Plus MW3 aCI Dump (v70)

[Hitokiri~]

I dumped their aCI module. Attached to this post as well.

Anyways, SSDD, they use the same stolen 4D1's idea of doing "troll %d" to send a ban.

However they changed it a bit. Here's the "new" format:

   sprintf(buffer, "troll %d %s", violation_code, 0x7EFB50);

0x7EFB50 points to a 96 bit HWID which they stupidly used wmic to make.

So basically, if you wanted to destroy their project:

static char charSet[] = "QWERTYUIOPASDFGHJKLZXCVBNM0123456789";

// Uses charSet to make a list of all possible HWID combinations.
char* makeHWID();

// Set when all possible combinations have been created
bool done = false;

void BanAllHWIDs()
{
   char buffer[128];
   DWORD msgCall = GetProcAddress( GetModuleHandleA("libpm.dll"), "SendRandomString" );
   while(!done)
   {
       sprintf(buffer, "troll 1337 %s", makeHWID() );
       ( ( int ( * )( char* ) ) msgCall )( buffer );
    }
}

Bypassing is as simple as preventing the module from being mapped.
As they download it from their site and manual map it from memory.

Enjoy.

#Rekt

 

Virus Total
Jotti's Malware Scan

[Horror]

Sorry
//Approved.