[Warning] Anti-cheat implemented, stop using any hack/bot (Proof inside)

[Valderic]

Not responding might as well be a false positive due to packet loss. I highly doubt the will ban you for not responding. They will use "Suspicious activities" if they ban you and you can get yourself unbanned quiet fast.

The game uses TCP, so they can reasonably expect there will be no packet loss. Banning for no response is not unreasonable here.

[@Home]

You are constantly changing servers.
My point is that they don't expect something to be send every second due to a slow connection and storing all checksums will break the servers. If you have 59 checksums instead of 60 they won't ban you.
It's more likely not responding ends up with a disconnect and a different flag.
It's not like you didn't pass the whitelist check.

[monkuar]

Hold the thread patch the function itself always pass the flag.
Doesn't look difficult to bypass.

You're a moron.

It's a heartbeat checksum. This means the checksum is GENERATED from the client, to the server. (Or in synchronization) (xx seconds, or whatever the case may be, op says 1 second). The client and gameserver check this periodically. It could be 2 seconds, 5 seconds, every 500ms, every 5 minutes, who knows. If the checksum or value is wrong, the server will disconnect you. XIGNCODE uses this heartbeat connection as well. Good luck bypassing this. Let me know when you can read their server files too. I'm sure their source code is available online... :shh:

[Evilwookie]

I dont know anything about coding so I can't follow this conversation at all, are you guys saying its safe or what

[Ouariasse]

Anything that changes crc of the base image of POE will trigger an alarm on their server. Aka any trainer out there will flag you. PoeHud will also flag you because it does write in memory afaik. I've heard people say it removes the search bar in your stash.
tl;dr : anything memory related isn't safe atm. Outside programs i'm not sure, they load dynamically stuff like EnumWindows, GetProcessFirst, GetProcessNext but i didn't see them called once.

[wookieTheSlayer]

Anything that changes crc of the base image of POE will trigger an alarm on their server. Aka any trainer out there will flag you. PoeHud will also flag you because it does write in memory afaik. I've heard people say it removes the search bar in your stash.
tl;dr : anything memory related isn't safe atm. Outside programs i'm not sure, they load dynamically stuff like EnumWindows, GetProcessFirst, GetProcessNext but i didn't see them called once.

yo good job on this trolling Chris... we know you cant scan processes on our pc, so gtfo and try better next time :gusta:

[@Home]

You're a moron.

It's a heartbeat checksum. This means the checksum is GENERATED from the client, to the server. (Or in synchronization) (xx seconds, or whatever the case may be, op says 1 second). The client and gameserver check this periodically. It could be 2 seconds, 5 seconds, every 500ms, every 5 minutes, who knows. If the checksum or value is wrong, the server will disconnect you. XIGNCODE uses this heartbeat connection as well. Good luck bypassing this. Let me know when you can read their server files too. I'm sure their source code is available online... :shh:

It doesn't prevent you to patch the function itself to generate valid checksums.
Freezing allows you to inject your code without being caught by a small chance. Of course you need to do some research how checksums are generated before that.

And you certainly have checked that they disconnect you? Because I don't see any people complaining here.

I will look into it myself in the evening.

@wookieTheslayer
You can easily get a list of processes running. It's a different story if you are cloaking them.
Warden did this quiet some time but hacks randomized the executable and modulenames.

[Ouariasse]

i still don't know what these do
dword_C8FF5C = sub_9C63C0(&unk_C75578, (int)dword_C8FF60);
dword_C8FF7C = sub_9C63C0(&unk_C755B4, (int)dword_C8FF60);
dword_C8FF40 = sub_9C63C0(&unk_C755C4, dword_C8FF50);
dword_C8FF20 = sub_9C63C0(&unk_C755D4, (int)dword_C8FF60);
dword_C8FF6C = sub_9C63C0(&unk_C755E4, (int)dword_C8FF60);
dword_C8F70C = sub_9C63C0(&unk_C755F4, (int)dword_C8FF60);
dword_C8FF68 = sub_9C63C0(&unk_C75604, (int)dword_C8FF60);
dword_C8FF78 = sub_9C63C0(&unk_C75614, (int)dword_C8FF60);
dword_C8FF74 = sub_9C63C0(&unk_C75624, (int)dword_C8FF60);
each of them loads a specific base address of a function and returns it but it doesn't get set anyway..... i think they plan or already did to global hook these functions to monitor them
Some of them are ReadProcessMemory, CreateRemoteThread, VirtualAlloc. You might wanna be careful when you use/hook those functions i think they're monitored too this is pure speculation i haven't reversed that part at all yet.

[arthemis1er]

If you dont use stuff that modifies the memory i guess you are safe. I guess only zoomhack and maphack modifies the memory as it has to send stuff to the client.
However other stuffs from Autopots to showing items on minimap (overlay) should be safe, no ?

[paradox404]

I hope at least the autopot isnt detected.

[StrongBG]

I dont know if this will help but,i got 1 friend who was botting with exiled bot with 2 accounts for months and apperantly after this patch exiled bot was working and he continued botting and he got banned this morning...No bans for months and after this patch insta banned the next day.Good that im using exilebuddy and the bot wasnt working,cuz prolly i would have been banned too...

[Treasure_Box]

Interesting(good), Coyls post was removed. Honestly didn't think the mods where active in this part of the forums.

[Debordes]

Interesting(good), Coyls post was removed. Honestly didn't think the mods where active in this part of the forums.

Was he trolling or something?

[paradox404]

Was he trolling or something?

He basically said he is done and wanted to sell his domain poehud.com

[hbm5006]

I'm very curious to see if this can flag for just reading memory as well. If that isn't the case we could still use a simple loot alert that only reads from memory. It could just play a sound if something good drops without actually modifying the client.