Hardware Bans explained

[Eleethal]

For those who wish to know a little about why I constructed my DLL the way I did, here is my post from UC that pretty much gave me the logic to ban only by one serial.

These are some of the method's we know that PunkBuster uses to develope the hash that bans your HardDrive.


HDSerial=sce49bb2d5fec656af3eb3fc3daff9fbf
HDSmart=t9f98c56ed2446543f46c9b7b117b2cd5
AdapterInfo=m7456b5ffcaafe63885c6845de63dca70
The above code was used in the last version of PBHack to spoof them from banning your HardDrives while in play. Any program that alters the above information will undo a Harddrive ban, NOT A GUID BAN. A Guid ban placed on your account is PERMANANT, there is no current way to get around it.

Once again, NO VOLUME SERIAL CHANGER WILL UNDO A HD BAN.

If you have been banned, try changing one of the above serials, that will alter the hash they develope, unless they use multiple hashes to get around a single hash which could be easily altered should you install AA on another Harddrive.

Allow me to explain, if Punkbuster gathers 5 serials from various componants, then the single hash of all of them would be hash XXXX. But if you change one serial out of the five, the total hash itself would be altered.

Here is an example, the MD5 hash of the text 'My name is root' is 27722bf812d04dd57c8a25c5caca706c

But if we changed that to 'Hello my name is rot' we get 72ec2d27c32ca9147c81808818ce1ae0

If this is the method PunkBuster uses, then changing one of the serials listed in the above code could get you out of a Hardware ban.

If Punkbuster gathers five serials, and sends five hashes, then changing one would not get around it becuase the other 4 hashes would mean that those 4 componants are banned. So changing your Adapter (let's assume it is your NIC adapter) would not help because the 4 other adapters (let's say Harddrive serial, vendor ID, video adapter, sound adapter) serials are all still banned.

Example:
Lets say the hashes the use are (and their respective hashes) are...

Adapter 1 92315f80d4647dffaa70f9b53aad263d
Adapter 2 e3bb5a4479cc94aa8d30570cd391d7d4
Adapter 3 2f73a0842de6e0b9552018c5075bbfae
Adapter 4 0d0c05588d3e558bb651bb32ef2f36d4
Adapter 5 44f130e65436bd55b4c99507f51de032


This is why simply changing your Harddrive, or relocating the Armyops.exe and every other AA related files would not work. I wrote my DLL to spoof only one serial (in the version) because I feel with all the heat PunkBuster and EvenBalance is under right now, they wouldn't risk ******* in more bandwidth then what they do.

Hope this helps you understand the new Harddrive bans a little further.

[vector150]

Ok, this might be a noob question to you, but how did you find that string? I have absolutely no idea how to program or write code or anything. I've been looking for the Win32 folder on my computer but can't find it for the life of me. Is in the registry? Can you maybe show us step by step on how you find it? You know like Go to My Computer, Double-Click C: drive, Go t Windows folder, Etc. I know theirs some of us that would like to change like the adapter, or hard drive serial numbers but have no clue how to go about doing it. Thanks for any help.

[Loucifer]

Hooooooo wait one let me go an dig out my degree in theorectial mathimathics..... Huh.... yea it stills says i am posed to understand this lol, so just for you heres a big .........

COOL man thats a nice write up an explanation on how the system works

[gil]

interesting method, but did you try it?
Or someone else? anyone who is HD banned and tried it and was able to play afterwards?

[importdrinker]

my hardward ban consisted of hard drive and/or network adapter....

[Loucifer]

I wonder if doing something with the wireless might help any...... anyone have some ideas on that ?

[gil]

what wireless got to do with HD ban ?

oh, they also ban Network adapters?

[importdrinker]

I wonder if doing something with the wireless might help any...... anyone have some ideas on that ?

thats how i got around my network adapter ban...see my thread on hardware ban

[vector150]

Ok how did you guys find out what was banned? Such as TCP/IP adapter and Hard drive. And can someone explain to me how you find the string that was metioned above? I'll admit it again that I have no clue as to how to find it. I R Noob who wants to play AAO again and want to know how to find what was banned and try and fudge the numbers.

[Loucifer]

what wireless got to do with HD ban ?

oh, they also ban Network adapters?

I dont know man was just throwing that into the mixer as well to see if anyone had thought of trying to use a wireless hookup to get by any of this, Was just a random thought process lol...

[importdrinker]

Ok how did you guys find out what was banned? Such as TCP/IP adapter and Hard drive. And can someone explain to me how you find the string that was metioned above? I'll admit it again that I have no clue as to how to find it. I R Noob who wants to play AAO again and want to know how to find what was banned and try and fudge the numbers.

see my thread on hardware bans.....
http://www.mpcforum.com/showthread.php?t=47207
my bet is ur hard drive and ur network adapter are banned....thats what happened to me...ull have to replace them and/or disable them....

:lam:

Im betting pb isnt banning video cards, motherboards, or displays...
im not sure these items have signature serial numbers but they potentially cost ALOT more and are more likely to be resold to another online gamer....

[Eleethal]

I'm pretty sure I am right on this cuz it was the basis for my DLL (Hardware Spoofer 1.0beta which has worked for everyone who has used it.

[evilbert]

Your information is not completely correct. The values you from the pbhack.ini file are the hashes pb has generated just before transfer.
They make 2 hashes for every hd you have in your machine. First one with drive props, second one with SMART information.
They make 1 hash for every NIC you have in your machine which is built of your NICs MAC.

Greetings, Evilbert

[vector150]

has been kicked for an undefined reason: YOU HAVE BEEN PERMANENTLY BANNED FROM THIS GAME SERVER VIA PUNKBUSTER ... GLOBAL PUNKBUSTER HARDWARE BAN 54598FFA



This is with using the HD fooler program. Yes I'm sure it was installed and used correctly. When launched, it pops up saying "Hard Drive Spoofer Loaded" or something to that effect. It was with a new account, new e-mail and all basic traing done. It hasn't worked for me. Guess no more AAO for me ever.

[FEAR]

if you're already HW banned, this doesnt help you get arround it.. this simply prevents computers that ARENT hardware banned from getting hardware banned...

[Punk.!]

This is why simply changing your Harddrive, or relocating the Armyops.exe and every other AA related files would not work. I wrote my DLL to spoof only one serial (in the version) because I feel with all the heat PunkBuster and EvenBalance is under right now, they wouldn't risk ******* in more bandwidth then what they do.

Hope this helps you understand the new Harddrive bans a little further.


Ok i guess ur wrong on the heat part (hope i'm wrong) since i did change the hd with the hd spoofer and hdprotector. and still get hw banned within the first 10 seconds.. on fresh account on new e-mail. after i ran Cleaner. The options i see from here:
1. Ur right on the heat part but then they didn't ban my hd just x other parts of my comp.
2. They are doing 5 seperate hashes.

(i could be wrong cuz of my english but not likely this time, i hope)

[Eleethal]

Ok i guess ur wrong on the heat part (hope i'm wrong) since i did change the hd with the hd spoofer and hdprotector. and still get hw banned within the first 10 seconds.. on fresh account on new e-mail. after i ran Cleaner. The options i see from here:
1. Ur right on the heat part but then they didn't ban my hd just x other parts of my comp.
2. They are doing 5 seperate hashes.

(i could be wrong cuz of my english but not likely this time, i hope)

Some people have been having no luck with thew spoofer I made and some people find it works amazingly. I don't know how to explain it, it is just the way it is. Hope you find your way past it.

[isther]

Good day all, I want some advice. After beeing hardware banned a few days back, I did the following. Uninstalled AA, (also deleted folder) downloaded AA 2.1 FULL. Reinstalled it and while running the hardware spoffer I created another account. After that, and while still running the spoofer, I made the training, and then finally, played, like around 2 rounds and a half (10, 15 minutes), after which I was again banned:

"KICK NOTIFICATION: ****** has been kicked for an undefined reason: YOU HAVE BEEN PERMANENTLY BANNED FROM THIS GAME SERVER VIA PUNKBUSTER ... GLOBAL PUNKBUSTER HARDWARE BAN *******
Log: PunkBuster Client: Removing "******" (GLOBAL PunkBuster HARDWARE BAN *******)"

Do you have any ideas? Does it means the spoofer doesn't work?

Regards,

[DjOsiris]

Good day all, I want some advice. After beeing hardware banned a few days back, I did the following. Uninstalled AA, (also deleted folder) downloaded AA 2.1 FULL. Reinstalled it and while running the hardware spoffer I created another account. After that, and while still running the spoofer, I made the training, and then finally, played, like around 2 rounds and a half (10, 15 minutes), after which I was again banned:

"KICK NOTIFICATION: ****** has been kicked for an undefined reason: YOU HAVE BEEN PERMANENTLY BANNED FROM THIS GAME SERVER VIA PUNKBUSTER ... GLOBAL PUNKBUSTER HARDWARE BAN 930D7FF6
Log: PunkBuster Client: Removing "******" (GLOBAL PunkBuster HARDWARE BAN 930d7ff6)"

Do you have any ideas? Does it means the spoofer doesn't work?

Regards,

In addition to what you did I would recommend getting a MAC address changer program just search google or these forums. This will allow you to change your MAC address as well as your IP. Changing 3 hashes should do it.

[isther]

In addition to what you did I would recommend getting a MAC address changer program just search google or these forums. This will allow you to change your MAC address as well as your IP. Changing 3 hashes should do it.
I will try that, I'm still trying to find the program, no luck so far. What I also I did not do, was changing HD. So I'll wait 'till I get paid and see if I can then change my HD and the mac address. :)

[I Like Chicken]

I will try that, I'm still trying to find the program, no luck so far. What I also I did not do, was changing HD. So I'll wait 'till I get paid and see if I can then change my HD and the mac address. :)
Try search google or these fourms for SMAC, it's the most popular tool of this kind.

[OMFS]

Your information is not completely correct. The values you from the pbhack.ini file are the hashes pb has generated just before transfer.
They make 2 hashes for every hd you have in your machine. First one with drive props, second one with SMART information.
They make 1 hash for every NIC you have in your machine which is built of your NICs MAC.

Greetings, Evilbert

Very useful information. At least most IDE drives allow you to disable the S.M.A.R.T. function. Problem is making it easy. I have used drivespan before to do somethings with my drive and has always noticed it allowed for easy access to enable or disable the SMART function. It is available here for any who are interested. http://www.fssdev.com/products/drivespan/updates/. Perhaps using this will effectively block one arm of the HD query PB uses. Then the hooking dll would protect the other arm or HDProtector as Evilbert suggested. Use it at your own risk as usual.



Here is a description of what it does.............................................. .
S.M.A.R.T. (Self-Monitoring, Analysis and Reporting Technology) for IDE drives
After installing this version of DriveSpan, you can now access a new S.M.A.R.T. tab through the Device Manager for your hard drives. If an imminent failure is reported by a physical disk, DriveSpan will display a warning message. At this time, please take the necessary steps to backup your data. Note that S.M.A.R.T. is a feature of IDE drives. To determine if a drive supports S.M.A.R.T. or to disable S.M.A.R.T., you can access the S.M.A.R.T. property page through the Device Manager by selecting the hard drive properties.

[OMFS]

jeez, I could disable SMART from my bios...Power up your system and enter BIOS setup. Disable 'S.M.A.R.T.

[importdrinker]

Very useful information. At least most IDE drives allow you to disable the S.M.A.R.T. function. Problem is making it easy. I have used drivespan before to do somethings with my drive and has always noticed it allowed for easy access to enable or disable the SMART function. It is available here for any who are interested. http://www.fssdev.com/products/drivespan/updates/. Perhaps using this will effectively block one arm of the HD query PB uses. Then the hooking dll would protect the other arm or HDProtector as Evilbert suggested. Use it at your own risk as usual.


looks like a good utility but costs $$$....any ideas on a comparable shareware utility????