| A basic understanding of how it hides itself. It works like a stealth injector, when the easymap.dll was originally loaded strait into the d2 process in memory, Warden (d2 anti cheat system) simply scanned loaded dll's and found the invalid easymap.dll and flagged the account for possible hack which then gave the d2 team the choice to ban or ignore.
The new hack uses something simililer to a stealth injector which on injection hides it from memory, renames it, destroys the headers and strips and encrypts the data making it invisible to scans in memory and other methods. This dosent mean that it will always work, Punk Buster is proof of that who has managed to find a method of detection even if this is used.
Though to counter this all they need to do is find the hooking method and detect its use and then ban. Assuming blizzard acctually keep interest in D2 which i doubt native hacks are truely going to get screwed if they are made public. | 
