Page 1 of 1

just asking

PostPosted: Wed Jan 05, 2011 2:31 am
by Petani
is there any possibility to search address in latest gg rev using mhs?

Re: just asking

PostPosted: Wed Jan 05, 2011 7:57 pm
by L. Spiro
No clue but MHS scripts give you the ability to undo any anti-cheat protections.


L. Spiro

Re: just asking

PostPosted: Thu Jan 06, 2011 7:28 am
by cobr_h
This is news to me! Any samples or theory reference somewhere on how to do it? If I see how it was done in earlier versions maybe it will be possible (for me) to replicate on modern xtrap/gameguards...

Re: just asking

PostPosted: Thu Jan 06, 2011 11:35 pm
by L. Spiro
Search the help file for “Hook Detection”.
It has been there all along.

ReadLocalMemory() and WriteLocalMemory() are all you need to modify any part of the kernel and undo any changes Game Guard may have made (ShowHooks() in the help file will show you plenty of hooks Game Guard has set).
Aside from removing existing hooks, you can add your own hooks.
This is necessary to defeat Game Guard because Game Guard checks its hooks and if it finds that you have removed them it will crash your PC.
You have to begin by inserting a hook on KiSwapThread() that puts the Game Guard hooks back when the Game Guard threads become active and removes them when any other thread becomes active.
This way Game Guard can’t see that you have modified its memory.

There are other ways also, such as tricking it to read a different copy of memory.


Although it seems advanced, many people are doing it, and MHS gives you all the tools you need to both study Game Guard and defeat it.
To be honest, I am a bit annoyed that no one has used these features after I spent so much time adding them for this purpose.


And the MHS source is available for download, so you can always make an undetected version if necessary.


L. Spiro

Re: just asking

PostPosted: Tue Jan 11, 2011 12:27 pm
by cobr_h
wh-? why didn't I think on the source code before!.. I think I forgot there were one. But what means now is to study this stuff of hooks. I am not dealing with gg but xtrap, but again I am sure they have the same philosophy.

I will study a little to make use of that stuff you had so much trouble to write for us. ;) thanks again

Re: just asking

PostPosted: Tue Jan 11, 2011 12:49 pm
by cobr_h
alright... I fail miserably finding MHS source code on the download page. Google failed me as well. All I could find is the source for a plugin to watch file activity by processes open by MHS. Am I too blind or is there a trick to find MHS source code?

Re: just asking

PostPosted: Tue Jan 11, 2011 3:39 pm
by L. Spiro

Re: just asking

PostPosted: Wed Jan 12, 2011 3:03 am
by cobr_h
thanks! Now I got x-trap rebooting my computer here and then. I am to study this hook stuff. I already have some questions but I suppose you expect us to find answers by self. If I exhaust trying I'll make a post and hope you are on good mood to help =]

About the source topic.. There are people that give nothing for learning, they just want the hacks done, someone to do the work -- not the hard work but the entire work -- for them. You really had a reason to quit developing MHS. But yet, there are 90% people willing to copypaste, and 10%... maybe less... willing to learn from your experience and maybe extend your work. In my opinion people who criticized you on that topic are into that 90%. "Oh, he quit. Now I will look for someone else who are doing hacks.". Some viruses ahead, they will end up finding some hack that work. Made from someone who studied not copypasted like they like to do.