[FaIW] aIW Ban Bypass

[nismax]

This is a bypass for aIW's new ban mechanism. It includes both binary and source releases (this thread). If you're a nub, change your MAC address, and your IP (there are other threads around for such). If you know what you're doing and just need a binary, extract the archive and run faiw.exe and it will inject the faiw.dll as soon as possible. The source code is pretty self explanatory and is follows:

[php]
#include <windows.h>
#include <tchar.h>
#include <wchar.h>
#include "detours.h"
#pragma comment(lib, "detours.lib")

typedef LONG (WINAPI* RegEnumValueW_Proto)(HKEY, DWORD, LPWSTR, LPDWORD, LPDWORD, LPDWORD, LPBYTE, LPDWORD);
typedef LONG (WINAPI* RegQueryValueExW_Proto)(HKEY, LPCWSTR, LPDWORD, LPDWORD, LPBYTE, LPDWORD);

RegEnumValueW_Proto RegEnumValueW_Pointer;
RegQueryValueExW_Proto RegQueryValueExW_Pointer;

LONG WINAPI RegEnumValueW_Detour(HKEY hKey, DWORD dwIndex, LPWSTR lpValueName, LPDWORD lpcbValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);
LONG WINAPI RegQueryValueExW_Detour(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData);

BOOL WINAPI DllMain(_In_ HANDLE _HDllHandle, _In_ DWORD _Reason, _In_opt_ LPVOID _Reserved)
{
DisableThreadLibraryCalls((HMODULE)_HDllHandle);
if (_Reason == DLL_PROCESS_ATTACH)
{
RegEnumValueW_Pointer = (RegEnumValueW_Proto)DetourFunction((PBYTE)GetProc Address(GetModuleHandle(_T("advapi32")), "RegEnumValueW"), (PBYTE)RegEnumValueW_Detour);
RegQueryValueExW_Pointer = (RegQueryValueExW_Proto)DetourFunction((PBYTE)GetP rocAddress(GetModuleHandle(_T("advapi32")), "RegQueryValueExW"), (PBYTE)RegQueryValueExW_Detour);
TCHAR filePath[256];
ExpandEnvironmentStrings(_T("%AppData%\\steam_md2. dat"), filePath, 256);

if (GetFileAttributes(filePath) != 0xFFFFFFFF)
{
DeleteFile(filePath);
MessageBeep(MB_OK);
}
}
else if (_Reason = DLL_PROCESS_DETACH)
{

}

return TRUE;
}

LONG WINAPI RegEnumValueW_Detour(HKEY hKey, DWORD dwIndex, LPWSTR lpValueName, LPDWORD lpcbValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
{
if (wcscmp(lpValueName, _T("NetworkAddress")) == 0)
{
MessageBeep(MB_OK);
return ERROR_NO_MORE_ITEMS;
}
return RegEnumValueW_Pointer(hKey, dwIndex, lpValueName, lpcbValueName, lpReserved, lpType, lpData, lpcbData);
}

LONG WINAPI RegQueryValueExW_Detour(HKEY hKey, LPCWSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData)
{
if (wcscmp(lpValueName, _T("NetworkAddress")) == 0)
{
MessageBeep(MB_OK);
return ERROR_FILE_NOT_FOUND;
}
return RegQueryValueExW_Pointer(hKey, lpValueName, lpReserved, lpType, lpData, lpcbData);
}
[/php]

P.S: If you really want to have fun, change your aIW username to:

^1aIW|^0Unbannable

to show these ******s that you can't be banned.

Oh, and if you're in need of a hack to use, here's my modified Wieter20 public hook without the spam, just run mw2pp.exe and it'll autoinject.

gg,
req0

Links:
FaIW Bypass - Attached (Virus Scan)
No-Spam Wieter20 Hook - Attached (Virus Scan)NOTE: Menu key changed from DELETE to BACKSPACE. My bad, ya'll.
Related aIW.net Cheat Report (Funny ass video within)

@Credits:
Wieter20: For the public hook I nop'd. Pretty good 180 degree aimbot. Pretty easy to figure out how to make it 360 degrees, but left it as an RE exercise for the user.

nice i wish i can use this somehow. thanks anyways go coders f;;k alter iw up

Reported for flaming. Grow up, really.

reported for flaming i with i was mod on this site. i would report your bann for all times

[iwnet123]

dont works
fucking bypass

[Elmoisabeast]

Do you have Proof?
cause it looks like its working for me now you have been banned message still trying to connect to a game though

Edit: ok well cant connect to any games and the dedicated servers (attempts then fails) but it shows i have others playing

[Flossenwurst]

thanks for the dll fix but when i start iw4mp.exe first and then faiw.exe it doesnt start.why?

[aIW|Convery]

thanks for the dll fix but when i start iw4mp.exe first and then faiw.exe it doesnt start.why?

Patched? You should read the other posts..

[Flossenwurst]

does somebody know how alteriwnet generate the xuids?
because after each patch my xuid changed.

[aIW|Convery]

does somebody know how alteriwnet generate the xuids?
because after each patch my xuid changed.

XUID = Hashed MAC.
And ye, in one of the later patches we changed how it was calculated.. not sure why :3

[Elmoisabeast]

yeah this is patched
i had the hotspot method and this method running and was unbanned then i UN-installed hot spot and was banned so PATCHED!

[[MPGH]master131]

XUID = Hashed MAC.
And ye, in one of the later patches we changed how it was calculated.. not sure why :3

Probably because some users were generating identical XUIDs.

[Flossenwurst]

do you think there come a new unbann method?

[EpicTazz]

It says its missing file " MSVCR100.dll " then i download it, and another error ! " Cannot find something address _invalid_parameter_noinfo_noreturn in the DLL file MSVCR100.dll "

help?

[xbeatsszzx]

It says its missing file " MSVCR100.dll " then i download it, and another error ! " Cannot find something address _invalid_parameter_noinfo_noreturn in the DLL file MSVCR100.dll "

help?

btw this doesnt get u unbanned...it kinda failed
cuz we i open this..it doesnt do anything..

[skitzo da clown]

it did work. i couldnt use it on win7 though but i tried on xpsp3 and worked fine until now
so more than likely patched

[Max Damage]

This is patched, just sayin'.

[Max Damage]

Hi, Max Do you remember My forum you registered on? Well I have further produced it! Check it out. We have our own Client and server

It's still shit.