Will this work [A/C bypass]?

Posts 1–15 of 16 · Page 1 of 2
Will this work [A/C bypass]?
I need to bypass detection for my private cheat.. it got detected somehow but it was working fine quite literally an hour ago.. does anybody have suggestions?

I was thinking of moving code around, adding junk/spam code, rewriting things, renaming the DLL, and changing the file description stuffs. Will that work?
reproject
anti-cheat from other servers are getting the same as CFBR/CFNA
maybe the by-pass I posted will work on CFEU / CFPH
Quote Originally Posted by CaiozinhoFC1 View Post
anti-cheat from other servers are getting the same as CFBR/CFNA
maybe the by-pass I posted will work on CFEU / CFPH
I'm playing CFNA.. I'm sure that I might've done something to cause detections in my hack, but I have no idea what to prevent it - it was working fine for almost a week (since I got it working)
Quote Originally Posted by Goocolax View Post
I'm playing CFNA.. I'm sure that I might've done something to cause detections in my hack, but I have no idea what to prevent it - it was working fine for almost a week (since I got it working)
disable all your hack features and try just the bypass for couple hours , after that add functions one by one , just test them 1 day each , until you get ban or dc that means the last function added was the problem so u have to remove it or see another way to do it
Quote Originally Posted by 96neko View Post
disable all your hack features and try just the bypass for couple hours , after that add functions one by one , just test them 1 day each , until you get ban or dc that means the last function added was the problem so u have to remove it or see another way to do it
Can you tell me what the reason is for Ban without using any hack?
Hardware? IP?
Quote Originally Posted by CaiozinhoFC1 View Post
Can you tell me what the reason is for Ban without using any hack?
Hardware? IP?
HWID Ban ??
Quote Originally Posted by DEiseL View Post
HWID Ban ??
hardware ban hwid
Quote Originally Posted by CaiozinhoFC1 View Post
hardware ban hwid
Almost of HWID ban due to using a detcted hack and gets banned or trying to update it
then when banned increase Hwid Ban occuers
Quote Originally Posted by DEiseL View Post
Almost of HWID ban due to using a detcted hack and gets banned or trying to update it
then when banned increase Hwid Ban occuers
I do not understand, as I've already returned this function to another DeviceIOControl, it works normally, but I still get banned

Code:
005BA8FA   50               PUSH EAX
005BA8FB   6A 20            PUSH 20
005BA8FD   57               PUSH EDI
005BA8FE   6A 00            PUSH 0
005BA900   6A 00            PUSH 0
005BA902   68 00005600      PUSH 11_08_EN.00560000
005BA907   51               PUSH ECX
005BA908   FF15 F8016E00    CALL DWORD PTR DS:[6E01F8]               ; kernel32.DeviceIoControl
005BA90E   85C0             TEST EAX,EAX
005BA910   74 17            JE SHORT 11_08_EN.005BA929
// ...
005BB661   51               PUSH ECX
005BB662   E8 B6190000      CALL 11_08_EN.005BD01D
005BB667   8B5424 2C        MOV EDX,DWORD PTR SS:[ESP+2C]
005BB66B   83C4 08          ADD ESP,8
005BB66E   8902             MOV DWORD PTR DS:[EDX],EAX
005BB670   33F6             XOR ESI,ESI
005BB672   85FF             TEST EDI,EDI
005BB674   7E 14            JLE SHORT 11_08_EN.005BB68A
Quote Originally Posted by CaiozinhoFC1 View Post
Can you tell me what the reason is for Ban without using any hack?
Hardware? IP?
did you inject an empty dll and get ban ? or without injecting anything ?
you can test the game on spare pc or laptop in same network ( if you have one )to see if you get ban , if you didnt get ban , just buy a new HDD and rename all your projects and stuffs and make junkcode for your dll when you inject it , just try to be patient and test it as many times untill it success
CPU Disasm
Address Hex dump Command Comments
006156EE |. 68 60957200 PUSH 00729560 ; /Format = "Disconnected from server"
006156F3 |. 6A 01 PUSH 1 ; |Arg2 = 1
006156F5 |. B8 64000000 MOV EAX,64 ; |
006156FA |. C1E0 08 SHL EAX,8 ; |
006156FD |. B9 64000000 MOV ECX,64 ; |
00615702 |. C1E1 10 SHL ECX,10 ; |
00615705 |. BA FF000000 MOV EDX,0FF ; |
0061570A |. C1E2 18 SHL EDX,18 ; |
0061570D |. 0BD1 OR EDX,ECX ; |
0061570F |. 0BD0 OR EDX,EAX ; |
00615711 |. 81CA FA000000 OR EDX,000000FA ; |
00615717 |. 52 PUSH EDX ; |Arg1 => FF6464FA
00615718 |. E8 F31E0900 CALL 006A7610 ; \Crossfire_Dumped.006A7610
0061571D |. 83C4 0C ADD ESP,0C
00615720 |. 8B45 0C MOV EAX,DWORD PTR SS:[ARG.2]

someone here i try to asm it and idk how to remove that message box any help
Quote Originally Posted by iknowitsfake26 View Post
CPU Disasm
Address Hex dump Command Comments
006156EE |. 68 60957200 PUSH 00729560 ; /Format = "Disconnected from server"
006156F3 |. 6A 01 PUSH 1 ; |Arg2 = 1
006156F5 |. B8 64000000 MOV EAX,64 ; |
006156FA |. C1E0 08 SHL EAX,8 ; |
006156FD |. B9 64000000 MOV ECX,64 ; |
00615702 |. C1E1 10 SHL ECX,10 ; |
00615705 |. BA FF000000 MOV EDX,0FF ; |
0061570A |. C1E2 18 SHL EDX,18 ; |
0061570D |. 0BD1 OR EDX,ECX ; |
0061570F |. 0BD0 OR EDX,EAX ; |
00615711 |. 81CA FA000000 OR EDX,000000FA ; |
00615717 |. 52 PUSH EDX ; |Arg1 => FF6464FA
00615718 |. E8 F31E0900 CALL 006A7610 ; \Crossfire_Dumped.006A7610
0061571D |. 83C4 0C ADD ESP,0C
00615720 |. 8B45 0C MOV EAX,DWORD PTR SS:[ARG.2]

someone here i try to asm it and idk how to remove that message box any help
Code:
005FB880   55               PUSH EBP         <----------- CHANGE 55 to C2\08\00
005FB881   8BEC             MOV EBP,ESP
005FB883   6A FF            PUSH -1
005FB885   68 6FBA6A00      PUSH 11_08_EN.006ABA6F
005FB88A   64:A1 00000000   MOV EAX,DWORD PTR FS:[0]
005FB890   50               PUSH EAX
005FB891   64:8925 00000000 MOV DWORD PTR FS:[0],ESP
005FB898   83EC 3C          SUB ESP,3C
005FB89B   894D C8          MOV DWORD PTR SS:[EBP-38],ECX
005FB89E   68 58E67000      PUSH 11_08_EN.0070E658                   ; ASCII "Disconnected from server"
Quote Originally Posted by iknowitsfake26 View Post
CPU Disasm
Address Hex dump Command Comments
006156EE |. 68 60957200 PUSH 00729560 ; /Format = "Disconnected from server"
006156F3 |. 6A 01 PUSH 1 ; |Arg2 = 1
006156F5 |. B8 64000000 MOV EAX,64 ; |
006156FA |. C1E0 08 SHL EAX,8 ; |
006156FD |. B9 64000000 MOV ECX,64 ; |
00615702 |. C1E1 10 SHL ECX,10 ; |
00615705 |. BA FF000000 MOV EDX,0FF ; |
0061570A |. C1E2 18 SHL EDX,18 ; |
0061570D |. 0BD1 OR EDX,ECX ; |
0061570F |. 0BD0 OR EDX,EAX ; |
00615711 |. 81CA FA000000 OR EDX,000000FA ; |
00615717 |. 52 PUSH EDX ; |Arg1 => FF6464FA
00615718 |. E8 F31E0900 CALL 006A7610 ; \Crossfire_Dumped.006A7610
0061571D |. 83C4 0C ADD ESP,0C
00615720 |. 8B45 0C MOV EAX,DWORD PTR SS:[ARG.2]

someone here i try to asm it and idk how to remove that message box any help
just say what happens and i will help
Quote Originally Posted by DEiseL View Post
just say what happens and i will help
i just want to remove message box of DC so my problem is already solve now

- - - Updated - - -

Quote Originally Posted by CaiozinhoFC1 View Post
Code:
005FB880   55               PUSH EBP         <----------- CHANGE 55 to C2\08\00
005FB881   8BEC             MOV EBP,ESP
005FB883   6A FF            PUSH -1
005FB885   68 6FBA6A00      PUSH 11_08_EN.006ABA6F
005FB88A   64:A1 00000000   MOV EAX,DWORD PTR FS:[0]
005FB890   50               PUSH EAX
005FB891   64:8925 00000000 MOV DWORD PTR FS:[0],ESP
005FB898   83EC 3C          SUB ESP,3C
005FB89B   894D C8          MOV DWORD PTR SS:[EBP-38],ECX
005FB89E   68 58E67000      PUSH 11_08_EN.0070E658                   ; ASCII "Disconnected from server"
i using this but still gives me a DC msg
memcpy(reinterpret_cast<void*>(Engine + DCMsg), "\xC2\x08\x00", 3);
Posts 1–15 of 16 · Page 1 of 2

Post a Reply

Similar Threads

Tags for this Thread

None

Talk with us