Info about AntiCheat Protection, Active in short time

[turkmmo]

ROHAN2 WORLD 1-120 TR TİPİ OFFICIAL YOHARA, BALATHOR VE AMON! 80. GÜNÜNDE! +10.000 ONLİNE! HİLE VE BOT %100 ENGELLİ HEMEN TIKLA!

It is attached to the game as pbcl.dll. It reads game memory directly.
Next time that make hashes of scanned memory. It generates few hashes
and next it hashes all generated hashes to and sends to game server.
Server compare hash and select game violation from databese. Once
if you changed d3d8 you should be kicked for Dissalowed Program/Driver.
It don't hooks any api functions that you can normally write to game memory.
That uses server to check memory

HACKSHIELD by AhnLab

It is attached to the game as ehsvc.dll and may loads other modules
like hsupdate.dll. It scans memory directly like pb and compares that
on client (LOL). So you can simply edit the compare from jne to jmp
and you got memory scan bypassed. (Idk whats with newest version)
It hooks low-level memory manipulation functions and some process-functions
with kernelmode via EagleNT.sys : NtOpenProcess, NtWriteVirtualMemory
NtTerminateProcess, NtReadVirtualMemory, NtMapViewOfSection.
It injects dll into all processes: ERGNAPX2.DLL and hooks some function from that.
Note: When i tried to hook Direct3DCreate8 thats alllow me to hack lol.
That not using server to check memory

XTRAP by WiseLogic

It is working with external process Xtrap.xt what controls the game.
It hooks low-level memory manipulation functions and some process-functions
with kernelmode via XDva???*.sys : NtOpenProcess, NtWriteVirtualMemory
NtTerminateProcess, NtReadVirtualMemory, NtMapViewOfSection.
It injects dll into all processes: XTrapVa.DLL and hooks some function from that.
??? - number of version i think (example XDva121.sys on JP WarRock)
That uses server to get good hashes but client compares it

GAMEGUARD by INCA

It is working with external process GameMon.des what controls the game.
Idk more about it. I know that scans memory through the driver.
It hooks all memory manipulation functions, keattachprocess and
some GUI functions like GetPixel, FindWindow, GetWindowThreadProcessID
with kernelmode and usermode. It generate hashes and sends to ggserver
what compare that with hashes stored in GameGuard database.
It injects dll into all processes: npggNT.des (ON NT SYSTEMs) and
npgg9x.des (ON 9x kernel based systems) and hooks some function from that.
That uses server to check memory