Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


HackShield
Goto page 1, 2  Next
 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking
View previous topic :: View next topic  
Author Message
skyw4rrior
Advanced Cheater
Reputation: 0

Joined: 21 Aug 2005
Posts: 67

PostPosted: Tue Mar 28, 2006 10:30 am    Post subject: HackShield Reply with quote

Does someone know how hackshield hides GunBound from all app process list? And how can we disable it, turning the game visible to any app (like WPE)?
Back to top
View user's profile Send private message
skyw4rrior
Advanced Cheater
Reputation: 0

Joined: 21 Aug 2005
Posts: 67

PostPosted: Tue Mar 28, 2006 12:51 pm    Post subject: Reply with quote

hackshield is an anti-hack system like nprotect.. but it appears to have different methods of detection and protection..

Here is the link for the official hackshield home page
http://www.hackshields.com/

If u want to download gunbound (brazillian) to look at, take it at this link:
http://61.74.68.173/GBS/Gunbound_GBS_WC_440.exe

and here is the hackshield files (and the game executabe named gunbound.gme too) that are donwloaded by the game. Take a look at it..
http://rapidshare.de/files/16654002/GunboundWC.zip.html


I think that someone who have a good asm knowledge could understand how it works..
--> Hackshield hides the game process from processes lists and block any app from using it handles or use some apis on it (as writeprocessmemory, openprocess, readprocessmemory...)


Last edited by skyw4rrior on Fri Mar 31, 2006 6:40 am; edited 1 time in total
Back to top
View user's profile Send private message
Dark Byte
Site Admin
Reputation: 457

Joined: 09 May 2003
Posts: 25262
Location: The netherlands

PostPosted: Wed Mar 29, 2006 1:06 am    Post subject: Reply with quote

did gunbound change from nprotect to hackshield? Because last time i checked (a 3 weeks or so) it used nprotect
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.

Like my help? Join me on Patreon so i can keep helping
Back to top
View user's profile Send private message MSN Messenger
rEdoX
How do I cheat?
Reputation: 0

Joined: 29 Mar 2006
Posts: 6

PostPosted: Wed Mar 29, 2006 4:29 am    Post subject: Reply with quote

Ill try to hack hackshield for a long time some here infos:

-hackshield loads a driver to hide and protected himself.
-Hackshield detects many gamehacking tools e.g.: (SoftICE,OllyDBG,CheatEngine,ArtMoney,WPE (PRO) , ...)
-Cant inject dlls when hackshield is loaded(Solution: CreateProcess Suspended -> inject dll(s) -> and resume it)
-CheatEngine is the only tool who can see the game process, that hackshield trys to hide, but cant open it
-Hook LoadLibraryA/W and abort if hackshield trys to load dlls dont work.

greetz
Back to top
View user's profile Send private message
skyw4rrior
Advanced Cheater
Reputation: 0

Joined: 21 Aug 2005
Posts: 67

PostPosted: Wed Mar 29, 2006 9:22 pm    Post subject: Reply with quote

yeh.. hackshield is a powerfull antihacking system.. i know a boy that made a bypass for hackshield.. i dont know how he did it.. but his bypass stops hackshield from detecting hacks and hidding gunbound process, allow gunbound to open into a window and allow many instances of gunbound to be opened at the same time...

Hackshield is a good exchange for that who like programming and hacking games ... if someone of u interest in it post ur suggestions here


--------
Back to top
View user's profile Send private message
skyw4rrior
Advanced Cheater
Reputation: 0

Joined: 21 Aug 2005
Posts: 67

PostPosted: Wed Mar 29, 2006 9:43 pm    Post subject: Reply with quote

Dark Byte wrote:
did gunbound change from nprotect to hackshield? Because last time i checked (a 3 weeks or so) it used nprotect


I dont Know about gbwc international, i think it did, but gunbound brazil changed long time ago.. sure times ago, hackshield was not so powerfull as now.. they applyed many new security methods, because it was very easy to hack and the brazilian hackers was working harder on hacking it..


Last edited by skyw4rrior on Wed Mar 29, 2006 10:13 pm; edited 1 time in total
Back to top
View user's profile Send private message
skyw4rrior
Advanced Cheater
Reputation: 0

Joined: 21 Aug 2005
Posts: 67

PostPosted: Wed Mar 29, 2006 10:09 pm    Post subject: Reply with quote

rEdoX wrote:
Ill try to hack hackshield for a long time some here infos:

...
-Cant inject dlls when hackshield is loaded(Solution: CreateProcess Suspended -> inject dll(s) -> and resume it)
...


yeah.. i've alread did it.. I Hooked crateprocess, and injected my dll..
This way we have total control from it (the game memory)... but the question is what to do now? how can we stop hackshield? I can write or read the game memory now, but i want to disable hackshield

---------- ERGNAPX2.DLL
If u take a look at all processes opened on the computer, u ll see that hackshield injected a dll on all it - ERGNAPX2.DLL
I dont know what it do... perhaps it give some extra information about the processes to hackshield, as strings (for hacking detection) , and other memory infos..
---------- V3PRO32S.DLL
I know that V3PRO32S.DLL is the detection library.. the one that hackshield uses to detect the hacks.. it is easy to hack by now... it is not more important that the hidding library (or driver, i'm not sure what do this)
---------- V3WARPNS.V3D AND V3WARPDS.V3D
Are encrypted text files that contain the information about each hack detected by hackshield.. they r the hacklist ^^ (sory my english is poor)
---------- V3PRO32S.DLL
This is the most important library of hackshield.. this one loads all the other libraries, inject, load the driver,... It is hackshields heart XD
---------- EAGLENT.SYS
The Hackshields driver... it is located on ...\Windows\System32\Drivers
and is hidden... i've tryed to use net.exe or dameware to stop it from running when gunbound is active but didnt worked =\

If u or someone could analyse it, plz post the informations u discover here
Back to top
View user's profile Send private message
holyman
Master Cheater
Reputation: 0

Joined: 08 Oct 2005
Posts: 347

PostPosted: Fri Mar 31, 2006 7:54 am    Post subject: Reply with quote

can it also stop trainers? (not CS but TMK types) ?
Back to top
View user's profile Send private message
skyw4rrior
Advanced Cheater
Reputation: 0

Joined: 21 Aug 2005
Posts: 67

PostPosted: Fri Mar 31, 2006 8:10 am    Post subject: Reply with quote

holyman wrote:
can it also stop trainers? (not CS but TMK types) ?


I don't know about trainer makers... but I think they use apis for reading and writting the game memory... if i'm correctly, the answer is YES. Hackshield block the memory access to the game by hooking common apis used in this action, like WriteProcessMemory, ReadProcessMemory, OpenProcess, ...
As rEdox said, the only way to get access to the game is injecting ur dll into it, in the moment of the Create Process. Anotherelse, only bypassing hackshield
Back to top
View user's profile Send private message
FSSBpro
How do I cheat?
Reputation: 0

Joined: 24 May 2008
Posts: 9

PostPosted: Mon May 26, 2008 11:28 pm    Post subject: Reply with quote

i know this topic is old and thats why people are not posting
can u find out more about this and try to hack it someone?
Back to top
View user's profile Send private message
arnold111
How do I cheat?
Reputation: 0

Joined: 10 Dec 2007
Posts: 5
Location: philippines

PostPosted: Mon Jun 02, 2008 2:43 am    Post subject: Reply with quote

I know how to disable it. You must stop it from running its library so that it will not detect CE. There are a lot of ways in doing so.

1st way is to alter its libraries or dll files
2nd i wont tell you
3rd its up to you

_________________
There is always an easy way
Back to top
View user's profile Send private message Yahoo Messenger
ernie
Expert Cheater
Reputation: 0

Joined: 05 Oct 2007
Posts: 123

PostPosted: Mon Jun 02, 2008 8:34 am    Post subject: Reply with quote

arnold111 wrote:
I know how to disable it. You must stop it from running its library so that it will not detect CE. There are a lot of ways in doing so.

1st way is to alter its libraries or dll files
2nd i wont tell you
3rd its up to you


That might work if the hackshield is a couple years old. Almost no one has such a crappy version of hackshield anymore. Welcome to last year.
Back to top
View user's profile Send private message
FSSBpro
How do I cheat?
Reputation: 0

Joined: 24 May 2008
Posts: 9

PostPosted: Mon Jun 02, 2008 7:18 pm    Post subject: Reply with quote

how do u alter its dll files?
Back to top
View user's profile Send private message
arnold111
How do I cheat?
Reputation: 0

Joined: 10 Dec 2007
Posts: 5
Location: philippines

PostPosted: Fri Jun 06, 2008 1:04 am    Post subject: Reply with quote

just list the dll files inside the hackshield.
if its different then its new if not then its all the same thing (old )


is the game you been cheating an online game?

_________________
There is always an easy way
Back to top
View user's profile Send private message Yahoo Messenger
FSSBpro
How do I cheat?
Reputation: 0

Joined: 24 May 2008
Posts: 9

PostPosted: Fri Jun 06, 2008 9:33 pm    Post subject: Reply with quote

these are the files:
AhnUpCtl.dll
AhnUpGS.dll
Bz32Ex.dll
EGRNAP.dll
EGRNAPX2.dll
EhSvc.dll
HSInst.dll
mspatcha.dll
psapi.dll
V3Hunt.dll
V3InetGS.dll
v3pro32s.dll

yes and it is an online game
do you know how to disable it?
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General Gamehacking All times are GMT - 6 Hours
Goto page 1, 2  Next
Page 1 of 2

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites