Maybe able to bypass hack shield?

[tooty123]

i saw this on another forum and i thought id post it in case it came in handy, i don't know if it works and i don't take credit for this at all..

it just might be a solution This was submitted by a user named ZeoN


1. The Theory

When you can hook with 0xE9 or whatever... You can hook with this, with GetProcAddress() and memcpy(), detours, and MANY more....
Then the first thing is you suspend AVA.exe and open the debugger(I use the CheatEngine debugger).
After that you must know which APIs the process CAN hook to do some detection of as example cheat engine or any debugger...
For the detection of a process you can use the K32EnumProcess API... This is API lists an array of processes and looks for blacklist programs.
And for debugger detection the most hackshields uses IsDebuggerPresent. This is the standard debugger detection API. It returns true or false(bool). So you hook all of these APIs that could be dangerous for Cheat engine and our hack ...
In C++ you can do this with memcpy() and the opcodes!
So that's the basic way to bypass a hackshield by hooking.

2. How to do this?!

That's not very hard when you got knowledge of any programming language like C++ and the advanced windows APIs and you must have knowledge with any debugger(I use Cheat Engine) and the standard mnemonics. So first you open Cheat Engine and set it up for debugging services...
Then you suspend your process with the hackshield including and open it in cheat engine. Open the memory viewer(Ctrl+B). Rightclick on the panel and choose go to address: there you gonna type the bad API you want to hook. Try "IsDebuggerPresent". You see that this function is a function of the kernel32 library. Now you just get the address in our C++ project (dll) with GetProcAddress() and then you can overwrite it. Then you can search K32EnumProcesses as example and hook this, too. For a few games this is enough. You can hook many more APIs to prevent the detection.

3. The test

This method works on all games when you hook the right things AND you hook right.
I did not tested it on AVA but I tested this on a game called "S4League" and it worked.




AVA = Alliance of valiant arms (a shooter game) just replace AVA with s4league in ZeoN's theory <3

[zZzWeedZz]

can a hacker try to make a bypass with this info plz <3

[ExeraKun]

Originally Posted by tooty123

i saw this on another forum and i thought id post it in case it came in handy, i don't know if it works and i don't take credit for this at all..

it just might be a solution This was submitted by a user named ZeoN


1. The Theory

When you can hook with 0xE9 or whatever... You can hook with this, with GetProcAddress() and memcpy(), detours, and MANY more....
Then the first thing is you suspend AVA.exe and open the debugger(I use the CheatEngine debugger).
After that you must know which APIs the process CAN hook to do some detection of as example cheat engine or any debugger...
For the detection of a process you can use the K32EnumProcess API... This is API lists an array of processes and looks for blacklist programs.
And for debugger detection the most hackshields uses IsDebuggerPresent. This is the standard debugger detection API. It returns true or false(bool). So you hook all of these APIs that could be dangerous for Cheat engine and our hack ...
In C++ you can do this with memcpy() and the opcodes!
So that's the basic way to bypass a hackshield by hooking.

2. How to do this?!

That's not very hard when you got knowledge of any programming language like C++ and the advanced windows APIs and you must have knowledge with any debugger(I use Cheat Engine) and the standard mnemonics. So first you open Cheat Engine and set it up for debugging services...
Then you suspend your process with the hackshield including and open it in cheat engine. Open the memory viewer(Ctrl+B). Rightclick on the panel and choose go to address: there you gonna type the bad API you want to hook. Try "IsDebuggerPresent". You see that this function is a function of the kernel32 library. Now you just get the address in our C++ project (dll) with GetProcAddress() and then you can overwrite it. Then you can search K32EnumProcesses as example and hook this, too. For a few games this is enough. You can hook many more APIs to prevent the detection.

3. The test

This method works on all games when you hook the right things AND you hook right.
I did not tested it on AVA but I tested this on a game called "S4League" and it worked.




AVA = Alliance of valiant arms (a shooter game) just replace AVA with s4league in ZeoN's theory <3

I m not sure but HS detects the hook on EnumProcesses
So its would be easier to use the 5min bypass for scanning

A easy way is to hook game function before hs is loaded so it prob can t detect it

[Der-Eddy]

/moved