[Solved] Avoiding Vac Bans

uwottywotm8 · 2015-07-26T21:28:03.000Z

If I use an undetected public hack for the current steam/CSGO version and stop using it immediately after a steam/CSGO update, and wait for further information about detection before using, is this a 100% fool proof method of avoiding a vac ban? And I know using enigma protector would help as well.

Originally Posted by WasserEsser

When do people realise that a Steam/CSGO update has NOTHING to do with VAC. VAC updates itself in the background and is completely independent from any Steam/CSGO update.

didn't know vac has a silent update.
welp any other tips on being safe rather than enigma protector and buying private hacks?

Originally Posted by uwottywotm8

didn't know vac has a silent update.
welp any other tips on being safe rather than enigma protector and buying private hacks?

There's no way to be safe with ANY hack in existence, even private hacks can give you a ban if you're way too comfy hacking in a game.

Yes, VAC has a silent update, it even silently detects all exes and so worth you're running on the background. So, yeah nothing is safe in hands of VAC, even if it's private.

So RIP.. Its just Private hacks aren't as common as public ones.

Originally Posted by WasserEsser

When do people realise that a Steam/CSGO update has NOTHING to do with VAC. VAC updates itself in the background and is completely independent from any Steam/CSGO update.

Yeah exactly this. ^ You won't know the cheat you are using is detected until people start getting banned. It's a risk that is always accompanied when using a public cheat. I've been cheating on my single account for about 6 months and have used over a dozen cheats without detection and here is my method to avoid it.

1. Try not to use a popular cheat (Makes sense that Valve usually targets these first)
2. Try not to use a cheat with multiple detectable hacks from different coders. Ex. A multi hack with the ESP from Merccy, Aim from Puddin Poppin', Bunny hop from whoever etc etc.
3. Completely clear internet browsing history/offline data before launching steam when you've been on multiple hack sites as I've read that (sorry lost source) VAC investigates your computer more thoroughly if some sites are found.
4. Don't keep the cheat on your hard drive. I keep mine on a USB and only leave it in when im cheating, otherwise its ejected.
5. Weird one. Use a USB 1.1 or at most USB 2.0. Lower transfer rates could minimize and prolong the VAC scan.
6. Cheat one game at a time. Then close stream, restart the hack and continue hacking again. Avoid 5 hour marathon cheating sessions.
7. As always, Protect with Enigma or VMprotect.

1. Try not to use a popular cheat (Makes sense that Valve usually targets these first)

VAC scans for public signatures. Pay Cheats are also Public. If i upload a cheat, VAC scans for this particular signature.

2. Try not to use a cheat with multiple detectable hacks from different coders. Ex. A multi hack with the ESP from Merccy, Aim from Puddin Poppin', Bunny hop from whoever etc etc.

Well, if VAC scans for parts of the signature, it could be detected.

3. Completely clear internet browsing history/offline data before launching steam when you've been on multiple hack sites as I've read that (sorry lost source) VAC investigates your computer more thoroughly if some sites are found.

Wat, nothing of that is true.

4. Don't keep the cheat on your hard drive. I keep mine on a USB and only leave it in when im cheating, otherwise its ejected.

VAC scans when you are on a VAC Secure Server, so leaving the USB drive in when you are cheating and plugging it out when you dont makes no sense at all and doesn't help.

5. Weird one. Use a USB 1.1 or at most USB 2.0. Lower transfer rates could minimize and prolong the VAC scan.

Read the above.

6. Cheat one game at a time. Then close stream, restart the hack and continue hacking again. Avoid 5 hour marathon cheating sessions.

Doesn't make any sense. The signature is the same, and VAC scans for it. Why would you restart everything?

7. As always, Protect with Enigma or VMprotect.

Enigma & VMProtect are VERY common methods. I honestly don't think they help at all, VAC knows that people use these Virtual Machines and they do take actions against it.

VAC scans for signatures. I code a cheat, this cheat gets compiled into a certain signature. VAC scans for this. For example, if i make a Program that prints out "Hello World", it has a certain signature. If you download this program, it has the same signature. If i make another program which prints out "H3ll0 W0rld", it has a different signature. VAC scans for the signatures that are public. Every public cheat is getting detected at some time. Some earlier, some later. VAC looks at how many people they could possible ban, and simply push out the ban wave. If a cheat is popular and gets downloaded 5000 times a day, they wait until it gets downloaded 100 times a day, and they push out the banwave, since its not worth waiting longer (fictional numbers). To stay VAC undetected, you simply just have to code your OWN cheat. If you code your own cheat, it has its own signature which is not public, so VAC can't scan for it. They can't just scan for signatures that MIGHT be a hack, since it would push out too many false positives. Code your own hack, get your own signature, don't make it public, and you are safe.

Originally Posted by WasserEsser

VAC scans for public signatures. Pay Cheats are also Public. If i upload a cheat, VAC scans for this particular signature.

Well, if VAC scans for parts of the signature, it could be detected.

Wat, nothing of that is true.

VAC scans when you are on a VAC Secure Server, so leaving the USB drive in when you are cheating and plugging it out when you dont makes no sense at all and doesn't help.

Read the above.

Doesn't make any sense. The signature is the same, and VAC scans for it. Why would you restart everything?

Enigma & VMProtect are VERY common methods. I honestly don't think they help at all, VAC knows that people use these Virtual Machines and they do take actions against it.

VAC scans for signatures. I code a cheat, this cheat gets compiled into a certain signature. VAC scans for this. For example, if i make a Program that prints out "Hello World", it has a certain signature. If you download this program, it has the same signature. If i make another program which prints out "H3ll0 W0rld", it has a different signature. VAC scans for the signatures that are public. Every public cheat is getting detected at some time. Some earlier, some later. VAC looks at how many people they could possible ban, and simply push out the ban wave. If a cheat is popular and gets downloaded 5000 times a day, they wait until it gets downloaded 100 times a day, and they push out the banwave, since its not worth waiting longer (fictional numbers). To stay VAC undetected, you simply just have to code your OWN cheat. If you code your own cheat, it has its own signature which is not public, so VAC can't scan for it. They can't just scan for signatures that MIGHT be a hack, since it would push out too many false positives. Code your own hack, get your own signature, don't make it public, and you are safe.

Hmm. VAC is a very complex entity and I doubt anybody has even a basic understanding of it outside of Valve. Either I'm extremely lucky or I must be doing something right. Anyway, thx for your reply. I'm going to go buy a lottery ticket.

- - - Updated - - -

I have a theory that certain variables can trigger a more intensive or VAC scan and client side steps can be taken to avoid it, like the ones that I outlined in my earlier post. It works for me and I wonder if it would work for others

Originally Posted by apictureofagoose

I have a theory that certain variables can trigger a more intensive or VAC scan and client side steps can be taken to avoid it, like the ones that I outlined in my earlier post. It works for me and I wonder if it would work for others

I use the most obvious variable/funtion names you can ever have, everyone can take my exe and decompile it with ILSpy and almost see the full source code and haven't got VAC banned ever.

Originally Posted by WasserEsser

I use the most obvious variable/funtion names you can ever have, everyone can take my exe and decompile it with ILSpy and almost see the full source code and haven't got VAC banned ever.

Variable names wont matter, strings will tho.

afaik (Haven't actually reversed VAC module myself, its only from experience, which you can choose to trust if you want)
They must have more complex way then simply JUST scaning for signatures, for them to be able to detect PolyCheats they must have either done one of the following:

1. Create patterns and masks for bytes in memory (Like normal pattern scanning that cheats do to get offsets) and just create a big pattern/mask collection and check certain bytes at certain positions to see if it matches anything from the raw source code compilation (Without Poly junk added). Merccy made a post about this a while ago when people supposedly said it was detected, it wasn't tho, at that point it went on to live for 1 or so months longer.

2. Detect by strings, litterally all PolyCheats that were released had the same strings insdie them for each compilation, it should have been 10 tiems easier for VAC to detect it just by checking for strings instead of creating a bunch of complicated Patterns/Mask like the first solution.

3. They could be detecting open handles, I feel like most external hacks using normal TLhelp32 functions would probably get detected then as well, so I doubt this is the method used.

- In conlusion:
Number 2 is the most reliable option for them to choose, and the easiest, but with the time it took to take the hacks down I doubt this was used.
Number 1 has a high chance as well, especially with the time it took.

- Other:
Obviously it could have been detected months ago, but they just decided to gather lots and lots of people to finally strike with a gigantic ban wave.

Originally Posted by WasserEsser

VAC scans when you are on a VAC Secure Server, so leaving the USB drive in when you are cheating and plugging it out when you dont makes no sense at all and doesn't help.

afaik they load the VAC module as soon as you open CS:GO (If you have internet connection since VAC isn't stored physically on your computer)

Originally Posted by WasserEsser

VAC scans for public signatures. Pay Cheats are also Public. If i upload a cheat, VAC scans for this particular signature.

Well, if VAC scans for parts of the signature, it could be detected.

Wat, nothing of that is true.

VAC scans when you are on a VAC Secure Server, so leaving the USB drive in when you are cheating and plugging it out when you dont makes no sense at all and doesn't help.

Read the above.

Doesn't make any sense. The signature is the same, and VAC scans for it. Why would you restart everything?

Enigma & VMProtect are VERY common methods. I honestly don't think they help at all, VAC knows that people use these Virtual Machines and they do take actions against it.

VAC scans for signatures. I code a cheat, this cheat gets compiled into a certain signature. VAC scans for this. For example, if i make a Program that prints out "Hello World", it has a certain signature. If you download this program, it has the same signature. If i make another program which prints out "H3ll0 W0rld", it has a different signature. VAC scans for the signatures that are public. Every public cheat is getting detected at some time. Some earlier, some later. VAC looks at how many people they could possible ban, and simply push out the ban wave. If a cheat is popular and gets downloaded 5000 times a day, they wait until it gets downloaded 100 times a day, and they push out the banwave, since its not worth waiting longer (fictional numbers). To stay VAC undetected, you simply just have to code your OWN cheat. If you code your own cheat, it has its own signature which is not public, so VAC can't scan for it. They can't just scan for signatures that MIGHT be a hack, since it would push out too many false positives. Code your own hack, get your own signature, don't make it public, and you are safe.

yes we get it you like the word signature

Originally Posted by Yemiez

Variable names wont matter, strings will tho.

afaik (Haven't actually reversed VAC module myself, its only from experience, which you can choose to trust if you want)
They must have more complex way then simply JUST scaning for signatures, for them to be able to detect PolyCheats they must have either done one of the following:

1. Create patterns and masks for bytes in memory (Like normal pattern scanning that cheats do to get offsets) and just create a big pattern/mask collection and check certain bytes at certain positions to see if it matches anything from the raw source code compilation (Without Poly junk added). Merccy made a post about this a while ago when people supposedly said it was detected, it wasn't tho, at that point it went on to live for 1 or so months longer.

2. Detect by strings, litterally all PolyCheats that were released had the same strings insdie them for each compilation, it should have been 10 tiems easier for VAC to detect it just by checking for strings instead of creating a bunch of complicated Patterns/Mask like the first solution.

3. They could be detecting open handles, I feel like most external hacks using normal TLhelp32 functions would probably get detected then as well, so I doubt this is the method used.

- In conlusion:
Number 2 is the most reliable option for them to choose, and the easiest, but with the time it took to take the hacks down I doubt this was used.
Number 1 has a high chance as well, especially with the time it took.

- Other:
Obviously it could have been detected months ago, but they just decided to gather lots and lots of people to finally strike with a gigantic ban wave.

afaik they load the VAC module as soon as you open CS:GO (If you have internet connection since VAC isn't stored physically on your computer)

This is what I think too but the last part I didn't know.

Originally Posted by T-800

This is what I think too but the last part I didn't know.

Its true VAC is loaded straight away with internet connection

SolvedAvoiding Vac Bans

Similar Threads

Tags for this Thread