Thread: TAC Information

Results 1 to 8 of 8
  1. #1
    DadDelta's Avatar
    Join Date
    Jun 2013
    Gender
    male
    Posts
    641
    Reputation
    18
    Thanks
    1,344

    TAC Information

    After looking into TAC, i found the following results:

    1. The game makes screenshots of your screen (this includes any windows that could be on top Black Ops 2). They also include information like if you are in combat training, private or public match, etc. (0x75CA30)

    2. The game hides some of its imports by searching the function to import using a hash combined with a Teb->Peb->Ldr search. (0x5F51F0)

    3. The game hooks kernel32.BaseThreadInitThunk. (0x6B7AC0)
    When a thread is created, the game knows about it. It checks the thread's start address (LoadLibraryA, LoadLibraryW, VirtualQuery, SetUnhandledExceptionFilter or DbgUiRemoteBreakin).
    - If it's LoadLibraryA or LoadLibraryW, it sends the full dll path to their servers.
    - If it's VirtualQuery or SetUnhandledExceptionFilter, they do some memmoves around, probably to copy the data queried or your exception handler filter function code.
    - If it's DbgUiRemoteBreakin, they just send the detection code to their servers, most likely banning you instantly.

    4. The game downloads code (asm) when you connect to their servers, which is then loaded into a game asset called "mp/store_header.img". This file is packed with zlib. (0x504050)
    They call EnumWindows inside the code, and then check some stuff for each window. All the checks are done ONLY if the window is WS_EX_TOPMOST and is visible (WS_VISIBLE).
    They probably check the process associated with the window.


    So this is a list of things that you must do to make sure your cheat is safe:

    1. Bypass their screenshot function! (setting 0x3A248F4 to 1 will bypass it)
    2. Don't create topmost windows!
    3. Don't use LoadLibraryA/LoadLibraryW + CreateRemoteThread/CreateThread injection method!
    4. Don't create threads at VirtualQuery or SetUnhandledExceptionFilter!
    5. Don't attach any debuggers!


    Credits:
    kokole

  2. The Following 2 Users Say Thank You to DadDelta For This Useful Post:

    Lovroman (11-01-2014),TonyMane() (04-29-2015)

  3. #2
    yanyoo's Avatar
    Join Date
    Feb 2014
    Gender
    male
    Location
    Hamburg
    Posts
    38
    Reputation
    10
    Thanks
    670
    My Mood
    Angelic
    If this is correct:

    Very nice Work!

  4. #3
    NewAgeGod's Avatar
    Join Date
    Jun 2013
    Gender
    male
    Posts
    184
    Reputation
    10
    Thanks
    248
    My Mood
    Amazed
    Good work on this info

  5. #4
    Bullet_Striker's Avatar
    Join Date
    Aug 2014
    Gender
    male
    Posts
    48
    Reputation
    10
    Thanks
    0
    My Mood
    Amused
    I am currently looking into making my own hack, this will come in handy!

  6. #5
    DadDelta's Avatar
    Join Date
    Jun 2013
    Gender
    male
    Posts
    641
    Reputation
    18
    Thanks
    1,344
    Quote Originally Posted by Bullet_Striker View Post
    I am currently looking into making my own hack, this will come in handy!
    Glad that this helped. Bumped so it will help more ppl lel
    Game: For Honor

    Goals:
    Thanks: 1000 ✓ Thanks for the Support!
    Thanks: 1500
    Posts: 500 ✓
    Posts: 1000

  7. #6
    OpTic_Callout's Avatar
    Join Date
    Jan 2015
    Gender
    male
    Posts
    1
    Reputation
    10
    Thanks
    0
    DadDelta do you have a mod menu for ps3 that I could download onto a USB?

  8. #7
    DadDelta's Avatar
    Join Date
    Jun 2013
    Gender
    male
    Posts
    641
    Reputation
    18
    Thanks
    1,344
    Quote Originally Posted by OpTic_Callout View Post
    DadDelta do you have a mod menu for ps3 that I could download onto a USB?
    If you google/Youtube, you can find tons of them.
    Game: For Honor

    Goals:
    Thanks: 1000 ✓ Thanks for the Support!
    Thanks: 1500
    Posts: 500 ✓
    Posts: 1000

  9. #8
    aIW|Convery's Avatar
    Join Date
    Oct 2010
    Gender
    male
    Posts
    2,876
    Reputation
    124
    Thanks
    595
    My Mood
    Cynical
    I do have to say that I like TAC, it does a lot of subtle things that are not immediately obvious. For example, there's two functions checking for topmost windows. One simply sends a zlib compressed string containing info about your game (version, gamesettings, fullscreen etc) when an overlay is detected while the screenshot from the other function is sent as a string to the error-event handler. The filenames and the task names are also very misleading :3

    Also, screenshots are only taken when you're in a game with multiple clients, so you can't test in custom games. But there's so much more. There's 3 CRC32 functions that scan everything from addresses to whole modules. Dvar uploading and eval() functions. It's worth having a look at even if you're not into cheating.

    Going to have it enabled on Redacted in the next version, just as an extra layer. So feel free to poke at it during runtime without risking a VAC ban. Just remember to test in offline mode, else the client can get a little upset =P
    Last edited by aIW|Convery; 01-15-2015 at 03:19 AM.

Similar Threads

  1. VIP Information
    By arunforce in forum General
    Replies: 12
    Last Post: 02-18-2007, 09:31 PM
  2. First Look: WR Information AND Screenshots
    By Dave84311 in forum WarRock - International Hacks
    Replies: 33
    Last Post: 07-09-2006, 02:41 AM
  3. MPGH - Information
    By Dave84311 in forum General
    Replies: 22
    Last Post: 03-24-2006, 12:56 AM