How did they patch .NET hacks?

[_cSharp]

So I remember a few years back that K2/G1 (not sure what the name was) patched .NET hacks somehow... at least they said they did...

Well, how is that possible, lol? What did they do? I'm sure its still possible to do hacks with C# and other .NET languages...

Mind telling me a few things about that patch and what they did? I couldn't find anything on Google...

Thanks!

[Tony906]

they removed external packet reading? D:

[~iToXiiC]

Well is not right, you can yet make hacks in .NET but not easyer as before and you need to work a lot on it

[Basser]

Create a proxy in .NET, they couldn't possibly patch that.
You can use it to hack

[Sleutel]

They did an update to the client that disabled (some) & detect memory modifications, this is however possible but they detect it.

[.BlackHat]

Originally Posted by Sleutel

They did an update to the client that disabled (some) & detect memory modifications, this is however possible but they detect it.

AFAIK Hackshield hooked a few functions which .NET calls on memory modification and such. So they detect that easily.

[+Yazzn]

In .NET you just called WinAPI's OpenProcess and Read/WriteMemoryProcess functions, but HackShield hooks them (I think they actually hook some underlying functions with their driver, but I'm too lazy to check that out now) and makes them unusable.

[Raz9r]

Originally Posted by Yazzn (:

In .NET you just called WinAPI's OpenProcess and Read/WriteMemoryProcess functions, but HackShield hooks them (I think they actually hook some underlying functions with their driver, but I'm too lazy to check that out now) and makes them unusable.

Actually it's some SSDT modifications/hooks detecting any call to those function on a system-wide level. The underlying functions are from ntdll.dll.

The way it works:
.NET marshals to Win32 API which calls the underlying NT functions which are hooked by Hackshields driver. There is a nice article about kernel-level SSDT hooks over .

[_cSharp]

Okay, can anyone PM me the current base address and coordY offset? I wanna try a function. As far as I could gather from info you supplied, the function should work.

Also, does the HS detect if you are reading the memory of War Rock or is only the memory writting stuff detected? If reading the memory isn't, it would be simple to make a memory aimbot with .NET, I guess?

[Raz9r]

It's entirely impossible without applying a driver unhooking the kernel-level SSDT hooks. That's why you'd need to inject a native DLL in the process: You don't really want to do that because it's a ******* mess.

An aimbot from an external program is not just almost impossible to do, but is gonna lag the sh*t out of you. Have fun trying that.