Driver to bypass Hackshield memory protection

From: http://www.gamedeception.net/threads/20450-Driver-to-bypass-Hackshield-memory-protection?s=dcbea4ca9540d0e50ddd2fba5dce425f

ONLY FOR EDUCATIONAL PURPOSES !
This software is an exploit, because they shouldn't call ZwQueryInformationProcess, they should use ObReferenceObjectByHandle instead.

INTRODUCTION
HackShield memory protection works by hooking some functions in kernel space. EagleNT.sys is checking all parameters passed to hooked functions and then it blocks or allows operation. When HS memory unprotector driver is loaded, you can use OpenProcess, WriteProcessMemory and ReadProcessMemory like normal.

HOW MEMORY PROTECTION WORKS ?
HackShield is replacing three functions (NtReadVirtualMemory, NtWriteVirtualMemory and NtOpenProcess) to protect game memory.

 


HOW TO BYPASS MEMORY PROTECTION ?
It's easy. We should take a look on NtWriteVirtualMemory function. 

 

As we can see, they are placing 'call' to EagleNT.sys function (call 0xA4A5C800).
Just go to this function (0xA4A5C800).

 

As we can see, they are using ZwQueryInformationProcess function to translate HANDLE to process id (bad idea btw.). We can hook ZwQueryInformationProcess and if EgaleNt.sys is calling this, we can return 0 (or fake number) as process id. Thats all !


Next we should hook NtOpenProcess with small re-implementation of this function.

DOWNLOAD
This source code is not perfect, but you can improve it.

 Attached Files

•  HS_UNP.rar (22.9 KB)

2012/12/01 補檔
HS_UNP.rar (22.9 KB)