From: http://www.gamedeception.net/threads/20450-Driver-to-bypass-Hackshield-memory-protection?s=dcbea4ca9540d0e50ddd2fba5dce425f ONLY FOR EDUCATIONAL PURPOSES ! This software is an exploit, because they shouldn't call ZwQueryInformationProcess, they should use ObReferenceObjectByHandle instead. INTRODUCTION HackShield memory protection works by hooking some functions in kernel space. EagleNT.sys is checking all parameters passed to hooked functions and then it blocks or allows operation. When HS memory unprotector driver is loaded, you can use OpenProcess, WriteProcessMemory and ReadProcessMemory like normal. HOW MEMORY PROTECTION WORKS ? HackShield is replacing three functions (NtReadVirtualMemory, NtWriteVirtualMemory and NtOpenProcess) to protect game memory.