Hello community.

[cheyester10]

I have a sincere question about disabling HGWC. I have the file detection, the keep alive, the ban and thread functions. I'm coding a method to do the work for me. However I can't get it to work in ollydbg because I can't find a way to stop it from crashing. Any suggestions when I should disable those things to stop it from doing that?

[onahoe]

You've to suspend the threadr to avoid a dc..

[cheyester10]

I did, it still dc.

[onahoe]

Send me your code with a pn / skype. i'll take a look..

[cheyester10]

As I said, I can't code it if I can't get it to work in olly.

[Forbidi]

Are you getting crash after attaching the debugger ?
Try to use veh debugger or another ...

[cheyester10]

I'm getting crashed after I suspend and stuff then detaching.

[Omdi]

Did you already think about that the crash is caused by OllyDbg and not your patches?

[cheyester10]

It's not the patches. It's when I detach hgwc then unsuspend it crashes. I think it's because of the wrong jmps. Let me make sure.

[cheyester10]

Late reply, yea it's still crashing for some reason.

[Forbidi]

Originally Posted by cheyester10

I have a sincere question about disabling HGWC. I have the file detection, the keep alive, the ban and thread functions. I'm coding a method to do the work for me. However I can't get it to work in ollydbg because I can't find a way to stop it from crashing. Any suggestions when I should disable those things to stop it from doing that?

I understand from you first post that you don't really need a debugger like ollydbg cuz i thing that attaching a debugger to HGWC is detected. What you need is only to nope the function that you mention before, so like i said before just attach CE, search the function, and change opcodes nothing more, if you still have crash that's mean that HGWC don't get the return that he must get so it give a dc all what you have to do is backtrace the func and bypass it ;o

[cheyester10]

i backtraced the function and it still crashes for some reason. I think something is wrong with hgwc.exe hehe.

[cheyester10]

It's working now. I didn't run olly as admin. e.e