Warning Interaction class it detected in memory

[JohnDeere6996]

I was just sent an email from my friend that bot busted and banned from twl. he got busted in the [106] clan server they are runing some kind of test pb checks. called 1.6test. and it can detect your interaction class in memory. because he was using drew loader with just an intraction bot. but he didnt get kicked or anything. so just fyi. stay away from 106 clan server. i dont know if any other server is running this but it looks like something macgyver made.

a_riDiscovered=(szName="[eXt]Chico...",szUBI_ID="Dadda6996",szIP="69.161.239.7:1477",szClassName="Engine.InteractionMaster.bitch0",szAttemptedParse="Engine.InteractionMaster.bitch0",szTimeStamp="2005/10/27 4 20:55:47:581")

[ALBerT]

there was somthing funny i noticed in the nurv server.. my class names where getting picked up on cvar.. i renamed them twice and still got picked up. . . somthing is going down im sure

[JohnDeere6996]

so i guess that the stuff macgyver was talking about on the twl forums. a mod that can detect your interaction class.

[superdupe]

ITS ABOUT TIME
pb has been noobing around for a long time... this was something they could have done so long ago... i dunno what took so long.... but its good cuzits gonna stop every noob in the word from having a free hack..... people are gonna have to start to learn how to code on your own

[RuffianSoldier]

LOL Steven you make a great point :)

Sucks though - I found a new way to load my bot and now this craps out, now I gotta get MacGyver's mod decompiled and I can be undetected again

[Jack D]

Hey guys wow been busy oh btw my good clan mate has already found a way past this and will be filling me in with more info tomarow :)

[Diddle]

There is really no need to bring up a user's attitude/whatever when he/it has nothing to do with this thread at all. Please refrain from posting dislikings of other users when it has nothing to do with the current topic. Thanks. :)

[ALBerT]

we have been buggered :(... i found this copy of it in the PsB forums

http://www.tfxclan.com/Downloads/PublicAnticheat/FeedPiranhas_B1.00.zip

http://www.punksbusted.com/forums/index.php?showtopic=15742

[KizZamP-]

i just decompiled it,and just saw that macgyver infact is damn leet lol,i eat my words from earlier...

[ALBerT]

Here it is decompiled...

http://lynchmobclan.com/decompiled.txt

What do the unknown functions mean???

[KizZamP-]

ok i will,i'm just cleaning some code of it up a bit.
EDIT = i cleaned it up,here it is,decompiled,but you still need to find out what all the unknownfunctions mean if you want to understand what he wrote there.(check attachment).

[noob-cheater]

File: decompiledpiranha.rar
Status: OK
MD5: b9b3505acaf6baeffe23411d805cb21d
Packers Detected: -

Scanner Results
AntiVir: Found Nothing
ArcaVir: Found Nothing
Avast: Found Nothing
AVG Antivirus: Found Nothing
BitDefender: Found Nothing
ClamAV: Found Nothing
Dr. Web: Found Nothing
F-Prot Antivirus: Found Nothing
Fortinet: Found Nothing
Kaspersky Anti-Virus: Found Nothing
NOD32: Found Nothing
Norman Virus Control: Found Nothing
UNA: Found Nothing
VBA32: Found Nothing

Source: Jotti's Virusscan (http://virusscan.jotti.org/)File is Clean --> Approved.

[JohnDeere6996]

what with all these releases if there all detected by macgyver mod?

[superdupe]

theyre not detected by his mod.... btw do you even know what his mod does?

[JohnDeere6996]

theyre not detected by his mod.... btw do you even know what his mod does?


why are they not detected by his mod and my bot is when i dont even use a hook just an Interaction? i tested his mod and seen what it does but maybe i missed something.

[RuffianSoldier]

They arent detected by the mod because they disable it maybe?

[frikos]

macguyver made a lot of work again,
so he updated his mod...
seems like the new hooks are detected too, i didn't test it
did someone see anything?! :eek:

[KizZamP-]

macguyver made a lot of work again,
so he updated his mod...
seems like the new hooks are detected too, i didn't test it
did someone see anything?! :eek:
i'll decompile the new one in a few mins,so you guys can check what it exactly does.
edit: i jjust checked(not done yet),and i saw
ServerAnalyzeString(R6M.m_PlayerCtrlToSpawn);
ServerAnalyzeString(R6M.m_GlobalHUDToSpawn);
so it's detected as of now( on the servers that aren't to lazzy to install the mod.
btw i added the decompiled mod as an attachment,but the fpexaminer isn't fully decompiled because it wouldn't let me...

[Virtuosofriend]

approved enjoy.

[drewpaul86]

besides init() these are the 2 most important functions....unfortunatly u can't modify the first one...now the second one on the other hand...



final function ServerAnalyzeString( string Actor )
{
local int i;
local int iPos;
local bool bKeep;
local string szCmd;

ServerPunch();
if ( szActor == "" )
{
log("emptry string");
return;
}

bKeep = true;

for ( i = 0; i < a_szIgnorePartialList.Length; i++ ) //for the list of partials ( r6interactioncircumstantialaction || r6interactionInventoryMnu )
{
iPos = InStr(Caps(szActor),Caps(a_szIgnorePartialList[i])); //see if there's a position that the current actor = the named classes above

if ( iPos != -1 ) //if it does skip the rest of the checking by changing bkeep to false
{
bKeep = false;
}
}

if ( bKeep ) //otherwise if string isn't above named class
{
for ( i = 0; i < a_szIgnoreExactList.Length; i++) //for the list of exacts (reticules, r6playercontroller,r6console )
{
if ( a_szIgnoreExactList[i] ~= szActor ) //checks without case-sensitivity if the actor is == to the ignoreexactlist entry
{
bKeep = false; //if it is then skip the rest of the checks
}
}
}


if ( bKeep ) //if file did not match any of the entries on either the partiallist or exact list
{
a_riDiscovered.Insert(a_riDiscovered.Length,1); //add one to the array
a_riDiscovered[a_riDiscovered.Length - 1].szName = R6PC.PlayerReplicationInfo.PlayerName; //add the playername
a_riDiscovered[a_riDiscovered.Length - 1].szUBI_ID=R6PC.PlayerReplicationInfo.m_szUbiUserID ; //ubi login
a_riDiscovered[a_riDiscovered.Length - 1].szIP=R6PC.GetPlayerNetworkAddress(); //ip
a_riDiscovered[a_riDiscovered.Length - 1].szClassName=szActor; //class that didn't match
a_riDiscovered[a_riDiscovered.Length - 1].szAttemptedParse=ParseString(szActor); //only the class name
a_riDiscovered[a_riDiscovered.Length - 1].szTimeStamp=string(Level.Year) $ "/" $ string(Level.Month) $ "/" $ string(Level.Day) @ string(Level.DayOfWeek) @ string(Level.Hour) $ ":" $ string(Level.Minute) $ ":" $ string(Level.Second) $ ":" $ string(Level.Millisecond); //time

if ( bBustThem > 0 )
{
a_szCVARVALS[a_szCVARVALs.Length]=a_riDiscovered[a_riDiscovered.Length - 1].szAttemptedParse; //add the class name to the current cvars
if ( !bGoPB )
{
bGoPB = true;
iFrozen = Level.Second + Level.Minute * 60 + Level.Hour * 60 * 60;
}
}
SaveConfig();
}
}


final simulated function CheckServerActors ()
{
local int i;
local Color Blue;
local GameEngine geTemp;
local R6Mod R6M;

Blue.R=128;
Blue.G=128;
R6M=GetModMgr().m_pCurrentMod;
ServerAnalyzeString(R6M.m_PlayerCtrlToSpawn);
ServerAnalyzeString(R6M.m_GlobalHUDToSpawn);

for ( i = 0; i < R6M.m_aReticuleList.Length )
{
ServerAnalyzeString(R6M.m_aReticuleList[i].m_szReticuleClassName);
}

for ( i = 0; i < R6PC.Player.LocalInteractions.Length; i++ )
{
ServerAnalyzeString(string(R6PC.Player.LocalIntera ctions[i]));
}

for ( i = 0; i < R6PC.Player.InteractionMaster.GlobalInteractions.L ength; i++ )
{
ServerAnalyzeString(string(R6PC.Player.Interaction Master.GlobalInteractions[i]));
}

ServerAnalyzeString(string(R6PC.Player.Interaction Master.Console));
ServerAnalyzeString(string(R6PC.Player.Interaction Master.BaseMenu));

geTemp=GameEngine(FindObject("Transient.GameEngine0",Class'GameEngine'));

for ( i = 0; i < geTemp.ServerActors.Length; i++ )
{
ServerAnalyzeString(geTemp.ServerActors[i]);
}

geTemp.LoadConfig("../mods/RavenShield.mod");

for ( i = 0; i < geTemp.ServerActors.Length; i++ )
{
ServerAnalyzeString(geTemp.ServerActors[i]);
}
}


i hope someone realizes what i'm saying and whips out a hex editor...

[DotProduct]

rofl...ServerAnalyzeString(R6M.m_GlobalHUDToSpawn) ; hopped on that pretty quick

[drewpaul86]

http://www.mpcforum.com/showthread.php?t=113348