Hackshield Bypass idea

[Epic Shion]

For those of us interested in getting rid of that pesky little thing that ruins all our lives, why not look into defeating hackshield locally? By that I mean, why not effectively empty out its.. *cough* nonessential information (things that make sure we're not hacking) and fool its checking methods (checksums, things of that sort) into thinking all its data was still there? Basically, still letting it look, but not let it know what its looking for. Unless such hack-checking isn't entirely client-side?

[kotarou3]

I'm guessing that's what most hackshield bypasses do. But actually doing the modification to do that is quite hard... (I'm talking to you, Themidia)

[Epic Shion]

Hmm... But it seems like most bypasses add to or modify the data that hackshield uses, I'm thinking to just remove it completely. And of course, it'd either take a lot of work, a lot of time or both, I'd assume. I just wanted to make sure something like that hadn't been attempted and found to be impossible. XD
Personally, methinks someone should just get their hands on the Mabi source so we don't have to deal with all of this XD But that's just me.

[adam_j]

To my knowledge, you can still detour, which is probably what a lot of bypasses do.

Oh, and hackshield is required to login, and stay logged in, btw.

[Epic Shion]

Originally Posted by adam_j

Oh, and hackshield is required to login, and stay logged in, btw.

So don't remove it completely, just its data. What I'm saying here is to keep hackshield, and have it respond to the server as if everything were going fine, but client-side it has nothing to check your computer against, only instructions on how to make it seem like everything is okay, and modified checking values so it doesn't notice it doesn't have the other data anymore.

Basically, making spoofing an "all clear" state for the sake of the server Hackshield's only purpose.

[adam_j]

Originally Posted by adam_j

To my knowledge, you can still detour, which is probably what a lot of bypasses do.

Oh, and hackshield is required to login, and stay logged in, btw.

^

Basically, the check happens, but the HS module is never told that anything is wrong, as the message to it was detoured.

Also, I'm fairly sure that HS will simply lol at you if you edit the DLL itself. Checksums and all that.
If that's what you're suggesting, it's not really very clear..

What you're proposing seems extremely complex, and would take a LOT longer than simply replying to the relevant module "yeah, everything's cool".

[Epic Shion]

But what a lot of people, including yours truly, are looking for is a way to completely disable Hackshield rather than just avoid catching a particular mod (possibly allowing for free packet editing and other things of that sort again). So basically since hackshield would keep sending the "all clear" no matter what we did, we could pretty much do anything within the abilities of the client (i.e. that wouldn't cause the client to crash, that is realistically possible)

[adam_j]

Please don't make me quote myself again.

FYI:
Hackshield never says "LOL I FOUND -specific modification-, NO CLIENT FOR U!"
It gives you a fairly broad category.

Thus, what you are asking is what I've been saying, but instead of wasting hours upon hours removing all the data, you just say "Yep. Everything's fine here."

[Epic Shion]

Hmmm... It seems like it'd take even more work to detour as reliably as a removal like this (conceptually 100% success rate), since there are multiple functions to detour, one could miss a few. I suppose it'd be effective enough, if done thoroughly, although another factor to consider is permanence, and I don't know which one if either is more likely for that since Nexon/DevCAT reallllly like patching whatever we decide to mess with. Regardless, I think I'll try it after I get out of school for summer, if nothing else it'll be fun for me Mostly the point of the thread was to see if it had been tried yet, like I said.

[adam_j]

Okay, well gl with that..

[tbstewa]

this is an idea of what hackshield and the client communicate to each other. if you can EMULATE this data set then you can play with mods. (note this is just a sample of the log taken from an actual file but some information is masked)

 Spoiler

[00:02:06.969]{FEE6147A-2032-47B1-AE59-B18C1815AF48} GUID : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[00:02:06.985]{D147F14F-F419-4B04-BEDF-A0C281031569} HASH : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[00:02:06.985]{BBD55FA1-C16F-4DE8-990E-70DCAFF79F5B}
[00:02:07.359][AntiCpXCnt][_AntiCpXCnt_MakeResponse] dwRequestLength = 56
[00:02:07.359][AntiCpXCnt][SetMemoryScanContext] pRequestBody : nPageGroupSize = 40
[00:02:07.359][AntiCpXCnt][SetMemoryScanContext] pRequestBody : ulImageBase = XXXXXXX
[00:02:07.359][AntiCpXCnt][SetMemoryScanContext] pRequestBody : nNumberOfCodeSections = 1
[00:02:07.359][AntiCpXCnt][SetMemoryScanContext] pRequestBody : CodeSectionIndex, ulStartAddress, ulSize = CodeSectionIndex = 0, uiStartAddress = XXXXXXX, uiSize = XXXXXXX
[00:02:07.359]{392018DA-8C28-4011-B6F8-F8AEB48CE117}
[00:02:07.359]{1B0D2D5C-95AE-4595-B16A-A1C795139E37}
[00:02:07.375]{D147F14F-F419-4B04-BEDF-A0C281031569} HASH : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[00:02:07.390]{BBD55FA1-C16F-4DE8-990E-70DCAFF79F5B}
[00:07:06.631][AntiCpXCnt][_AntiCpXCnt_MakeResponse] dwRequestLength = 40
[00:07:06.631]{8527FE8E-C58B-4572-9B50-11F0E3257B1B}
[00:07:06.631]{BBD55FA1-C16F-4DE8-990E-70DCAFF79F5B}
[00:07:06.647]{CEF81677-D587-4887-963C-0AC391A2B0E1} CRC : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[00:12:06.621][AntiCpXCnt][_AntiCpXCnt_MakeResponse] dwRequestLength = 40
[00:12:06.621]{8527FE8E-C58B-4572-9B50-11F0E3257B1B}
[00:12:06.652]{D147F14F-F419-4B04-BEDF-A0C281031569} HASH : XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
[00:12:06.668]{BBD55FA1-C16F-4DE8-990E-70DCAFF79F5B}

[razer951]

Can you upload all the logs and decrypted data you have anne post a link? Also maybe the decryption key?

[adam_j]

[harrybong1]

What about Esl.dll can you do anything in there? I recall something about cshell, is there anything you can do with it?