purposes, and would like to know if what I have come up with is true or false:

1. The best case scenario would be if HackShield was never loaded at all.
2. To achieve this, a dll would need to be written that intercepts certain function calls and replaces those with its own.
3. The dll would need to be injected into the game process before HackShield is started.
4. To find those functions and their parameters and return values, a disassembler like IDA is needed.
5. A function can be intercepted using HookImportedFunction.

Thanks.
02/13/2010 01:12 Koboldbandit#2
what was the point of this post?
02/13/2010 01:16 Halfslashed#3
Interesting, now for my two cents.

It HAS to load, else you can't start the game. Doesn't matter what you try, it won't let you log in.

For bypassing hackshield, your main concerns are HSInst.dll and EhSvc.dll. EhSvc.dll is the best option, but it's packed with themida, so you have to figure out how to unpack that.
02/13/2010 01:40 shadowsforu#4
My bypass just stops the "Hackshield has detected a hack" from stopping gameplay. All you do is move the message, and continue playing.
02/13/2010 04:20 access1z#5
Quote:
Originally Posted by shadowsforu View Post
My bypass just stops the "Hackshield has detected a hack" from stopping gameplay. All you do is move the message, and continue playing.
How do you do that? Using a 3rd party app or editing a file?
02/13/2010 04:22 Halfslashed#6
Because everyone wants to publically give out a bypass.
02/13/2010 04:27 pawntobishop#7
ooo ooo I can has bypass Mr. Half? I promise I'll be good and not release it. (dun worry guise I will).
Pweeeeeese.
I'll be your best friend.
02/13/2010 04:39 windsworddd#8
Half its not impossible, as you very well know Checkbox did it with binkw32.dll file.
02/13/2010 05:00 pawntobishop#9
Lies hackshield is a fortress with no viable bypasses. When will you learn that we cannot possibly tamper with these things.
02/13/2010 05:22 Uncreative.#10
Quote:
Originally Posted by shadowsforu View Post
My bypass just stops the "Hackshield has detected a hack" from stopping gameplay. All you do is move the message, and continue playing.
Fun part about that one is it works for any game with HS and can never be patched up.
02/13/2010 11:02 zkuddy#11
Thanks for your input. Some of you seem to think the HackShield cannot be completely disabled but some think it can.

I would still like to know though if the way I described is the way to go about it or if I'm totally wrong.

About EhSvc.dll, can this disable the scanning of hacks or will it just produce false outputs? The goal is to have HackShield basically do nothing.
02/13/2010 11:07 Darien630#12
Quote:
Originally Posted by zkuddy View Post
Thanks for your input. Some of you seem to think the HackShield cannot be completely disabled but some think it can.

I would still like to know though if the way I described is the way to go about it or if I'm totally wrong.

About EhSvc.dll, can this disable the scanning of hacks or will it just produce false outputs? The goal is to have HackShield basically do nothing.
Want a cookie?
02/14/2010 03:04 pawntobishop#13
Because of how mabi and hackshield work together, you can never "completely" disable it.
02/15/2010 05:57 Halfslashed#14
Quote:
Originally Posted by Darien630 View Post
Want a cookie?
Want to fuck off you failure of a troll?

/end insult

Anyways, HS is loaded into the memory. You have to alter it's functions to send negative values to the server.

Wind, he never killed HS completely, he just stopped it from updating. Thats why it appeared to not load.
02/15/2010 08:14 Darien630#15
Quote:
Originally Posted by Halfslashed View Post
Want to fuck off you failure of a troll?

/end insult

Anyways, HS is loaded into the memory. You have to alter it's functions to send negative values to the server.

Wind, he never killed HS completely, he just stopped it from updating. Thats why it appeared to not load.
Kay o-o