Ghosts .NET External ESP v1.6 [3.6.5]

[DasKai]

funny guy pls proof haha

[Lovroman]

Ok people, valve anti cheat is on (I GOT BANNED ) I take some time to got banned! I use this and fov view hackers! so.. use at your responsible....

Yea, sure.
VAC bans are delayed.
Proof or bullshit.

[noil]

You will got your prof! ^^

[fudal]

Great joke. ! This is undetected !

[sarahx]

Banned or not, anyways I'm sure that loads of people will get banned in the next 2-3 weeks (?)

VAC is enabled for this game! You can check it on the Ghosts store page.

[Bad_Karma]

Actually The Ghosts Steam page does specify VAC enabled. Was this always the case or is this new?

[[MPGH]master131]

It is true that the Store page claims that VAC is enabled and I can confirm that VAC2 (and probably VAC3) is active too. If you check the loaded module list on Steam, you'll notice a ~XXXX.tmp file being loaded (where XXXX is numbers or letters). This is VAC2; I haven't bothered to dump VAC3.

But I can see some problems with this. Because Steam is 32-bit, it will severely limit what it can do with a 64-bit process. For example, it won't be able to scan Ghost's memory to detect memory changes (eg. for trainers that modify memory and whatnot). It can however, list all processes open on the system and determine it's file location and check if it's a cheat (IW tweeted that they are banning for 3rd party programs).

[GoldenEagle]

list all processes open on the system and determine it's file location and check if it's a cheat

Changing "Program Files" folder to be called "Game Hacks" to troll IW? I think yes.

[[MPGH]master131]

Changing "Program Files" folder to be called "Game Hacks" to troll IW? I think yes.

As funny as it sounds I'm not sure if that will work. I think they send the file name (maximum 16 characters). wav from a now defunct hacking forum documented VAC2's "scan gates" one of which submits the following:

Scan Gate 0xC - Generic Process Scanner

dwVACStatus
Unknown ( always 0 )
OS Version
Unknown ( always 0 )
Always 9
Packet Size = 0x180 ( = 0x20 + i * 0x58 )
Processes Scanned ( # of processes, always 4 )
Unknown ( always 0 )

File MD5
16 bytes padding
16 bytes padding
Memory MD5
2
Base Address of scanned process, right shift by 2 to get rid of the 2, and then left shift by 2 to restore
Unknown ( always 1 )
Filename 16 bytes

[GoldenEagle]

I think they send the file name (maximum 16 characters)

Soo, changing the file names of any tools we use to weird and wonderful things would still give me a good laugh :P

[Slaytanic]

Soo, changing the file names of any tools we use to weird and wonderful things would still give me a good laugh :P

In the hack there is a line where you can change the name of the window to something else, it may not help due to the way the hack executes itself but I am not sure on that.

[mxchild]

yer why not change the program name to something that sounds like a program for something else you could be running (example: overwolf for teamspeak)

[SammyDoge1]

yer why not change the program name to something that sounds like a program for something else you could be running (example: overwolf for teamspeak)

Mine is called "MidgetFistFight"

[Youmi]

Why do you need windows aero??

[Slaytanic]

Why do you need windows aero??

It is used to draw the overlay on the game.