Carbine banning for using Jadd's 32 bit forcer?

[Altnob]

It's hard to argue with Reddit. If you really did nothing wrong, submit a ticket and they will return your account.

Here's the culprit, as pointed out by SKU (InitializeRealmConnection @ 0x004276F0 [6760.3]):

They already said my account would not be overturned. As of now it's just a suspension but I'm sure it'll turn into a ban before Monday.

[Jadd]

As of now it's just a suspension but I'm sure it'll turn into a ban before Monday.

Maybe. Maybe not. It's hard to believe you didn't use anything else when your location is set to "nova-verify".

[Altnob]

Yea nova came out before the anti cheat was implemented. the day they patched it i nope'd right out of that. who makes a public announcement about implementing a warden?

[Jadd]

Yea nova came out before the anti cheat was implemented. the day they patched it i nope'd right out of that. who makes a public announcement about implementing a warden?

They implemented the server-side anti-cheat before they announced it.

[Master674]

They implemented the server-side anti-cheat before they announced it.

I havent seen any till now. What they do is do a /random upon login and if you have a bad day you'll be banned no matter if hack or not. Thats not something to consider an Anti-Cheat imo.

[iamclint]

I was just looking at this function and it appears that the isWow64Process is being used but the variables its setting is unused. I could be wrong but you might look again for yourself not sure if they had a hot patch or something for it. Unless i'm looking at this wrong

 v35 = (unsigned int)&v24 ^ __security_cookie;
  v2 = a1;
  v3 = dword_C738B4;
  _mm_store_si128((__m128i *)&v32, 0);
  v4 = *(_DWORD *)(v3 + 376);
  _mm_storel_epi64((__m128i *)&v33, 0);
  v23 = a2;
  hModule = (HMODULE)::hModule;
  _mm_storel_epi64((__m128i *)((char *)&v32 + 4), _mm_loadl_epi64((const __m128i *)(v3 + 336)));
  v6 = _mm_loadl_epi64((const __m128i *)(v3 + 344));
  HIDWORD(v33) = v4;
  v7 = *(_DWORD *)(v3 + 368);
  v26 = v2;
  ProcessType2 = 0;
  _mm_storel_epi64((__m128i *)((char *)&v32 + 12), v6);
  LODWORD(v32) = v7;
  ProcessType = 0;
  _IsWow64Process = GetProcAddress(hModule, "IsWow64Process");
  isWow64 = 0;
  if ( _IsWow64Process )
  {
    _CurrentProcessHandle = GetCurrentProcess();
    if ( ((int (__stdcall *)(HANDLE, int *))_IsWow64Process)(_CurrentProcessHandle, &isWow64) )
    {
      if ( isWow64 )
        ProcessType = 2;
    }
  }
  ProcessType2 = ProcessType;
  sub_4192B0(*(_DWORD *)(dword_C738B4 + 212), 1146, &v32);
  v10 = *(_DWORD *)(dword_C738B4 + 328);
  v11 = *(_DWORD *)(dword_C738B4 + 332);
  v28 = dword_C738B4 + 336;
  v29 = 16;
  v30 = 1328409489;
  v31 = 1905109255;
  LODWORD(v12) = sub_422A00(&v28);
  v13 = sub_9775C0(v10 + v12, (__PAIR__(v11, v10) + v12) >> 32, -1434480983, 0);
  v14 = v26;
  result = sub_419170(v16, v13, v15);
  if ( result >= 0 )
  {
    v18 = sub_510070(328, 0);
    if ( v18 )
      v19 = sub_414310(v18);
    else
      v19 = 0;
    if ( *(_DWORD *)(v14 + 84) && sub_414550(*(_DWORD *)(v14 + 84)) >= 0 && sub_423280(v19) >= 0 )
    {
      *(_DWORD *)(v14 + 76) = 3;
      v20 = *(_DWORD *)(v14 + 80);
      if ( v20 )
      {
        (*(void (__stdcall **)(_DWORD))(*(_DWORD *)v20 + 4))(*(_DWORD *)(v14 + 80));
        *(_DWORD *)(v14 + 80) = 0;
      }
      v21 = *(_DWORD *)(v14 + 28);
      if ( v21 )
        sub_489310(v21, (unsigned int)"NetworkStatus", &unk_B0BF13, v23);
      v22 = 0;
    }
    else
    {
      v22 = sub_427970(501422, 0);
    }
    if ( v19 )
      (*(void (__stdcall **)(int))(*(_DWORD *)v19 + 4))(v19);
    result = v22;
  }
  return result;

[Midi12]

I was just looking at this function and it appears that the isWow64Process is being used but the variables its setting is unused. I could be wrong but you might look again for yourself not sure if they had a hot patch or something for it. Unless i'm looking at this wrong

 v35 = (unsigned int)&v24 ^ __security_cookie;
  v2 = a1;
  v3 = dword_C738B4;
  _mm_store_si128((__m128i *)&v32, 0);
  v4 = *(_DWORD *)(v3 + 376);
  _mm_storel_epi64((__m128i *)&v33, 0);
  v23 = a2;
  hModule = (HMODULE)::hModule;
  _mm_storel_epi64((__m128i *)((char *)&v32 + 4), _mm_loadl_epi64((const __m128i *)(v3 + 336)));
  v6 = _mm_loadl_epi64((const __m128i *)(v3 + 344));
  HIDWORD(v33) = v4;
  v7 = *(_DWORD *)(v3 + 368);
  v26 = v2;
  ProcessType2 = 0;
  _mm_storel_epi64((__m128i *)((char *)&v32 + 12), v6);
  LODWORD(v32) = v7;
  ProcessType = 0;
  _IsWow64Process = GetProcAddress(hModule, "IsWow64Process");
  isWow64 = 0;
  if ( _IsWow64Process )
  {
    _CurrentProcessHandle = GetCurrentProcess();
    if ( ((int (__stdcall *)(HANDLE, int *))_IsWow64Process)(_CurrentProcessHandle, &isWow64) )
    {
      if ( isWow64 )
        ProcessType = 2;
    }
  }
  ProcessType2 = ProcessType;
  sub_4192B0(*(_DWORD *)(dword_C738B4 + 212), 1146, &v32);
  v10 = *(_DWORD *)(dword_C738B4 + 328);
  v11 = *(_DWORD *)(dword_C738B4 + 332);
  v28 = dword_C738B4 + 336;
  v29 = 16;
  v30 = 1328409489;
  v31 = 1905109255;
  LODWORD(v12) = sub_422A00(&v28);
  v13 = sub_9775C0(v10 + v12, (__PAIR__(v11, v10) + v12) >> 32, -1434480983, 0);
  v14 = v26;
  result = sub_419170(v16, v13, v15);
  if ( result >= 0 )
  {
    v18 = sub_510070(328, 0);
    if ( v18 )
      v19 = sub_414310(v18);
    else
      v19 = 0;
    if ( *(_DWORD *)(v14 + 84) && sub_414550(*(_DWORD *)(v14 + 84)) >= 0 && sub_423280(v19) >= 0 )
    {
      *(_DWORD *)(v14 + 76) = 3;
      v20 = *(_DWORD *)(v14 + 80);
      if ( v20 )
      {
        (*(void (__stdcall **)(_DWORD))(*(_DWORD *)v20 + 4))(*(_DWORD *)(v14 + 80));
        *(_DWORD *)(v14 + 80) = 0;
      }
      v21 = *(_DWORD *)(v14 + 28);
      if ( v21 )
        sub_489310(v21, (unsigned int)"NetworkStatus", &unk_B0BF13, v23);
      v22 = 0;
    }
    else
    {
      v22 = sub_427970(501422, 0);
    }
    if ( v19 )
      (*(void (__stdcall **)(int))(*(_DWORD *)v19 + 4))(v19);
    result = v22;
  }
  return result;

You declaration of sub_4192B0 is wrong, the variable you mention is used as parameters for this function.

[iamclint]

Thanks I didn't do any debugging into the game that was ida's declaration.

[Jadd]

Thanks I didn't do any debugging into the game that was ida's declaration.

Hex-rays dynamically creates function definitions for functions that haven't been analysed yet. Go make hex-rays disassemble this sub_4192B0 and then go back and disassemble the function that calls it, and you'll have the correct definition.

[iamclint]

Appreciate the tip

[aeo]

Update: I seem to have had my ban reversed 13 days after I made the ticket..I also got 2 game time codes for the loss of time. Seems pretty ridiculous.

[Jadd]

Update: I seem to have had my ban reversed 13 days after I made the ticket..I also got 2 game time codes for the loss of time. Seems pretty ridiculous.

I know it's annoying but you have to appreciate the fact that they are obviously trying hard to rectify the mistake.