All about Punkbuster Hardware [Archive]

View Full Version : All about Punkbuster Hardware

Sparten

18th January 2006, 19:47

Punkbuster Hardware Info.
Made by: PizzaPan.

Credits: Tetsuo, RunningBon, Rob, Xen, h1web, BlackDove, Sparten, Kosire.
I will allow this to be replicated word for word, to mpc forum, but only to be posted by Sparten, and no where else, simply link here
http://forum.gamedeception.net/showthread.php?t=8435 if you want to.

Part 0: Usermode.
There are only 3 hashes made in usermode:

2 hashes are generated by the amount of hdds you have, with a maximum of 16 Drives.
Hash Begin: "s" Generated from IOCTL_STORAGE_QUERY_PROPERTY
Hash Begin: "t" Generated from SMART_RCV_DRIVE_DATA

1 Hash is generated from various networking properties:
Hash Begin: "m" generated by the combined info of:
a) Hardware NIC via IOCTL_NDIS_QUERY_GLOBAL_STATS
b) MAC Address
^^ The following Hash will not be used if you have onboard lan and no installed nic cards.

I have seen all 3 hash's combined, and then hashed again, no idea if this single is sent to the server, but i assume it is, if they base hardware bans on this changing any one hardware, would change the final hash, so i also have to assume they send all of them seperate also.

Part 1: Drivers Galore.
There are currently 3 Versions of the punkbuster driver floating around.

This does not include the very first set of drivers, we can call them unstable etc., and were upgraded fast to detect hwspoofers, and various bugs.

You could break them down as follows:

Size - Version:
16KB v0
22KB v7 (As sent by pbcl.dll)
26KB v71 (As Sent by pbcl.dll)

As of writing this, and current pbcl.dll versions.
v0 is in use by: bf1942, bfv, doom3, farcry, joint ops
v7 is in use by: bf2, cod1, et, rvs, rtcw, sof2
v71 is in use by: aao

Cod1 includes United Offensive.

The following games from what I can see do not contain a driver: moh
The following games from what I can see CONTAINS but doesn't USE the driver: quake4

In v0, the drivers' results, are compared with usermode results.
In v7, v71 the drivers' results are encrypted a second time (PB_E) and sent to the server.

v0: A Total of 3 hashes are used.

2 hashes are generated by the amount of hdds you have, with a maximum of 16 Drives.
Hash Begin: "s" Generated from IOCTL_STORAGE_QUERY_PROPERTY
Hash Begin: "t" Generated from SMART_RCV_DRIVE_DATA

1 Hash is generated from various networking properties:
Hash Begin: "m" generated by the combined info of:
a) Hardware NIC via IOCTL_NDIS_QUERY_GLOBAL_STATS
b) MAC Address
^^ The following Hash will not be used if you have onboard lan, and no installed nic cards.

A returned string will look like the following if the user has 1 HDD and onboard lan with no nic cards installed:
sfffffffffffffffffffffffffffffff tfffffffffffffffffffffffffffffff ecf0d0b2

A returned string will look like the following if the user has 2 HDDs with a nic card installed:
sfffffffffffffffffffffffffffffff tfffffffffffffffffffffffffffffff sfffffffffffffffffffffffffffffff tfffffffffffffffffffffffffffffff mfffffffffffffffffffffffffffffff ecf0d0b2

To become unbanned from a v0 Game, simply change your hdds (Change to Raid or buy new ones etc.) & your Mac Address.

v7: A Total or 4 hashes are used, hash 't' is renamed to hash 'r'

2 hashes are generated by the amount of hdds you have, with a maximum of 16 Drives.
Hash Begin: "s" Generated from IOCTL_STORAGE_QUERY_PROPERTY
Hash Begin: "r" Generated from SMART_RCV_DRIVE_DATA

1 Hash is generated from various networking properties:
Hash Begin: "m" generated by the combined info of:
a) Hardware NIC via IOCTL_NDIS_QUERY_GLOBAL_STATS
b) MAC Address
^^ The following Hash will not be used if you have onboard lan and no installed nic cards.

1 Hash is generated by various hardware from your pc. The entire pci chain is queried for info via direct hardware i/o access.
PUSH ECX
PUSH EBX
PUSH ESI
PUSH EDI
PUSHAW
PUSHAD
PUSH ES
PUSH DS
PUSH FS
PUSH GS
MOV AX,8000
MOV AL,BYTE PTR SS:[ESP+5C]
SHL EAX,10
MOV AX,WORD PTR SS:[ESP+60]
AND AX,0FC
MOV AH,BYTE PTR SS:[ESP+54]
SHL AH,3
ADD AH,BYTE PTR SS:[ESP+58]
MOV DX,0CF8 ; 0xCF8 = PCI_INDEX
OUT DX,EAX ; I/O command
MOV AX,WORD PTR SS:[ESP+60]
AND AX,3
MOV BL,8
MUL BL
MOV CX,AX
MOV DX,0CFC
IN EAX,DX ; I/O command
SHR EAX,CL
MOV BYTE PTR SS:[ESP+4F],AL
MOV DWORD PTR DS:[3977F4],0
XOR EAX,EAX
MOV DX,0CF8 ; 0xCFC = PCI_DATA
OUT DX,EAX ; I/O command
POP GS ; Modification of segment register
POP FS ; Modification of segment register
POP DS ; Modification of segment register
POP ES ; Modification of segment register
POPAD
POPAW
MOV AL,BYTE PTR SS:[ESP+F]
POP EDI
POP ESI
POP EBX
POP ECX
RETN 10

Hash Begin: "p":
After the in/out commands are completed eax, will contain a 32bit value for example:

EAX: 11063205
EAX: -> 1106 (Vendor ID)
AX: -> 3205 (Device ID)

Maybe at first glance it doesnt look too bad, however looking at http://www.pcidatabase.com/ we can plugin the values:

11063205 -> Vendor ID: 1106 -> Device ID: 3205
0x1106: VIA Technologies Inc
0x3205: CPU to PCI Bridge
KM400 chipset

1106b198 -> Vendor ID: 1106 -> Device ID: b198
0x1106: VIA Technologies Inc
0xB198: PCI-to-PCI Bridge (AGP 2.0/3.0)
ProSavageDDR P4X600 chipset

10110019 -> Vendor ID: 1011 -> Device ID: 0019
0x1011: Digital Equipment Corporation
0x0019: DC21142/3 / PCI/CardBus 10/100 Mbit Ethernet Ctlr

12745880 -> Vendor ID: 1274 -> Device ID: 5880
0x1274: Ensoniq
0x5880: 5880, AudioPci
Used on Sound Blaster 16 PCI and SoundBlaster 4.1 Digital (eat my 16bit sound card!)

11063104 -> Vendor ID: 1106 -> Device ID: 3104
0x1106: VIA Technologies Inc
0x3104: VT6202 / USB 2.0 Enhanced Host Controller

11063038 -> Vendor ID: 1106 -> Device ID: 3038
0x1106: VIA Technologies Inc
0x3038: VT6212L / 4 x USB2.0 PCI controller

11063038 -> Vendor ID: 1106 -> Device ID: 3038
0x1106: VIA Technologies Inc
0x3038: VT6212L / 4 x USB2.0 PCI controller

11063038 -> Vendor ID: 1106 -> Device ID: 3038
0x1106: VIA Technologies Inc
0x3038: VT6212L / 4 x USB2.0 PCI controller

11063177 -> Vendor ID: 1106 -> Device ID: 3177
0x1106: VIA Technologies Inc
0x3177: VT8235 / PCI to ISA Bridge

11060571 -> Vendor ID: 1106 -> Device ID: 0571
0x1106: VIA Technologies Inc
0x0571: VT82C596 / PCI IDE Controller

10024e48 -> Vendor ID: 1002 -> Device ID: 4e48
0x1002: ATI Technologies Inc.
0x4e48: R360 / Radeon 9800 Pro
Saaphire Radeon 9800 PRO 256Mb Antlantis (R360)

10024e68 -> Vendor ID: 1002 -> Device ID: 4e68
0x1002: ATI Technologies Inc.
0x4e68: R350 / Radeon 9800 Pro - Secondary

The return actually looks more like:
11063205 1106b198 10110019 12745880 11063104 11063038 11063038 11063038 11063177 11060571 10024e48 10024e68

That is then hashed and becomes the 4th hash.

A returned string will look like the following if the user has 1 HDD and onboard lan with no nic cards installed:
v7 s9ffffffffffffffffffffffffffffff r9ffffffffffffffffffffffffffffff p9ffffffffffffffffffffffffffffff ecf0d0b2

A returned string will look like the following if the user has 2 HDDs with a nic card installed:
v7 s9ffffffffffffffffffffffffffffff r9ffffffffffffffffffffffffffffff s9ffffffffffffffffffffffffffffff r9ffffffffffffffffffffffffffffff mfffffffffffffffffffffffffffffff p9ffffffffffffffffffffffffffffff ecf0d0b2

To become unbanned from a v7 game is a little more difficult, follow the steps for a v0 game, and then read below:

At the current time I am not too sure if changing the order of such hardware would change the p hash.

As I don't own more than one pci card I couldn't swap the slots to see if the order of returned pci info changed.

Your best bet is to either remove a card or add a card and hope for the best.

As you can see they are grabbing a LOT of info.

v71 Consists of 4 hashes

It's identical to v7, but reintroduces direct hardware i/o via the ide chain to retrive hardisk info, and from what I could see either:

a) the pci info is not used (but is grabbed)
b) the pci info is used, and combined with the info from the hdds (which would be retarded seeing as changing a hdd would damage their pci results, but hey its pb!)

1 hash is generated by the amount of hdds you have, with a maximum of 16 Drives.
Hash Begin: 'i' Generated via direct hardware i/o for all drives present (maybe includes pci info)

2 hashes are generated by the amount of hdds you have, with a maximum of 16 Drives.
Hash Begin: "s" Generated from IOCTL_STORAGE_QUERY_PROPERTY
Hash Begin: "r" Generated from SMART_RCV_DRIVE_DATA

1 Hash is generated from various networking properties:
Hash Begin: "m" generated by the combined info of:
a) Hardware NIC via IOCTL_NDIS_QUERY_GLOBAL_STATS
b) MAC Address
^^ The following Hash will not be used if you have onboard lan and no installed nic cards.

A returned string will look like the following if the user has 1 HDD and onboard lan with no nic cards installed:
v71 i9ffffffffffffffffffffffffffffff s9ffffffffffffffffffffffffffffff r9ffffffffffffffffffffffffffffff ecf0d0b2

A returned string will look like the following if the user has 2 HDDs with a nic card installed:
v7 i9ffffffffffffffffffffffffffffff i9ffffffffffffffffffffffffffffff s9ffffffffffffffffffffffffffffff r9ffffffffffffffffffffffffffffff s9ffffffffffffffffffffffffffffff r9ffffffffffffffffffffffffffffff mfffffffffffffffffffffffffffffff ecf0d0b2

To become unbanned from a v71 game Id try the changing hdds method (setup raid, buy new hdds, remember each one needs to be replaced), this should disrupt the 'i' hashes, plus 's' and 'r', then a simple mac change should fix 'm'.

Part2: Common Myths.

1.) Sent in from a Kid named Ralf.
Q.) If I am banned and replace partial hardware my other hardware 'X' will be banned ?

A.) False, the 'X' hardware is not automatically banned unless you get another hwban.

2.) Sent in from our good friend "Spontaneous" from MPC.
Q.) PB ONLY uses Mac addresses and harddrive serials, PB does NOT use DVDroms, CDroms, DVDWriters, CDWriters, sound card, video card, motherboard, cpu, floppy, IDE/SATA controlers, or anything along those lines.

A.) Sounds more like he's telling us what happens, rather than a question, but I think my complete reversal of 13 Game Drivers gives me the edge. Anyways as you can see from v7, and v71 games, I'd say just about the entire set of hardware is used and this includes IDE/SATA controllers, vidocard, soundcard, etc.

3.) Sent in from a Kid named Peter.
Q.) When i do receive a hardware ban, which hash's are used in the ban?

A.) Without actually receiving a ban my self, i couldn't really say my self, i would assume they ban your entire set of hardware, and have a type of counter like if UserX has X amount of banned hardware, drop him, so replacing as much of the banned hardware as possible, could prevent this, but like i said, i never have had a hw ban, so i cant say for sure.

4.) Feel free to ask, if I don't know it, I'll reverse the driver till I do know it!

Regards PizzaPan & Sparten

n()()b_Power

18th January 2006, 19:59

Yep they have been getting alot of information, that is why from the begining i have said each hardware ban is user specific. One person may be banned on one thing, and another person will get banned on another. Its a process of trial and error that the user has to do, at that point will you be able to get around your ban and play on PB servers once again.

gil

18th January 2006, 20:41

Thanks G-D and Sparten.
Sticked.

InFeSt3d

18th January 2006, 22:50

how did you get your hands on this info?

Sparten

18th January 2006, 23:30

how did you get your hands on this info?
reversing PB, and pizza is prolly one of the best out there at that job.

Kosire

18th January 2006, 23:47

yeah pizza knows assembly really well so can read a dissasembled program as if it was C++ source code. Thus he knows exactly whats going on in the Driver.

Amazing stuff Pizza!

2FACETANNER

19th January 2006, 05:39

rought

19th January 2006, 11:05

that is some great info...

n()()b_Power

19th January 2006, 21:45

Thus, you are saying the problem with HD spoofers is that each person gets a different "type" of ban? Thus, the only people that could unban themselves are the one that know how they are banned and how to spoof themselves?

Thats the problem yes but most dont have enough knowlege to make spoofers. But they do have knowledge to replace / swap hardware to find out what there banned on and learn what makes them unique in pb land. At that point they can get around there own unique ban.

2FACETANNER

20th January 2006, 05:08

n()()b_Power

20th January 2006, 19:32

Making spoofers is more complicated than making undetected bots.

Which people have the knowledge of making their own spoofers? (Besides of Taurine of course).

It would be awesome if one of these people would release a tutorial of how to identify which type of ban you have, and a Spoofer maker, a program designed to meet the conditions of your ban.

I know this is off-topic from me ... but Tanner im sick of this shit. Why dont you stop looking everywhere else for the answer or for someone to do everything for you, and start looking at yourself and what you can do for yourself. Ultimately its up to you when you realise that you will be kicking yourself in the ass wondering why you wasted so much time asking/begging/suggesting. Step it up for yourself, and this applies to everyone.

spl1ntered

21st January 2006, 11:55

This is very interesting, thank you. I don't really understand it, but it made me wonder something. If you are not currently hardware banned, would it make sense to enable SMART capabilites in the BIOS, so that in the event of a future ban you could disable SMART, thereby depriving PB of one of their hashes?

fidgaf

21st January 2006, 22:27

I don't think it's that easy. The hash contains so much information that it's like activating windows XP. They might have a base check of 7 out of 10 things so if you only change 3 things they can still tell it's the same computer if you get my drift.

The real trick is [Deleted by poster] in the first place...
Methinks I have an idea that needs to be discussed privately...
;)

klown727

13th February 2006, 20:17

Ok I replaced my HD NIC Card and took the built in one on my motherboard off by tearing it off the mother board socket and still got a HW Ban WTF I got to do to get it the **** off.

I got a 2.0 GHz AMD 3000+ With 1 GIG Ram Radeon 9550 and a X-Fi Sound card. What else can I do to get this lifted?

spl1ntered

13th February 2006, 23:42

You should read the initial post thoroughly. It all boils down to there being 3 types of bans.

To become unbanned from a v0 Game, simply change your hdds (Change to Raid or buy new ones etc.) & your Mac Address.

To become unbanned from a v7 game is a little more difficult, follow the steps for a v0 game, and then read below:

At the current time I am not too sure if changing the order of such hardware would change the p hash.

As I don't own more than one pci card I couldn't swap the slots to see if the order of returned pci info changed.

Your best bet is to either remove a card or add a card and hope for the best.

To become unbanned from a v71 game Id try the changing hdds method (setup raid, buy new hdds, remember each one needs to be replaced), this should disrupt the 'i' hashes, plus 's' and 'r', then a simple mac change should fix 'm'.

Determine which type you have, and go from there. But even I as a newbie can tell you it's not a matter of poking stuff in holes and tearing things from your mobo. You have to actually do some reading and educate yourself. Or you can wait for a "one-click" solution.

Sparten

14th February 2006, 02:19

I got a 2.0 GHz AMD 3000+ With 1 GIG Ram Radeon 9550 and a X-Fi Sound card. What else can I do to get this lifted?

I'm 99% sure its your X-FI that giving you problems, it comes with build in firewire that also contains a mac address you will have to change(spoof).

HUMM3R

23rd February 2006, 15:38

Maybe an inapropiate question, but where are these hashes returned? I used taurine's driver to log the values, and all that it gets filled in the output buffer when the pb driver is called, are the first 3 dword's. First and third is constant, the second changes when I spoof the hdd/smart/mac info. Is one of these dwords a pointer to the hashes?
Because I think the direct i/o hash is used for double checking the IOCTL_STORAGE_QUERY_PROPERTY/SMART_RCV_DRIVE_DATA
/IOCTL_NDIS_QUERY_GLOBAL_STATS hashes, is much simpler to have already prepared hashes from not hw banned computers to replace the hash on the hw banned comp.

HUMM3R

28th February 2006, 17:59

Yes, it was an inapropiate question, since the answers can be found on Game-Deception, Pizza Pan's GetHWInfo. Great site filled with great programmers! ;) Thanks.

dextro

13th May 2006, 20:24

can't you spoof your hash values relatively easily?

Missingxtension

17th June 2006, 23:42

well althoug it looks at your hardware to ban and then identifies the resulting hashes as the perp, then what are the chances that everyone who uses a (Exmaple) dell laptop xyz will be banned? I kno the mac adreses are still different and so are the hdd sn# but say if u change 2 out of lets say 7 that still leaves 5 identifiable hashes, i cant believe ppl use this stupid program whats next nick stealing (pb_plist)

[)e@thWolF.^

10th July 2006, 00:41

I have a GLOBAL PUNKBUSTER ARDWARE BAN. Am I banned from all games requiring Punkbuster ? I got my ban while cheating at America's Army. I am able to play CoD2 but on some occasions I get a message when I try to connect to a server saying I'm an Impure Client. Can I still play PB games other than America's Army ?

orgasiM

10th September 2006, 18:16

Torry46

11th September 2006, 01:42

i just got a reply from bp saying why i was hb they said

this hardware was logged in a PB-integrated game using a cheat that tried to prevent detection by PB. The method used is considered by us to interfere with the way PB is designed to work, therefore violating our EULA.

If you were not cheating, then someone was using your computer and was caught.

Either way, your hardware is now permanently banned from all PB servers. You may still play on non-PB servers as our bans only apply to servers with PunkBuster enabled.

Same meesage i have had over and over, it a copy and paste reply from PB. they won't chage their mind either.

Wiat for Trudle to release his spoofer or replace your NIC card and hard drive, remember to disable your lan setting in the bios.

Torry