[Warning] Anti-cheat implemented, stop using any hack/bot (Proof inside)

[SeUbZer0]

Just wanted to share two quotes from user ******* The first is from 5-8-2015. The second is shortly after the "134 ban wave" on 7-10-2015.


5-8-2015


7-10-2015



Hopefully this helps how people view what the Developer of the Game is doing, and how to be smart when using utilities during one's gaming experiences.

7-11-2015

Decrypted strings from 2.0.0c
0xa26c18 => ntdll.dll
0xa26c24 => kernel32.dll
0xa26c34 => user32.dll
0xa26c44 => advapi32.dll
0xa26c54 => LdrGetDllHandle
0xa26c68 => LdrGetProcedureAddress
0xa26c84 => LdrQueryProcessModuleInformation
0xa26ca8 => NtAllocateVirtualMemory
0xa26cc4 => NtCreateFile
0xa26cd4 => NtDuplicateObject
0xa26ce8 => NtFreeVirtualMemory
0xa26d00 => NtGetTickCount
0xa26d14 => NtQueryInformationFile
0xa26d30 => NtQueryInformationProcess
0xa26d4c => NtQueryObject
0xa26d5c => NtQueryPerformanceCounter
0xa26d78 => NtQuerySystemInformation
0xa26d94 => NtQueryVirtualMemory
0xa26dac => NtReadFile
0xa26dbc => NtSetInformationThread
0xa26dd8 => AdjustTokenPrivileges
0xa26df0 => CloseHandle
0xa26e00 => ContinueDebugEvent
0xa26e18 => CreateThread
0xa26e28 => CreateToolhelp32Snapshot
0xa26e44 => DebugActiveProcess
0xa26e5c => GetCurrentProcess
0xa26e70 => GetCurrentProcessId
0xa26e88 => GetCurrentThread
0xa26e9c => GetProcessId
0xa26eac => GetNativeSystemInfo
0xa26ec4 => LookupPrivilegeValueA
0xa26edc => Module32First
0xa26eec => Module32Next
0xa26efc => OpenProcessToken
0xa26f10 => WaitForDebugEvent
(rebased at 0xC0000)

[enaf3n]

Just wanted to share two quotes from user ******* The first is from 5-8-2015. The second is shortly after the "134 ban wave" on 7-10-2015.


5-8-2015


7-10-2015



Hopefully this helps how people view what the Developer of the Game is doing, and how to be smart when using utilities during one's gaming experiences.

Definitely an "I told you so" moment. Sadly it also affected my own hack, so I was just as naive.

[snakescrin]

Is gurud multiscript autopot banable in 2.0?

[enaf3n]

We will know more over the next few days.

[Migunne]

In how much " few days " you say Maper ? I need zoom out and MH ¬¬'

[HvC]

Jesus, the entitled people in here...

Anyway I have reason to believe the new AC features are only targeted at maphackers, although since I can't get them to load for dynamic analysis I can't tell you precisely what's going on.

[dodger]

I used maphack on the 1st day and didn't get ban or a warning, its pretty funny when they say they wanted the laptop race to be fair

[pootisbb]

I believe that's exactly the case.
Day 1 I was using ONLY the Gurud's maphack and I got hit.
I wonder tho if they're scanning movement patterns or anything overall so that only maphack is bannable and fullbright + zoomhack are not.

I used maphack on the 1st day and didn't get ban or a warning, its pretty funny when they say they wanted the laptop race to be fair

As far as the hack makers know the new anticheat can be toggled on and off, so the hack makers have been having a hard time finding out how it works. The new anticheat may only detect memory writing when it is toggled on, since only people who used hacks which wrote to memory like maphack, zoomhack were banned, while people using autoflask which only reads memory weren't touched. Of course, everything is still uncertain.

[enaf3n]

JAnyway I have reason to believe the new AC features are only targeted at maphackers, although since I can't get them to load for dynamic analysis I can't tell you precisely what's going on.

They seem to have stepped up their game. Just based on the decrypted imports alone, I would say they have refined their out of process detection quite a bit. It also seems to be a lot more flexible than it was before, from the limited analysis I've done. But as you say, it seems like it isn't being called right now. Maybe they plan to activate it in short bursts like they did just recently with the laptop competition?

[SummerDaysAhead]

process detection can only go as far as to catch public things right? they arent going to be reading your code/source (even if not compiled) are they? isnt that pushing the legal limit? what is it they would start to use it against if it was better process detection? or do you just mean for things like CE/Olly/Ect... i really am not enjoying the game nearly as much without zoom but ive been basically playing legit and all i can think of is i wish i could zoom so i could enjoy the game and buy some MTX -- but sense i want to zoom i fear i may chance my account and then buying that MTX was a bad move so its like GGG is just making enough money that they dont care they are dumping anything the light cheaters would be spending, unless the maphack was really the only thing attacked in which then if they would SAY That i would be happy to buy MTX and enjoy the game! and also would be nice for others with computers that cant handle to use particle reduction type hack....

[manutdrule]

probably only to activate it every now and then when race season starts to catch more cheaters

[enaf3n]

process detection can only go as far as to catch public things right? they arent going to be reading your code/source (even if not compiled) are they? isnt that pushing the legal limit? what is it they would start to use it against if it was better process detection? or do you just mean for things like CE/Olly/Ect... i really am not enjoying the game nearly as much without zoom but ive been basically playing legit and all i can think of is i wish i could zoom so i could enjoy the game and buy some MTX -- but sense i want to zoom i fear i may chance my account and then buying that MTX was a bad move so its like GGG is just making enough money that they dont care they are dumping anything the light cheaters would be spending, unless the maphack was really the only thing attacked in which then if they would SAY That i would be happy to buy MTX and enjoy the game! and also would be nice for others with computers that cant handle to use particle reduction type hack....

I suspect their out-of-process detection is for bots and such.

Maphack and zoomhack are always going to have to modify the game's memory (any reasonable implementation anyway, if someone wants to write a maphack by redrawing shit to the screen be my guest), and so will always be inherently unsafe.

[SummerDaysAhead]

Well, unless you reverse the AC and give results it expects for those scans... but i dont know what kind of work/skill that requires as i have never tried...

ALSO i noticed Gurud method was using SE one way but there is a completely separate way to do it, where instead of making a code cave and hiding your changed code and reading from there, you make a copy of the source and have the AC read from that copy and alter the original... not sure if that would be any more effective...

[HvC]

You don't really need to do anything as excessive really I'm not going to write down what I do but really you can pretty easily catch and manipulate the ac, well the old bits, I cannot get anything new to load...

[Migunne]

Someone its playing with zoom out without knowing us ?. Come on its almost 2 weeks with the shit GGG zoom system