Spoofer example code

[gdtaurine]

Here's a small example of a kernelmode driver that intercepts I/O calls between the PB dll and driver, and attempts to spoof your hardware information when it's being sent back to pbcl.dll.

The driver hooks ZwDeviceIoControlFile by modifying an entry in the System Service Descriptor Table. It's not hard to detect since there is no additional protection, but there are lots of other ways to hook that function.

The IoControlCode is different in every PB version. For the current AA pbcl (v1.125), the code is 0xB3E6D180.

I'm not hardware banned myself, so I've not really tested this in action. It's just an example... Use it while you can, and please let me know if it helps. :)


PS. Just to state the obvious:
- You should only use this if you are hwbanned already.
- Nothing lasts forever, and PB will detect this soon.

Edit: Added some more spoofer code... Hope it actually works this time. :dead:
Edit2: Added MAC address spoofing
Edit3: Changed to using a detour instead of SDT hook, couple of bugfixes
Edit4: Removed MAC spoofer, fixed some bugs: MPC Downloads Link (http://www.mpcdownloads.com/forums/downloads.php?do=file&id=5634)

[gil]

Thanks a lot Taurine.
Nice to see you participating. With this, the forum will sure be more active than it is now.

I'm not HW banned myself, so I can't test it.


Cheers.

[A.Wesker]

thanks buddy

[Galaktikos]

BIT THX -gdtaurine

I have HW ban,
I will test your spoof'er and I will serve results soon .

sry my english ;)

[langefrans]

gonna try it now, gj taurine keep it up

Anyone who is dutch, can explain to me how to use this spoofer exactly i tryed a few things but don't get how to run it. Hopefully a dutch/belgium guy can help me. Thanks in advance

[n()()b_Power]

gonna try it now, gj taurine keep it up

Anyone who is dutch, can explain to me how to use this spoofer exactly i tryed a few things but don't get how to run it. Hopefully a dutch/belgium guy can help me. Thanks in advance

This is the source not the actual program. Read the readme it gives you a very basic idea of what to do.

Taurine good to see you again.

[langefrans]

I readed the readme, but im not very familiar with those things. If someone could explain in a bit easy-way i would appreciate.

[Spider.]

mhh some one test it??? how long u can play with this spoofer??? and when u get banned (again) can u use this spoofer again?

[tamimego]

Taurine thankyou for releasing a public driver setup.
I was wondering if you could help me get this thing to build.
I have been able to get to the build.exe stage no problem just I don't see where it creates the compiled file / files.

Console ScreenShot:
http://img202.imageshack.us/img202/716/compile6tj.jpg

Any help would be greatly appriciated.

[langefrans]

I can't wait to try it. But I don't know how to load the spoofer. Never worked with sources if someone could be so nice to explain me (preferable in dutch if possible) Thank you in advance.

[The-X™]

mhh some one test it??? how long u can play with this spoofer??? and when u get banned (again) can u use this spoofer again?
Do u Guys really read the threads?!?...

I can't wait to try it...U´ll need to compile it first,and then u could see if it works.

taurine Read me.txt :

How to compile:

First, you'll need to get the Windows Driver Development Kit.

Then, simply open a command prompt, run setenv.bat from the
DDK\bin directory, and run "build.exe" in the spoofer directory.

Tami had a picture in is post,u should see how it works...

[gdtaurine]

I have been able to get to the build.exe stage no problem just I don't see where it creates the compiled file / files.

Console ScreenShot:
http://img202.imageshack.us/img202/716/compile6tj.jpg

You need to run build from the spoofer directory (C:\cSpoofer in your case).

[langefrans]

any dutch guy can help me with this thingy i don't got a clue how to spoof it plz pm or msg here thank you very much

[gdtaurine]

Allright, here are compiled versions for AA pbcl v1.215 and ET pbcl v1.213. All you need to do is run spoofer.exe. These will not work after PB updates.

You should only use these if you're hwbanned already.

[Ping_pong]

Thnx for your time Taurine.

Long time no see. :) Hope you will keep this community alive. I really enjoyed seeing people unHW-banned using your tools.

The most thing i like was that pb needed to hire a "more knowledge person" to detect your spoofer.

Greetz Ping_Pong

[langefrans]

Taurine, I don't play AA but sof2 will this make a difference? Your other hwspoofers didn't :) hope this one does the same.

[gil]

Taurine, I don't play AA but sof2 will this make a difference? Your other hwspoofers didn't :) hope this one does the same.
hwspoofer is for PB, not for AA itself.
Should work for BF2 as well.

[gdtaurine]

Actually, the io control codes are different in every PB version, so the ones I just posted won't work for SOF2 (or BF2).

Here's one for sof2 pb v1.217 (ioctl is 9408D278h).

[gil]

Oh, I forgot the PB version isnt solid for all the games out there.
My bad.

Nice contribution Taurine, Make some mess ;)

[No1uKnow]

cool deal, im not hw banned but i have friends that are, they appreciate it man

:thumbsup:

[tamimego]

Hmm I got it to compile but I havn't got it to work.
I still get HW Banned from all PB Servers, :(
Its not my MAC-Address either because I use to use
Taurine's HW Spoofer 2.0 ( One without MAC Spoofing ) and
played fine ^^

Heres an SS:
http://img107.imageshack.us/img107/639/aahwban1nd.jpg

[gdtaurine]

Hmm I got it to compile but I havn't got it to work.
I still get HW Banned from all PB Servers, :(
Its not my MAC-Address either because I use to use
Taurine's HW Spoofer 2.0 ( One without MAC Spoofing ) and
played fine ^^

Heres an SS:
http://img107.imageshack.us/img107/639/aahwban1nd.jpg
Ok, I've added some more code to the original post, that really should have been there from the start... I've not been able to test it in action at all, but I hope I got it right this time. :disappoin

[tamimego]

Works ^^ <3 Taurine
ScreenShot:
http://img283.imageshack.us/img283/387/aanonhwban6sr.jpg

[goggles99]

NJ Taurine, It's good to see you again. Seems like things haven't been so good in the scene since the problems with GD.

I haven't had much time to check on PB lately, are they communicating directly with the HW again? Is this why you aren't using the Filter Driver Anymore?

Thanks for the sources...
Good as always :rambo:

[Samshit]

Where can I download "Windows Driver Development Kit" ???

[Galaktikos]

When program will appear ??
person which spoofer acts she would can to to put together already this in the whole and to throw open .

[tamimego]

1. Galaktikos please speak english
2. Samshit the Window DDK is worth $200 posting a link would be warez, please read the rules before posting stupid shit. Notice how taurine didnt post about using the DDK on MPC itself and only in the readme?

[mcMike]

2. Samshit the Window DDK is worth $200 posting a link would be warez, please read the rules before posting stupid shit. Notice how taurine didnt post about using the DDK on MPC itself and only in the readme?

Actually DDK is free and DVD can be ordered from Microsoft by covering shipping and handling only (25$).

http://www.microsoft.com/whdc/devtools/ddk/default.mspx

[gil]

Thanks again Taurine for adding more.
Thanks Tami for testing it.

Those who are HW banned should put the effort and learn it :)

[Galaktikos]

If HWspoofer let's it will be rendered accessible guns as programs.

THX Taurine, good work ;)

[goggles99]

Where can I download "Windows Driver Development Kit" ???

I've been told that the KMDF ISO includes the windows 2003 DDK. It can be freely download from MS site. :cool:

Kernel-Mode Driver Framework 1.0
http://www.microsoft.com/whdc/driver/wdf/KMDF_pkg.mspx
262 MB
Updated: Dec 2, 2005
(Look forthe "WIN2K3DDK" folder in the ISO image)

More Info about the whole thing here (http://www.osronline.com/article.cfm?article=432)
So the DDK is once again legally DL-able from MS :)

[langefrans]

Actually, the io control codes are different in every PB version, so the ones I just posted won't work for SOF2 (or BF2).

Here's one for sof2 pb v1.217 (ioctl is 9408D278h).

Ok thanks alot, but how do i get this code in the spoofer?

[gil]

Ok thanks alot, but how do i get this code in the spoofer?
If you can't read above posts and can't understand, maybe it's not for you.
You should wait and see if someone decides to release.

[gdtaurine]

NJ Taurine, It's good to see you again. Seems like things haven't been so good in the scene since the problems with GD.
Thanks. Nice to see you're still around as well. :)

I haven't had much time to check on PB lately, are they communicating directly with the HW again? Is this why you aren't using the Filter Driver Anymore?
Yeah they're sending the ATA IDENTIFY DEVICE command directly to the drive. Btw, PB also goes past the filter chain and calls the last disk driver to get the serials. I've no idea why they bothered with that since they're reading the serials directly anyway, but it's there...

Thanks for the KMDF link, it looks really nice! :cool:

[Galaktikos]

Thanks. Nice to see you're still around as well. :)


Yeah they're sending the ATA IDENTIFY DEVICE command directly to the drive. Btw, PB also goes past the filter chain and calls the last disk driver to get the serials. I've no idea why they bothered with that since they're reading the serials directly anyway, but it's there...

Thanks for the KMDF link, it looks really nice! :cool:

Yeah! Taurine You are champion! I can not wait for final version already :P

evenbalance F*** you ! ;)

[gdtaurine]

Added a simple mac address spoofer to the original post... This will also spoof the MAC addresses of FireWire ports, which have caused quite a bit of confusion on what components PB is actually banning.

Also, here's a compiled version for those who can't do it themselves, but keep in mind that it's only a short-term solution and will stop working when PB updates. I recommend you learn how to update this yourself.

This should work with the current pbcl in AA, ET, SOF2 and COD.

Edit: binaries removed until i get the mac spoofer working properly...

[HUMM3R]

Added a simple mac address spoofer to the original post... This will also spoof the MAC addresses of FireWire ports, which have caused quite a bit of confusion on what components PB is actually banning.

Also, here's a compiled version for those who can't do it themselves, but keep in mind that it's only a short-term solution and will stop working when PB updates. I recommend you learn how to update this yourself.

This should work with the current pbcl in AA, ET, SOF2 and COD.

Thank you Taurine, because of your sources I learned new things, and I'm ver y grateful. But under XP SP2 I get a blue screen at IoDeleteDevice, with message DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATI ONS. If I remove it, and do an assert for 'DriverObject->DeviceObject == NULL' all is ok, but I can't restart driver anymore after stopping it.
And another question I have, is it possible PB to ban my other IDable part of my harddisk, not serial number? Cause in log all I see is the two IOCTL_STORAGE_QUERY_PROPERTY and SMART_RCV_DRIVE_DATA. And all seems like I'm getting re and rebanned, without using any hacks. And I ain't forgetting anything in any folder ;)
Yesterday it were reaching IOCTL_NDIS_QUERY_GLOBAL_STATS sometimes, but not today (I put yesterday the MAC spoofing in on my own). Do the other 2 commands have to do with this (getversion, sendcommand)?

[Galaktikos]

OMG!
Taurine You Rule!
Huge due to !!!!!!!!!!!!!!!!
:bunny: :bunny: :bunny: :bunny: :bunny:

La camisa negra! :D
F*** **** *** **** evenbalance ! :]

[gil]

OMG!
Taurine You Rule!
Huge due to !!!!!!!!!!!!!!!!
:bunny: :bunny: :bunny: :bunny: :bunny:

La camisa negra! :D
F*** **** *** **** evenbalance ! :]
I must ask you to stop spamming this thread.
This is not a releases forum, so you don't need to thank if you don't have anything to add.

Next time i'll make sure it wont happen again.

[Galaktikos]

Program before moment complete test ...
Manual update PB ....Including game ET ...
I enter on server with including PB ...pb scan... is OK, I have played ten minutes .:smoke:
I leave from server and I enter on other ... pb scan ... is ok, I have played several minutes ...:smoke:

I change server the third time ... pb scan ...and ... PB KICK >> HW BAN ... :dead:

Something is not so... :disappoin ... With former versions (taurine spoofer) so not happen.

( I did not use in time of testing with cheat )

[gil]

Maybe you used something that is detected and got banned again?
Since i'm not HW banned myself, I didn't really check if it hides the info or spoofs it to something else (so you can get banned again).

So I might be wrong :x

[Galaktikos]

I have obtained behind third approach HW ban, As PB my has discovered banned hardware.

I did not leave during tests from game, I changed servers only .

[gdtaurine]

Thank you Taurine, because of your sources I learned new things, and I'm ver y grateful. But under XP SP2 I get a blue screen at IoDeleteDevice, with message DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERATI ONS. If I remove it, and do an assert for 'DriverObject->DeviceObject == NULL' all is ok, but I can't restart driver anymore after stopping it.
And another question I have, is it possible PB to ban my other IDable part of my harddisk, not serial number? Cause in log all I see is the two IOCTL_STORAGE_QUERY_PROPERTY and SMART_RCV_DRIVE_DATA. And all seems like I'm getting re and rebanned, without using any hacks. And I ain't forgetting anything in any folder ;)
Yesterday it were reaching IOCTL_NDIS_QUERY_GLOBAL_STATS sometimes, but not today (I put yesterday the MAC spoofing in on my own). Do the other 2 commands have to do with this (getversion, sendcommand)?

I didn't get blue screened during my very limited testing, but maybe you could try moving the IoDeleteDevice call to the very end of UnloadSpoofer().

Get_version and send_command don't return serial numbers, so they shouldn't be a problem. PB shouldn't be able to get to your real hw info... If you're also able to play for a short while, I guess the spoofer is causing a new hwban on the spoofed info for some reason.

I updated the spoofer binaries posted above, maybe you could give that a try. :cool:

Wish I had more time to work on this..

[HUMM3R]

I didn't get blue screened during my very limited testing, but maybe you could try moving the IoDeleteDevice call to the very end of UnloadSpoofer().


I put the call at the end, still blue, and didn't find anywhere useful info to answer why.
Your new binary also gives blue screen, which would not be a problem for usage, but also doesn't spoof in my case. Well I used DeviceIoControl function to test the mac, and is spoofed, so the hdd serial should be too. Maybe my hdd geometry be banned? Can I return a non-valid/old smart version number to avoid smart info to be read? Or what would happen if I return a reasonable error code in PB calls, like insufficient resources?
The situation is that I'm instantly, even before PB authentication, kicked for hw ban. I receive 3 remove messages, 1 with ? before full PB authentcation, and 2 with ID after PB authentication...

[moshandroll]

so with the spoofer that is already compiled all i do is open it and press enter?

Becasue i did that and went too test it & I was stil hardware banned. Sorry but im not too good at computers.

Thanks.

[Galaktikos]

so with the spoofer that is already compiled all i do is open it and press enter?

Becasue i did that and went too test it & I was stil hardware banned. Sorry but im not too good at computers.

Thanks.
You open program and you minimize window, you do not press enter! You drive in after termination of game enter only.

______________
@Taurine
Your program breaks down files on hard disk, It will suffice that try to open partition, But blue screen will be showed :/ not good, there is serious case !
ps
Your program is very forceful, but it owns serious errors

[gdtaurine]

I put the call at the end, still blue, and didn't find anywhere useful info to answer why.
Your new binary also gives blue screen, which would not be a problem for usage, but also doesn't spoof in my case. Well I used DeviceIoControl function to test the mac, and is spoofed, so the hdd serial should be too. Maybe my hdd geometry be banned? Can I return a non-valid/old smart version number to avoid smart info to be read? Or what would happen if I return a reasonable error code in PB calls, like insufficient resources?
The situation is that I'm instantly, even before PB authentication, kicked for hw ban. I receive 3 remove messages, 1 with ? before full PB authentcation, and 2 with ID after PB authentication...

I guess you could return STATUS_UNSUCCESSFUL when SMART_GET_VERSION is called. That should at least stop PB from doing the smart IO calls from usermode. I'm not sure why the spoofer is not working, but in any case, I don't think they're using HDD geometry.

Does the spoofer report "PB_IOCTL (0xB3E6D180)" being called? If not, I can only conclude that the ioctl code is wrong or the hook function doesn't get called.

I did manage to reproduce the crash on UnloadSpoofer(), but I've no idea what caused it. I changed the spoofer to hook NtDeviceIoControlFile by using a detour, and that seemed to getg rid of the problem... Also fixed a couple of small bugs, so please get the latest src and give it a go. :)

Updated spoofer_src and spoofer_bin.




@Taurine
Your program breaks down files on hard disk, It will suffice that try to open partition, But blue screen will be showed :/ not good, there is serious case !
ps
Your program is very forceful, but it owns serious errors

You need to be more specific. How exactly does it break files? Did you simply lose unsaved changes when the computer crashed, or were some files actually deleted? And what do you mean by opening a partition? I really hope you're not trying to change the partition table while the spoofer is running...

I've never lost files with this, but unfortunately I can't guarantee the code is 100% bug-free.

[HUMM3R]

I guess you could return STATUS_UNSUCCESSFUL when SMART_GET_VERSION is called. That should at least stop PB from doing the smart IO calls from usermode. I'm not sure why the spoofer is not working, but in any case, I don't think they're using HDD geometry.

Does the spoofer report "PB_IOCTL (0xB3E6D180)" being called? If not, I can only conclude that the ioctl code is wrong or the hook function doesn't get called.


Well I still have crash and hw ban. Heres the log when I return STATUS_INSUFFICIENT_RESOURCES for SMART_GET_VERSION and SMART_SEND_DRIVE_COMMAND:

00000000 8:02:59 PM IOCTL_STORAGE_QUERY_PROPERTY
00000001 8:02:59 PM IOCTL_STORAGE_QUERY_PROPERTY
00000002 8:03:07 PM IOCTL_NDIS_QUERY_GLOBAL_STATS
00000003 8:03:07 PM IOCTL_NDIS_QUERY_GLOBAL_STATS
00000004 8:03:07 PM PB_IOCTL (b3e6d180)

Then I disabled my soundcard and TVTuner, after that I returned this status above for all the spoof calls,still hw ban.
My guess is that I'm getting rebanned somehow.

[Galaktikos]

@Taurine
http://img230.imageshack.us/img230/1601/enters3fe.jpg

Drive in enter?, leave window opened during playing ?
Really, I do not know already, this spoofer acts strangely so :tired:

[DarkPnkX]

Yep i get a blue screen also when i press the enter button on the updated bin. wxp sp2

[StateOfTheMind]

Major props man, making these along, made you a highly respected man. But now you're releasing some of the source. This is amazing my friend.

[moshandroll]

so i open the spoofer.

start up aa.

then go back too the spoofer and press enter?

[Galaktikos]

@moshandroll ... ENTER!!!!!!

______________

http://img222.imageshack.us/img222/7840/banned7yf.jpg

1) I have used SMAC 1.1 for change of address of net card
2) disable card sund ( RealTek 655) in bios
3) I have uploaded spoofer before inclusion of game, from Taurine .
3) punk buster "It has allowed me on game" By fifteen minutes, suddenly I have been thrown out after this time from server . :bored:

I did not use during test with cheats .
Please, believe, really, spoofer unacts (not work)
Former programs acted from without objection Taurine, really, they were not bad, unfortunately, it does not grant new spoofer role. :ermm:

EDIT:
Probably, punk buster, It has thrown out me at once, simply manually forget modernize him, it was actualized through fifteen minutes punk buster but it has thrown out me from server next .

[langefrans]

Gj taurine, you doing a good job releasing all the time spoofers because noobs like me don't know how to make one :)

Just tryed it :( got kicked (in sof2) unlucky for me. For the others enjoy as long as it can ;)

[Galaktikos]

Gj taurine, you doing a good job releasing all the time spoofers because noobs like me don't know how to make one :)

Just tryed it :( got kicked (in sof2) unlucky for me. For the others enjoy as long as it can ;)



This spoofer it lottery, case will set but case not ... this spoofer is good releasing ?? Probably, rather not.
Oldest versions acted stably definitely and they were more certain.

[gil]

This spoofer it lottery, case will set but case not ... this spoofer is good releasing ?? Probably, rather not.
Oldest versions acted stably definitely and they were more certain.
I'm getting tired of your posts.
Stop saying the same all the time.
Didn't work for you? Tough luck.

If you can't create your own spoofer, don't criticize others.
He released the source, you can make your own.

You've posted enough in this thread.

[KizZamP-]

i think there is almost nobody besides taurine that could write a spoofer from scratch,and EVEN IF it is detected,you can make your own one because all the functions for the spoofing are in it.

[moshandroll]

ah so it mustnt work for me either, ohwell hopefully taurine or someone else realesas another. Big hooah too taurine for releasing the source and all that so others can help them selves. no use to me as i only know how too trun the computer on. One day maybe.

New comp coming soon so i guess i will just play clean.

[gdtaurine]

Well I still have crash and hw ban. Heres the log when I return STATUS_INSUFFICIENT_RESOURCES for SMART_GET_VERSION and SMART_SEND_DRIVE_COMMAND:

...

Then I disabled my soundcard and TVTuner, after that I returned this status above for all the spoof calls,still hw ban.
My guess is that I'm getting rebanned somehow.
Well I just realized that the driver isn't handling IRP_MJ_CREATE and IRP_MJ_CLOSE as it should... That might explain the error message you got (DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERAT IONS). A really stupid mistake on my part :disappoin . Also, the MAC address spoofing code wasn't working properly, so I took it out...

Anyway, the only thing I can think of is that maybe you still have some MAC addresses that haven't been spoofed. You've probably done all this already, but just to make sure... Try spoofing all network card MACs with SMAC and disable all firewire connections (IEEE 1394) in Control Panel -> Network Connections. You can also disable every other connection you don't need.

The HDD serial spoofing should be working properly at least.


This spoofer it lottery, case will set but case not ... this spoofer is good releasing ?? Probably, rather not.
Oldest versions acted stably definitely and they were more certain.
Perhaps you didn't understand why I posted this in the first place, so let's try again:

This was not meant to be an easy to use spoofer that would work for everyone. The point was to release source code that other programmers might use and learn from. I wasn't originally going to post binaries at all...



Anyway, here's the latest src... Gil, can you put this into the original post since I can't edit it anymore? thx

[Spider.]

the spoofer doesnt work 4 me to =/ bad luck

[gil]

Anyway, here's the latest src... Gil, can you put this into the original post since I can't edit it anymore? thx

Sure, Edited.

Do you want to tell me what's new in it?
So i'll add the Edit4: Desicription part.. :)
Furthermore, maybe you can add a version number to the file? I'll be able to upload it to MPC Downloads FTP.

[gdtaurine]

Do you want to tell me what's new in it?
So i'll add the Edit4: Desicription part..
Furthermore, maybe you can add a version number to the file? I'll be able to upload it to MPC Downloads FTP.

"Edit4: removed MAC spoofer, fixed some bugs" would be fine. I guess this version could be named spoofer_src-v0.4.zip.

[gil]

"Edit4: removed MAC spoofer, fixed some bugs" would be fine. I guess this version could be named spoofer_src-v0.4.zip.
Damn, it's so slow now.
Anyway, Main post is edited, thanks.

MPC Downloads Link (http://www.mpcdownloads.com/forums/downloads.php?do=file&id=5634)

[moshandroll]

would it work if i added the files from spoofer src too spoofer bin so that I dont need too compile it, would that work?

[HUMM3R]

Well I just realized that the driver isn't handling IRP_MJ_CREATE and IRP_MJ_CLOSE as it should... That might explain the error message you got (DRIVER_UNLOADED_WITHOUT_CANCELLING_PENDING_OPERAT IONS). A really stupid mistake on my part :disappoin . Also, the MAC address spoofing code wasn't working properly, so I took it out...

Anyway, the only thing I can think of is that maybe you still have some MAC addresses that haven't been spoofed. You've probably done all this already, but just to make sure... Try spoofing all network card MACs with SMAC and disable all firewire connections (IEEE 1394) in Control Panel -> Network Connections. You can also disable every other connection you don't need.

The HDD serial spoofing should be working properly at least.


Well, still blue screen and no spoofing. I think its XP SP2, because I can't stop the SFcure driver either, same blue screen. Unfortunately I can't use SMAC because of my ISP... And I did disabled all my devices except my videocard ;)
Maybe PB does some authenticy check, and rebans me? I'm thinking now of why you use only one fourth of the output buffer spoofed?

[mcMike]

Hello guys,

For You who have still probs with firewire (1394) in soundcard here's the correct way to disable:

1) From networks disable 1394 network connection
2) From mycomputer->hardware->Devicemanager
->network adapters disable all 1394-controllers
->IEEE 1394 Bus host controllers disable all 1394-compliant controllers
3) From registry HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E972-E325-11CE-BFC1-08002bE10318}
Look for sub-key containing info about 1394-adapter and delete.
4) Reboot
5) To be sure: remove the Soundcard, reboot without it. Shut down and insert card and start again. (Verify that above are disabled).

[KizZamP-]

just want to make sure (though i don't have it)...
can pb ban your 'onboard' sound card?
cause i don't think those onboards really have a "unique" serial.

[moshandroll]

is the already compiled dl link be available again?

[valenti1232289]

That would rock, all could get it then, including me... :P Didnt get the compile to work and when i tried someones else compiled exe and sys it didnt work.. He says it dont call the pb offset so its useless...

[2FACETANNER]

I tried to understand how to compile your spoofer but I do not know how to do it, can someone upload it in .exe form so it would be workable already or is that not possible?

[moshandroll]

for the people who are unable too compile, we are just gonna have too wait for the bin version tooo be updated.

If you read his post on 3rd page where he removed it too get it working properly He will have it out soooon. :-)

[gil]

I think this thread worth a sticky :)

[2FACETANNER]

Taurine what will the haxing community do without you!

[moshandroll]

definetly worth a sticky:-)

[darealmastad]

anymore news regarding this? It's been awhile...

[New Hacker]

anymore news regarding this? It's been awhile...

i was wondering as well

[gdtaurine]

Sorry I haven't been around much lately... I just don't have as much time to work on this as I used to. :(

Anyway, here's a small usermode DLL that spoofs MAC and HDD serials like the example driver. This doesn't rely on hard-coded PB ioctl codes, so it should work for all games. That is, until PB updates, of course.

I recommend you use a stealth injector for the dll, but you can use any injector you like... I will release the source once I get around to cleaning it up a bit.

Thanks to LanceVorgin for his neat CDetour class, which I've used extensively in this program. :)

Once again, I've not been able to test this much, so let me know if there are problems...

Edit: bugfixes...

[MAKEUBLEED]

hey ive tried ur spoof taurine but my screen turned black 4 like 5 minutes and it seems that he was not doing anything even my monitor went off is that normal? i thought it was wrong so i hitted the reset button on my pc.
was that the spoofing thing or did i something wrong?
i started AA minimalised it went for an injector (=SS= sniper's injector) and injected the s.dll and mimimalised the injector then it turned on black screen.

can some1 plz help me i wanna play again!!
maybe some1 has a private spoofer who wants 2 share it with me,
cause those public 1s or not working (i think).

ow btw if it went wrong.
and ill try it again do i have 2 inject it everytime when playing AA¿
sorry 4 tha noobish Q.

ThnX

[MaTriX1337]

I have kinda a same problem....... wen I have injected the s.dll into the programme, and go onto a PB server, the whole thing works fine, but my game just closes itself nd returns to my home screen but in like 'safe mode' with the ligheter colour nd smaller icons etc.............. hope that you can help taurine nd good to see you back again mate :D used to use ur spoofers nd miss them loads now they dont work


Thanks

[HUMM3R]

I tried to inject it without injector, it didn't crashed the game, but also didn't worked; it took a longer time to detect the ban, but it did at the end.
Tried with Temp2's injector, and it crashed the ame, aproximately at the same time PB tried to check my hw.
I will wait for the source to debug it.

[gdtaurine]

Ok, fixed a couple of bugs that could cause crashing... Should work now (I hope).

still need to clean up the code a bit.

[MaTriX1337]

Well the crashin of the game has now fixed, well done for that, but its also detected lol :P PB detected my ban nd then kicked me............

:ermm: so not sure thts wot u meant by needin to fix the code or wot? lol

[[R]>>Killer]

Well the crashin of the game has now fixed, well done for that, but its also detected lol :P PB detected my ban nd then kicked me............

:ermm: so not sure thts wot u meant by needin to fix the code or wot? lol


yeah crashing the game has been fixed but its detected
still thank you for trying this :) to make it works ;) taurine
keep it up
good luck :rambo:

[TwistedShadow]

O_O hi guys,
i am not fumilior with those things maybe can some1 help me?
i've downloaded the spoofer source and readed the read me,
"First, you'll need to get the Windows Driver Development Kit.

Then, simply open a command prompt, run setenv.bat from the
DDK\bin directory, and run "build.exe" in the spoofer directory."

for me its like engrish... i cant understand what is the driver development kit or those other things it says about or how do i active this spoofer source at all.

any help would be apritiated, thanks.

[tuxpr0]

thanks you .. nice post :)

[fidgaf]

I would NOT use the stealth injector. It's detectable by PB and could lead to a ban.

[gil]

I would NOT use the stealth injector. It's detectable by PB and could lead to a ban.
Not just a ban, HW ban.

[Sparten]

So what if it does lead to HW ban, it cant hurt him more then he is allready!

[2FACETANNER]

Anyone know -=SS=- Sniper's HW spoofer. (The one that has a 50% of success) Not able to find it. Searched Everywhere.

[H4xx0r]

um....i need help i dont know what to type once im in the spoofer directory in CMD cause i run build.exe and its not in there

[Tobzy]

i have the =ss= hardware spoofer but the .ini is in german so i dunno if thats why it doesn't work for most people or not? but anyways you said you wanted it, here ya go! enjoy.

[gil]

So what if it does lead to HW ban, it cant hurt him more then he is allready!

HW is the worse thing.
We only care for HW bans @ AA.
GUID bans are nothing.

Anyone know -=SS=- Sniper's HW spoofer. (The one that has a 50% of success) Not able to find it. Searched Everywhere.

I don't think it's his spoofer.

[2FACETANNER]

Thanks man, Tobzy. Not going to try it just yet.
Is there a way to translate that german?

[DirtyDevil85]

didn´t work anymore , dunno why ...
i played for 3 or 4 hours with a new account at my hwbanned pc , after that time pb kicks me for a unknown reason , wanted to reconnect , and looks .. hardware and guid bann for my new acc :(

so the journey goes on to find a way to work out ...
or , i play at my linux server ....
in this one i have 2 network cards and 8 hdd´s in raid ...
but , no sound :(

[Blueman007]

didnt work for me either
i tried but still hw ban :(

[2FACETANNER]

I used =SS=Sniper's Spoofer but the problem is that it says Blocked OS Privleges.

Here are my steps:
1)I am using a HW banned account, I figure if I get kicked it would say ..."GLOBAL BAN"... and not "GLOBAL HARDWARE BAN"...
2)I first inject sniper.dll with Stealth/Normal mode on.
3)Go an play on PB.
4)Once it said I was caught cheating
5)Another Time it said I had file whitelisted
6)Other times it was blocked OS privledges.

Thus, I works as far a blocking my HW is concerned, but what do I do about Blocked OS privledges?

[n00blar]

Bloody brilliant mate. i have no code knowledge but i had an idea similar to this in my head. didnt no who to tell tho.

[Stany01]

Thx, hope it still works.

[METALhacker]

i dunno if aney one has posted this yet but would it work if u used root kit to hide your networking and system

[V3-C]

i dunno if aney one has posted this yet but would it work if u used root kit to hide your networking and system

You cant since PB does Kernel too.

[BlitzRaider]

does this work.. any1 tested? because im not HW banned

[KizZamP-]

You have to mod it to make it undetected again.

[sspoke1]

cheers

[friendlyweapon4]

You have to mod it to make it undetected again.

how are you supposed to do that?

[shelite1]

Great. Hope I can do that soon, :)

[soccernike]

taurine the readme doesnt explain it well...and when i try to install it or start spoofer.exe my windows says it needs to kno where it comes from..please explain it to me

[Rapid]

if i read the description, the program intercept calls from a dll to pbcl, can't we itnercept calls between pbcl.dll and otheer game files so it will return clean with no hacks or something?

[tuxpr0]

This Source code is Detectable by PB?

[neoxquick]

thx nice rlz

[wooze]

Would be nice to try. Although im not HW banned :D

Im just hoping to find some good PB proof hack ;)