Gameguard bypass for speed hack

LordAnas · 06/27/2025, 22:28

Hello there,

Is there any tool or tips to run a speedhack tool or cheat engine just to get the speedhack working? I know there are bots with lots of features but I'm not interested in those I just wanted finish battles manually in ~5 sec.

I tried the undetected cheat engine method but no luck so far, either I ran into lots of errors or I skip those line as comments but also I get detected as soon as game launches.

Any help is appreciated.

HighGamer. · 06/28/2025, 00:33

Only way to speedhack in AO without detection is to hook to API's addresses directly you have to find the IAT addresses for 3 api calls "timeGetTime", "GetTickCount", "QueryPerformanceCounter".

If you do the same method all speedhacks use which is simply this below, chances are it will get detected 100% of the time, i call this method (old speedhack) in my bot.

Works like this old speedhack

Code:

TimeGetTimex = (DWORD)GetProcAddress("winmm.dll", "timeGetTime");
Jump(TimeGetTimex, (DWORD)NewTickCount, TRUE);

GetTickCountx = (DWORD)GetProcAddress("kernel32.dll", "GetTickCount");
Jump(GetTickCountx, (DWORD)NewTickCount, TRUE);

QueryPerformanceCounterx = (DWORD)GetProcAddress("kernel32.dll", "QueryPerformanceCounter");
Jump(QueryPerformanceCounterx, (DWORD)NewQueryPerformanceCounter, TRUE);

myprintf(true, false, false, TextColor::RED, "Old Speedhack loaded, will be detected.\n");
OldSpeedHackInitialized = true;

New speedhack uses this method which is hardcoded IAT addresses. Here is a example for NA (Global server) of AO which I updated yesterday.

Code:

[SpeedHack]
timeGetTime=0x2707DD0
GetTickCount=0x27070F4
QueryPerformanceCounter=0x2707194

LordAnas · 06/30/2025, 13:01

Quote:
Originally Posted by HighGamer.
Only way to speedhack in AO without detection is to hook to API's addresses directly you have to find the IAT addresses for 3 api calls "timeGetTime", "GetTickCount", "QueryPerformanceCounter".

If you do the same method all speedhacks use which is simply this below, chances are it will get detected 100% of the time, i call this method (old speedhack) in my bot.

Works like this old speedhack
Code:
TimeGetTimex = (DWORD)GetProcAddress("winmm.dll", "timeGetTime");
Jump(TimeGetTimex, (DWORD)NewTickCount, TRUE);

GetTickCountx = (DWORD)GetProcAddress("kernel32.dll", "GetTickCount");
Jump(GetTickCountx, (DWORD)NewTickCount, TRUE);

QueryPerformanceCounterx = (DWORD)GetProcAddress("kernel32.dll", "QueryPerformanceCounter");
Jump(QueryPerformanceCounterx, (DWORD)NewQueryPerformanceCounter, TRUE);

myprintf(true, false, false, TextColor::RED, "Old Speedhack loaded, will be detected.\n");
OldSpeedHackInitialized = true;
New speedhack uses this method which is hardcoded IAT addresses. Here is a example for NA (Global server) of AO which I updated yesterday.
Code:
[SpeedHack]
timeGetTime=0x2707DD0
GetTickCount=0x27070F4
QueryPerformanceCounter=0x2707194

Thank you for helping me out. i wonder if i still have to get my version of UCE just in case that those offsets get updated in the future.