[Warning] Anti-cheat implemented, stop using any hack/bot (Proof inside)

[Ouariasse]

This is actually great that they notify users. Makes writting a bypass way easier. Won't disclose much information. Also it's funny how i didn't get flagged with all the shit i tried. Probably cause i don't maphack or use the hud.

[HvC]

This is actually great that they notify users. Makes writting a bypass way easier. Won't disclose much information. Also it's funny how i didn't get flagged with all the shit i tried. Probably cause i don't maphack or use the hud.

anything interesting in the new update ?

[Kapsel498]

They are not gonna notify you anymore, it was just once next time every detected using cheats will trigger account lock.

[enaf3n]

anything interesting in the new update ?

Nothing new.

[Ouariasse]

offset for new patch

FinalCheck                                            .text 009C7350 0000003D                   R . . . . . .
LoadAndCommunicate                                    .text 009C7390 00000084 00000004 00000004 R . . . . T .
CheckDebugger                                         .text 009C7420 00000098 00000000 00000000 R . . . . . .
std::_Ref_count_base::_Get_deleter(type_info const &) .text 009C74B8 00000005 00000000 00000000 R . L . . T .
CheckCheatThread                                      .text 009C74F0 000000DD 0000001C 00000000 R . . . . . .
LoadAC                                                .text 009C7660 00000052                   R . . . . . .
LoadFromEncryptedName                                 .text 009C76C0 00000078 00000000 00000004 R . . . . . .
InitAC                                                .text 009C7740 00000263 00000004 00000000 R . . . . . .
myHash                                                .text 009C79B0 00000022                   R . . . . . .
Checksum                                              .text 009C79E0 00000034                   R . . . . . .
CheckThreadEvent                                      .text 009C7A20 00000079 00000000 00000004 R . . . . . .
CheckExceptionEvent                                   .text 009C7AA0 00000061 00000004 00000000 R . . . . . .
getDecryptedModuleName                                .text 009C7B10 0000004D 0000000C 00000004 R . . . . T .
getPoeHandle                                          .text 009C7B60 0000005E                   R . . . . . .
GetSuspiciousProcessHandle                            .text 009C7BC0 00000093 0000013C 00000000 R . . . . . .
rndbetween1and15                                      .text 009C7C60 0000004A 0000000C 00000000 R . . . . . .
decrypt                                               .text 009C7CB0 00000061 00000020 00000000 R . . . . . .
getFlagForAction                                      .text 009C7D20 000001A1 00000018 00000008 R . . . . T .
check1                                                .text 009C7ED0 00000082 00000004 0000000C R . . . . . .
check2                                                .text 009C7F60 0000004D 00000010 00000000 R . . . . . .
check3                                                .text 009C7FB0 0000004D 00000010 00000000 R . . . . . .
check4                                                .text 009C8000 00000052 00000014 00000000 R . . . . . .
check5                                                .text 009C8060 0000004C 00000010 00000000 R . . . . . .
check6                                                .text 009C80B0 00000050 0000000C 00000000 R . . . . . .
CheckMaliciousModuleName                              .text 009C8100 000000CD 00000234 00000004 R . . . . . .
CheckMaliciousExeName                                 .text 009C81D0 000000B3 00000138 00000004 R . . . . . .
PatternScanner                                        .text 009C8290 000000A9 00000034 0000000C R . . . B . .
CheckForPatternInsidePoeMemory                        .text 009C8340 00000065 00000000 00000004 R . . . . . .
CheckForPatternInsideMaliciousProcess                 .text 009C83B0 000000DD 00000068 00000004 R . . . . . .
CheckWindowText                                       .text 009C8490 000000C3 0000010C 00000008 R . . . . . .
CheckForUnmappedMemorySpace                           .text 009C8560 000000AB 00000134 00000000 R . . . . . .

The debug thread makes sure you don't see INT3 or hardware breakpoints while PoE is running.

[HvC]

offset for new patch

FinalCheck                                            .text 009C7350 0000003D                   R . . . . . .
LoadAndCommunicate                                    .text 009C7390 00000084 00000004 00000004 R . . . . T .
CheckDebugger                                         .text 009C7420 00000098 00000000 00000000 R . . . . . .
std::_Ref_count_base::_Get_deleter(type_info const &) .text 009C74B8 00000005 00000000 00000000 R . L . . T .
CheckCheatThread                                      .text 009C74F0 000000DD 0000001C 00000000 R . . . . . .
LoadAC                                                .text 009C7660 00000052                   R . . . . . .
LoadFromEncryptedName                                 .text 009C76C0 00000078 00000000 00000004 R . . . . . .
InitAC                                                .text 009C7740 00000263 00000004 00000000 R . . . . . .
myHash                                                .text 009C79B0 00000022                   R . . . . . .
Checksum                                              .text 009C79E0 00000034                   R . . . . . .
CheckThreadEvent                                      .text 009C7A20 00000079 00000000 00000004 R . . . . . .
CheckExceptionEvent                                   .text 009C7AA0 00000061 00000004 00000000 R . . . . . .
getDecryptedModuleName                                .text 009C7B10 0000004D 0000000C 00000004 R . . . . T .
getPoeHandle                                          .text 009C7B60 0000005E                   R . . . . . .
GetSuspiciousProcessHandle                            .text 009C7BC0 00000093 0000013C 00000000 R . . . . . .
rndbetween1and15                                      .text 009C7C60 0000004A 0000000C 00000000 R . . . . . .
decrypt                                               .text 009C7CB0 00000061 00000020 00000000 R . . . . . .
getFlagForAction                                      .text 009C7D20 000001A1 00000018 00000008 R . . . . T .
check1                                                .text 009C7ED0 00000082 00000004 0000000C R . . . . . .
check2                                                .text 009C7F60 0000004D 00000010 00000000 R . . . . . .
check3                                                .text 009C7FB0 0000004D 00000010 00000000 R . . . . . .
check4                                                .text 009C8000 00000052 00000014 00000000 R . . . . . .
check5                                                .text 009C8060 0000004C 00000010 00000000 R . . . . . .
check6                                                .text 009C80B0 00000050 0000000C 00000000 R . . . . . .
CheckMaliciousModuleName                              .text 009C8100 000000CD 00000234 00000004 R . . . . . .
CheckMaliciousExeName                                 .text 009C81D0 000000B3 00000138 00000004 R . . . . . .
PatternScanner                                        .text 009C8290 000000A9 00000034 0000000C R . . . B . .
CheckForPatternInsidePoeMemory                        .text 009C8340 00000065 00000000 00000004 R . . . . . .
CheckForPatternInsideMaliciousProcess                 .text 009C83B0 000000DD 00000068 00000004 R . . . . . .
CheckWindowText                                       .text 009C8490 000000C3 0000010C 00000008 R . . . . . .
CheckForUnmappedMemorySpace                           .text 009C8560 000000AB 00000134 00000000 R . . . . . .

The debug thread makes sure you don't see INT3 or hardware breakpoints while PoE is running.

any new patterns it's looking for ?

[Sikas]

Is the account lock right away though? So if I create an account, run it.. I should be given a warning and then banned right?

[MEARSHEIMER]

So. Are we ****ed? or is this a bluff?

How can I help?

[Ouariasse]

it's still the same checks, another check worth doing is rename the folder you're running your scrambled poehud from.
don't do C:\poehud\mylittleponey.exe for your poehud, you'll be ****ed.
What's detected :
if the imagefile of poe changes, if there are unmapped memory (code injection), dll injection, memory modification (through scanning if it exist or doesn't), opened exe filename, loaded dll filename, folder name, window name of opened processes, if a int3 or single_step event fires inside poe, if a new thread is created from unknown base address, known signature in opened processes and i think that's it.

Sadly because of the feature of this antihack and how often GGG updates I don't think i'll maintain a patcher publicly, only private if i do ever make one.

[FrankTheCrazy]

it's still the same checks, another check worth doing is rename the folder you're running your scrambled poehud from.
don't do C:\poehud\mylittleponey.exe for your poehud, you'll be ****ed.
What's detected :
if the imagefile of poe changes, if there are unmapped memory (code injection), dll injection, memory modification (through scanning if it exist or doesn't), opened exe filename, loaded dll filename, folder name, window name of opened processes, if a int3 or single_step event fires inside poe, if a new thread is created from unknown base address, known signature in opened processes and i think that's it.

Sadly because of the feature of this antihack and how often GGG updates I don't think i'll maintain a patcher publicly, only private if i do ever make one.

At this point people just want to know if the memread only version is safe and AFAIK the answer is yes*

*for now

[enaf3n]

At this point people just want to know if the memread only version is safe and AFAIK the answer is yes*

*for now

Yes, for now, it isn't being detected. However, as it stands, the capability is certainly there within the anti-cheat to detect it in the future.

[Ouariasse]

For people who pm'd me i think i answered everyone.
For those asking me to write a bypass : I won't release a public patcher because of :reasons:
I think reversing it publicly was enough already and if you want to maphack that badly either make your own patcher or hire/ask a dev to do it for you.
Everything to work with the current AC is here.

[gep666]

so if u play on another account/steam account but on the same PC and u get caught using cheats do they ban both of your accounts or just the one using the cheats ?

[crazyden85]

both (10 boths)

[mareot]

No, open handles aren't currently checked, there's actually no point in doing this since it's not the ReadProcessMemory that's detected it's writing to it and/or commonly used hack names more accurately a hash of the name of an program it compares the crc32 of the program and the one it has on it's blacklist if the crcs match at at least 90% you are flagged, if you write to the memory in a certain specific way (eg: maphack) you are flagged. This is it.

What would happen when anti cheat tries to find (hash of the name of an program) crc32 of the program and founds nothing in the memory, no programs running. Will that get me flagged aswell ?