So, everyone has heard of the NoX Server Shield. Hearing that it is the best ever and no one can hack against it. Well, when I didn't have internet I decided to reverse engineer it and figure out what was going on with it. The NoX Server Shield completely relies on the client to have the hooks generated into it. There are a total of two hooks that the client uses, one being on send (to store the socket) and the other on the decryption function to scan the packet for a certain one recieved. When a packet is recieved from the server the DR client scans throught he packet looking for a certain operation inside the packet at +0x8. If the operation is in range of what it needs to be, it will execute some shell code. Most of this shell code will add another hook on a function, such as chat output or ZPostSkill. The hooks being placed just check the address is < 0x00600000 or somewhere in that range. Knowing this we can just virtualallocate memory at 0x5E0000 or do a JMP with a fake return address. The DR anti-hack is a nice idea, but was implemented in a very bad manor. If Kolie wanted to actually work on something, he would know that checking the return address of a function isn't merly enough.
