Findings from IDA Pro disasm

[Spontaneous]

Ok right off the bat I found something built in that I dont know if it is a good thing or a bad thing. Win95IsDebuggerPresent. Hmm, PB uses the IsDebuggerPresent API in the other bf games, but this is not PB that I disasm, this is the bf2.exe. Just something that you might want to keep in mind.

BF2 uses keystate for its key setup. Just something to keep in mind for those that use trainers to sendkeys to the game.

hack-ignore-asserts. hmm
GSPunkBusterPath
pbPath
addRank
addAward
addCredit
setViewDistanceScale
setBuddytagColor
setSquadtagColor
useGlobalRank
useGlobalUnlocks
setKit
aFieldOfView
aNametagmanager
aFriendlyteamto db 'FriendlyTeamTopRed'
aEnemybrightalp db 'EnemyBrightAlpha
aEnemybrightblu db 'EnemyBrightBlue'
aEnemybrightgre db 'EnemyBrightGreen'
aEnemybrightred db 'EnemyBrightRed'
aEnemytextalpha db 'EnemyTextAlpha'
aEnemytextblue db 'EnemyTextBlue'
aEnemytextgreen db 'EnemyTextGreen
aEnemytextred db 'EnemyTextRed'
aGsfogstartenda db 'GSFogStartEndAndBase
aGsviewdistance db 'GSViewDistance'
aSetviewdistanc db 'setViewDistanceScale'


There is a lot more but I gotta goto bed. I am about 1/5th the way through the exe. Then I will go through RendDX9.dll since sparten said a lot of stuff is in there too.

[xollox]

Ok right off the bat I found something built in that I dont know if it is a good thing or a bad thing. Win95IsDebuggerPresent. Hmm, PB uses the IsDebuggerPresent API in the other bf games, but this is not PB that I disasm, this is the bf2.exe. Just something that you might want to keep in mind.


I know I read somewhere that they use some of their own built-in cheat detection. It was very vague but they mentioned something about PB not being the only thing detecting cheats...

[Chaotik]

Me too, they said that with this version of the bf series, one of there objectives was to help make the games less open for hacks. I think we have seen that with the minimap already. I don't think it will be a problem tho for some of us!!!!!

[caliber1942]

i saw the IsDebuggerPresent while scanning with olly a few times already. interesting to see it within the .exe itself. won't present a problem searching with TSEARCH for addresses, but might be a problem (if they utilize this) when turning the autohack feature of TSEARCH on or when trying to startup SEH and detours.....

best,
cal

[xollox]

I believe you can patch the IsDebuggerPresent API to always return "no"...

[Spontaneous]

thats true xollox, but I believe the game uses some debugging functions of its own and uses the api for itself, not so much for detecting hacks. Now I could be wrong on this but thats my belief right now.