How does MHS get around hooks & drivers?

[mystikfox]

Recently, one of the games I wrote a bot for began using GameGuard. Since the bot makes use of SendInput and Read/WriteProcessMemory, it currently no longer works.

So I figured I'd use system calls to get around GameGuard's hooks. This didn't quite work; and I assume it is because of GameGuard's driver (wmpi_dump or something long those lines) is still blocking input (since the input works just fine when GameGuard isn't loaded).

I see that MHS is easily able to get around any sort of protection. I'm actually quite impressed. The question is, how does MHS manage to do this? I think the only way would be to write a system driver, but that's a lot of work--especially considering all the small differences between operating systems and processor architectures. Maybe there's an easier way?

[L. Spiro]

Unfortunately I can not discuss MHS’s anti-anti-cheat methods; obviously the same information can be used by the wrong people.

However I can share what is common knowledge: MHS has a kernel-mode driver, and if you are planning to write one it will help but as you said it is considerable work, mostly because only a fraction of the DDK is actually documented, and when you make mistakes you don’t just close and retry again, you reboot, disk-scan, look through the FOUND.0XX folders for file parts that were lost and try to put them back together, etc.


L. Spiro

[mystikfox]

Of course; I wouldn't expect you'd give away the source code. Just the rough idea was enough, so thanks for your input.

Also, I think using a VM would work better for testing a kernel mode driver. It's quicker to just reset the VM than screw with all that mess.