PDA

View Full Version : What I found out


test0r
19th April 2004, 21:10
OK,

I found out that PB doesnt kick you for just having my hack open/running. That means, that PB doesnt scan for window names or processes. I log-BPed many functions in OllyDbg (Toolhelp32API, several Process/Memory functions) and couldnt find anything that really tests/scans in processes (and my hacks - all versions - were open). I was very surprised, because you had often said, that PB e.g. will kick when you hack with TrainerMaker or something like that. But PB doesnt look into other processes!
Of course it can kick you for hacking with T-Search, because T-Search injects a DLL into the attached process, but not for other processes.

This is logical to me, because PB really cannot kick you for not cheating (just having a process open) - it also always shows a GAMEHACK # - What if no hack is active - which #?

Anyways, can you tell me which testing results you have and if it is the same in bf1942 (does it kick there - e.g. with your TMK hack caliber?)?


Thx for answers :D

caliber1942
19th April 2004, 21:42
i never personally tested it, but from what i understand even back in the dazhack days that just having a trainer running with tmk (even if it was a trainer for another game!) apparently caused a kick. hell, it should be easy to test this (tmk kick) by just running a trainer made by it in the background and not engaging the cheats and then also running a trainer made in the background that isn't even for vietnam or bf1942.

maybe it's different for vietnam right now than bf1942.

also, maybe they looked at your trainer and realized that it would be caught because of what it changes via scan of the addresses that it didn't need to be caught via detecting running process name. anyways, maybe someone can test the tmk thing. i don't have it handy right now, so can't do it. someone could even download the bf1942 tmk trainer and run it while playing vietnam and see if it causes a kick (just don't activate any cheats with it).

sorry that i didn't test this before, but i hope that it DOES kick tmk users since the point of making that trainer with tmk was to make it so they had to do their public hack in non-pb servers-

CaptainCox
19th April 2004, 22:00
Actualy test0r I mentioned this here or somewhere else...I dont remeber anymore..doesnt matter, anyway, that alot of people especialy on EC servers (couse I play mostly EC or specificaly on German servers) are using hacks on PB servers. and I thought that it cant be that manny people with priv hacks out there, so most likely they are using yours or could be mine (simple TMK NOP) that I did for another forum or what ever. So this finding of yours is actualy strengthening the fact that these hacks dont get PBusted.....YET!!!

test0r
20th April 2004, 16:08
If you activate your hacks (with known offsets) you will be kicked of course. I only found out that PB doesnt kick for having the trainer process open - that PB even doesnt scan processes. This is kinda logical to me, because there is just no need for any hack to detect the process. You can detect everything within the BF memory...

Could you (caliber) test it with the public bf1942 TMK hack on a PB server? I dont have 42 installed and I also dont have the 1.6 patch any more (have ISDN, so...).

If not can anyone else (maybe you Cox) test it in bf1942 with caliber's hack (on a PB server, of course none of the cheats enabled, just running hack)?? I am very interested in this, so plz :)!

caliber1942
20th April 2004, 18:40
what do you want me to do?

1) run your bfv hack process in the background while playing 1942?

2) run my tmk hack process in the background while playing bfv?

3) run my tmk hack process in the background while playing 1942?

of course DONT activate any cheats, just process running.....

tell me which or all of them or whatever-

test0r
20th April 2004, 19:43
of course 3. That is the only logical way :D If you have time you may also do 2...
Yes, without activating any cheats. Join a PB-Server and play/wait for about 15 minutes - that should be enough to test. Then return to this thread and post you results ;)

Thx for your help, btw.

caliber1942
20th April 2004, 20:37
here's what i did:

1 I started bf1942.exe and then went to multiplayer--> internet
2 Turned on the Punkbuster option
3 alt-tab out and then start the tmk1942.exe (my trainer)
4 alt-tab back and then click on EA server game (coral sea)
5 game started... went through the pb verifivation (0 cvar violations, etc).
6 approx 2 minutes into the game i was kicked for gamehack violation

i never engaged any of the cheats at all, just the trainer was running. any more tests?

test0r you might also want to remember that daz's hack caused global GUID bans and it didn't do much different things than the rest of our hacks, except the pb ss avoid stuff (which my own hack now has also). so i still think it must be able to identify if certain processes are running or something.... how else would it know daz's hack specifically for a ban?

test0r
20th April 2004, 20:43
it need not know that it is "DazHack", it only needs to detect the SS offset.
But you are right in some way, because DH also violates the EULA with its process (morphing etc..). But OK I thought, that is is like that in BF42, but currently there is no process detection in BFV - tahts what I can say ;)

caliber1942
20th April 2004, 20:59
cool- although i could make a trainer with nops for vietnam with tmk and see what it does, but will have to test that another day-

soy380
24th April 2004, 08:05
thought i would post this little bit of info. When i first discovered test0r's hack, i used it all the time on pb-enabled servers and was never kicked, i even played on ea servers for many many hours. I think it was the last version (1.00) or maybe the version just b4 that where i was kicked once, so i never tried again. but with the earlier versions, pb would never detect it... hell, i almost posted a message to tell you guys that even though test0r said to use it on non-pb enabled servers, it wasnt detected on pb-enabled servers.
Just some food for thought.

test0r
24th April 2004, 12:47
All hacks should be detected, there is no difference...

Spontaneous
24th April 2004, 18:09
soy380, that was ONLY DUE to the fact that PB did not have their scanning turned on until recently. They were not busting any hacks at that time. Now they are busting hacks. They did 1 update which enabled scanning. Once that happened, test0rs hack was detected by the memory offsets and the NOPs put into them offsets. The hack was created to get busted on PB, even tho it was working on PB servers at 1st, then again any hack would have worked on PB at 1st. Theres some food for thought for you.

shears
28th April 2004, 01:27
I don't think Soy380 was trying to be rude. He's new and is probably learning, so everyone should cut him some slack.