hello,

Im trying to make a bypass, is it true that if u hook the createprocess + loadlibrary u have a fully bypass?

grz

No.

There is many ways to bypass Hackshield; you can evade it, or you can stop it. If you want to "evade it" then you'll need to make sure your code is undetectable by Hackshield. 5 Byte Trampolines may be required if you want to use a function which is under a local hook by Hackshield such as memcpy. There are many ways to evade it, but it gets harder when you want to stop it. If you plan on making a fully functional bypass, I suggest you hook the inner functions in Hackshield. Try debugging the dll's in hackshield with something like OllyDbg and find functions that it needs, then just tamper with them in your bypass.

To do a 5 byte trampoline, you can learn more with this article:

http://www.zonehacks.com/article/97/bypassing-hooks

To hook a function, you can learn more with this article:

http://www.zonehacks.com/article/95/hook-process-functions-via-dll-injection-cpp