Year 2022 Update

There has been many distractions for me the last year however I’m migrating some old project to my Github for everyone who wants to contribute.

Still thinking about what to do for this site if anyone wants to contact me shoot me[at] an email and ill try get back to you.

I’ve done some work around the Android game hacking I may write up something in the future. [Watch This Space]



Posted in Main | Tagged , , | Leave a comment

Year 2021

Yes it has been a while everyone.. Almost 2 years.

I’m going to better shape my previous blog posts along with refresh this site sometime this year. I’ve been away from the scene for a while doing other things so it’s going to take some time to ugh get motivation/time to begin some new projects.


Posted in Main | Leave a comment

Year 2019

This blog has been getting quieter and quieter. I have not been doing research or development much that I can share almost to a point I forgot this blog existed.

Neverless if I find something worth posting about I will.

Yes I’m still alive 🙂

Posted in Uncategorized | Leave a comment

BattlEye Anti-Anti LoadLibrary

So while testing some things against a BattlEye protected again I noticed recently there was an update that prevents LoadLibrary from being utilized even after unloading the Anti-cheat.

First of all I thought, maybe Mr Bastian isn’t unloading the minifilter hook or it’s the PsSetLoadImageNotifyRoutine catching the LoadLibrary call but that didn’t really make sense.

Checking the system for any hooks and routinues installed returned nothing, so how is he still blocking the LoadLibrary call even after the BEDaisy driver is unloaded and BEClient.dll gone from the game’s module list.

So let me explain whats going on here:

He is overwritting one of NTDLLs core structued used by the Windows Loader:


If you compare the original loaded bytes to the ones that are present in any game BattlEye runs on you will notice that there is an line patch present.


50 00 00 00 00 00 00 00


50 00 00 00 00 00 E7 F9

This stops any DLL if it has runtime checks enabled (CRT) and/or manifest resource causing an Access is Denied Error.

Restoring these patched bytes will fix the issue.

Posted in Uncategorized | Tagged , , , , , , , | Leave a comment

Xenuine Anti-cheat | PlayerUnknown’s Battlegrounds

Blocked Access

It’s been a while since I’ve posted. So my adventures have moved passed the Valve Anti-cheat towards something far more interesting. Battle-Eye AC and now this.

Titled ‘Xenuine’ the new anti-cheat by PUBG Corporation the owners of PlayerUnknown’s Battlegrounds ‘PUBG’ which has been developed to run along side the failing Battle-Eye anti-cheat. Announcement

This anti-cheat after taking a brief look seems to only operate in Ring3 (Usermode) meaning that there is no Ring0 (Kernel) component.

Utilizing this technique:

They are protecting their game executable code from being touched, on top of that they are doing something which will catch any allocated memory marked as ReadWriteExecute with an exact detail of what instruction and/or process wrote or caused the detection which is surprisingly good for a ring3 anticheat.

I will be doing more research into this, for now here is my post on UnknownCheats about it:

Posted in Main | Tagged , , , , , , , , , , , | Leave a comment

Valve Anti-Cheat Untrusted Bans (VAC) CSGO

Untrusted Bans

So recently I’ve seen people suprized at how they are getting ‘untrusted bans’ on cheating forums. Some even confused at what that term even means.

Even though Valve hasn’t given us a definition of what it means previously it was understood that an ‘untrusted ban’ was the serversided anticheat ban given to players who send incorrect data to the game server in Valve’s official matchmaking. Most prominently player view angles which are stored in the Euler format (X,Y,Z) (Pitch, Yaw, Roll) if sent incorrectly to the game server instantly will flag your account as ‘untrusted’.

Heres some MSPaint diagram I drew showing you what I mean by invalid viewangles and how this is a big no no when the server receives them.

Now without going way off topic let me just point out whats going on, obviously the game character can not be upside down in CSGO there is no possible way for this to happen therefore if the Valve Offical Matchmaking Server receives 180 for the roll angle for example in this case they will instantly flag your account for a ban.

Untrusted bans however have evolved from that, people are getting untrusted bans with correct viewangles and you see the same sort of replies people make on forums online. “You forgot to clamp your angles properly”, “You must of wrote wrong viewangles” when in fact it could be something else causing these types of bans.

Now disclaimer I present to you my take on things this isn’t necessarily why it happens but I believe strongly it’s very likely to be the case based on research I’ve done on the Valve Anti-cheat system.


When you load an internal hack into a game (in this case csgo) usually the easiest way to do so is to call a function exported by KERNEL32 called LoadLibrary. LoadLibrary comes in many variants and since it’s the easiest to use one can quickly whip up an injector for their hack or copy paste one from the Internet and make it work.

Now lets talk about VAC3, one of the process scanning modules that resides in VAC returns all loaded modules in CSGO (or the target process) at the time of the scan.

It returns:

  • ModuleBase
  • MD5 Hash
  • VolumeSerialNumber (the module is stored on)
  • Some other attributes also present in structure ‘BY_HANDLE_FILE_INFORMATION’

It also has the ability to do deeper scans on individual modules, one of the more interesting scan flags returned is the fact if the module mapped in memory is present in the module list (PEB). Some people using LoadLibrary think it’s smart to unlink their hack module from the PEB which makes it appear even more suspicious as they can easily tell and do log this when scans are run.

(Here is a zip file containing said module and a IDA idb file which has fixed imports and decoded strings)

Scan Function is @ 0x10002f07


So where am I going with this you may be wondering? Well 2017.05.02 there was a CSGO update which bought some sneaky changes to game integrity.

At first it appeared they did this to stop anti-virus vendors from incorrectly flagging CSGO’s DLL libraries as malware (false positives). However if you think about this was a pretty strategic move on Valve’s part to help them isolate potential cheat specific DLLs.

Since VAC is constantly collecting data from you and I they have a massive sample size of loaded DLLs that could be present in CSGO besides their own signed modules which you can not alter. For example they can easily rule out their official DLL libraries from foreign ones.

There are a ton of legitmate applications which load libraries into other windows applications such as teamviewer ‘tv_w32.dll’ however Valve eventually collects enough data to determine that your hack dll you load everytime CSGO runs is in fact be a cheat and will deem your client as ‘untrusted’


Write your own manual mapper, and don’t copy paste assembly stubs (they are signatured)

Posted in Main | Tagged , , , , , , , , , | Leave a comment

VAC3 Updates

I haven’t posted anything here in a while and well this just happened yesterday.

VAC ban wave

They are indeed doing something to the timestamps of the modules because

File: vac_module_0_4034d3e194a4d269c43e889593b00bcb.dll
Size: 29KB
Export TimeStamp: 13/05/2017 4:07:59 AM
Debug TimeStamp: 13/05/2017 4:07:59 AM
.text hash: 70E41F8439001066DE3FFFB00B1CDE52A0BF9E6F
File: vac_module_0_125e53d20a0cbe4849b7ff5f0130a2bf.dll
Size: 29KB
Export TimeStamp: 16/05/2017 4:59:39 AM
Debug TimeStamp: 16/05/2017 4:59:39 AM
.text hash: 3AD50243148A16042AA035749A1AEC049FCEA2A3

Same module, which enumerates drivers that is 100% identical has different timestamps.

signed int __thiscall sub_100021AE(char *this)
  char *v1; // ebp@1
  signed int v2; // ebx@1
  int v3; // esi@1
  int v4; // eax@2
  _DWORD *v5; // esi@2
  _DWORD *v6; // edi@6
  int v7; // ST38_4@6
  int v8; // esi@6
  int v9; // eax@6
  signed int v10; // eax@8
  bool v11; // cf@8
  bool v12; // zf@8
  int v13; // eax@14
  int v14; // esi@16
  int v15; // ecx@16
  int v16; // eax@16
  int v17; // ecx@16
  int v18; // eax@16
  int v19; // eax@17
  int v20; // edi@19
  int v21; // eax@19
  int v22; // eax@21
  int v23; // edx@21
  int v24; // esi@21
  int v25; // eax@22
  int v26; // ecx@23
  _DWORD *lpMem; // [sp+4Ch] [bp-2918h]@1
  _DWORD *v29; // [sp+50h] [bp-2914h]@13
  int v30; // [sp+54h] [bp-2910h]@1
  unsigned int v31; // [sp+58h] [bp-290Ch]@6
  LPVOID v32; // [sp+5Ch] [bp-2908h]@1
  int v33; // [sp+60h] [bp-2904h]@20
  int v34; // [sp+64h] [bp-2900h]@1
  unsigned int v35; // [sp+68h] [bp-28FCh]@12
  int v36; // [sp+6Ch] [bp-28F8h]@20
  int v37; // [sp+70h] [bp-28F4h]@20
  int v38; // [sp+74h] [bp-28F0h]@1
  int v39; // [sp+78h] [bp-28ECh]@16
  char v40; // [sp+7Ch] [bp-28E8h]@6
  char v41; // [sp+80h] [bp-28E4h]@1
  char v42; // [sp+94h] [bp-28D0h]@1
  char v43; // [sp+A8h] [bp-28BCh]@1
  char v44; // [sp+BCh] [bp-28A8h]@23
  int v45; // [sp+12Ch] [bp-2838h]@23
  char v46; // [sp+134h] [bp-2830h]@16
  char v47; // [sp+135h] [bp-282Fh]@18
  char v48; // [sp+234h] [bp-2730h]@21

  v1 = this;
  v2 = 0;
  v30 = 0;
  v32 = 0;
  lpMem = 0;
  v38 = 0;
  v3 = ((int (__stdcall *)(_DWORD, _DWORD, signed int))vac_import_tbl.OpenSCManagerA)(0, 0, 4);
  v34 = v3;
  if ( !v3 )
    goto LABEL_2;
  v32 = (LPVOID)HeapAllocSimple(0x10000u);
  if ( v32 )
    v6 = v32;
    v8 = ((int (__thiscall *)(int, int, signed int, signed int, LPVOID, signed int, char *, unsigned int *, int *))vac_import_tbl.EnumServicesStatusA)(
    v9 = ((int (*)(void))vac_import_tbl_ptr->GetLastError)();
    if ( !v8 && v9 != 234 )
      v4 = ((int (*)(void))vac_import_tbl_ptr->GetLastError)();
      v5 = 0;
      v2 = v4;
      goto LABEL_33;
    v10 = v31;
    v11 = v31 < 0xCB;
    v12 = v31 == 203;
    *((_DWORD *)v1 + 6) = 0;
    if ( !v11 && !v12 )
      v10 = 203;
    v31 = v10;
    v5 = (_DWORD *)HeapAllocSimple(0x1000u);
    lpMem = v5;
    if ( v5 )
      v35 = 0;
      if ( v31 > 0 )
        v29 = v6;
        while ( 1 )
          v13 = ((int (__stdcall *)(int, _DWORD, signed int))vac_import_tbl.OpenServiceA)(v34, *v6, 5);
          v30 = v13;
          if ( !v13
            || !((int (__stdcall *)(int, _DWORD *, signed int, char *))vac_import_tbl.QueryServiceConfigA)(
                  &v40) )
          ((void (__stdcall *)(int))vac_import_tbl.CloseServiceHandle)(v30);
          v14 = 20 * *((_DWORD *)v1 + 6);
          v15 = *v6;
          v30 = 0;
          v39 = v14;
          v16 = sub_10006495(v15);
          *(_DWORD *)&v1[v14 + 36] = sub_10005043(*v6, v16);
          v17 = lpMem[3];
          v18 = sub_10001A77(&v46);
          if ( v18 )
            v19 = sub_10006495(v18 + 8);
          if ( v47 != 58 )
            v20 = sub_10006495((char *)off_10007290 + 469);
            v21 = sub_10006495(&v46);
            *(&v46 + v20) = 92;
            v6 = v29;
          v33 = 0;
          v36 = 0;
          v37 = 0;
          if ( (unsigned __int8)sub_10003677(&v33, &v36) )
            v29 = 0;
            v22 = sub_100047B1(v33, v36, v37, &v29);
            v23 = v39;
            *(_DWORD *)&v1[v39 + 44] = v29;
            v24 = (int)&v1[v23];
            *(_DWORD *)&v1[v23 + 40] = v22;
            *(_DWORD *)&v1[v23 + 48] = 0;
            *(_DWORD *)&v1[v23 + 52] = 0;
            if ( !v22 )
              v25 = sub_1000480B(&v48);
              *(_DWORD *)(v24 + 40) = v25;
              if ( !v25 )
                v45 = 1;
                if ( (unsigned __int8)sub_10004EA5(&v44, v26) )
            if ( ++*((_DWORD *)v1 + 6) >= 0xCBu )
              goto LABEL_5;
          v6 += 9;
          v5 = lpMem;
          v29 = v6;
          if ( v35 >= v31 )
            goto LABEL_33;
        v4 = ((int (*)(void))vac_import_tbl_ptr->GetLastError)();
        goto LABEL_32;
      v2 = 8;
    v2 = 8;
    v5 = lpMem;
  ((void (__stdcall *)(int))vac_import_tbl.CloseServiceHandle)(v30);
  ((void (__stdcall *)(int))vac_import_tbl.CloseServiceHandle)(v34);
  return v2;

100% match

Valve what are you up to now…  🙄

Posted in Main | Tagged , | Leave a comment

Valve Anti-cheat (VAC) in 2017

Lets first talk about Valve’s roadmap for Counter-Strike Global Offensive, mentioned briefly by Valve’s Gabe Newell in a reddit AMA he said the following:

As far as a roadmap is concerned, our priorities for 2017 are to replace the UI with Panorama, to make CS:GO available in more territories where a lot of Counter-Strike fans don’t have easy access to it (like China), and anti-cheat. Of course, we’re also planning on continuing to ship bug fixes and new features throughout the year, as in the past.

So clearly they are or from what Gabe has said looking at improving the game’s anti-cheat. Hard to believe as they haven’t exactly done anything significant in the past year or so but who knows we shall see what happens.

Today another post came out from the Valve Anti-cheat’s official reddit account.

A user asked about why they don’t add automated detection for spinbotters and send them to Overwatch they mentioned that heuristics can be very dangerous as cheat developers could probe the system to determine the edges of the detection approach and that it opens up a lot of room for false positives. I personally agree with them but seriously they could do something if they really wanted to that would be adequate. Their focus however seems more on machine learning and this is reflected actually by the current deployment of VAC modules.

Looking at a very recent dump of the modules we can see that their timestamps date back to last year.

Now at first I thought they were faking these timestamps but it seems they are in fact using dated modules. Comparing the timestamps to ones that I’ve dumped on those exact days we can see there are no differences in function calls or anything really.

So for now we can predict that they are working more on a server-sided heuristics approach to detecting cheaters (like mentioned in the reddit post) instead of focusing more on detecting cheats themselves.

We shall see what happens..  😮

Posted in Main | Tagged , , , , , , , , , , | Leave a comment

A New Year!

It’s been a while since I posted, now we are well into our second month of the year and here I’m posting for the first time here since last year.  😐

I’ve published some source code for some game data extraction tools I had made in the past on github if people are interested in the FoxEngine or Halo Online you can find them here:



Posted in Main | Tagged , , , , , , | Leave a comment

Some VAC3 Modules

Meh nothing new but here have some modules.

Posted in Main | Leave a comment