anticheat related information

supp mpgh
i've been playing around and found some intresting functions inside crossfire_x64.exe that do some checks on the game ( vtable checks, hook checks, integrity and stuff like that ).
from what i've reversed so far i've noticed a pattern: they create a thread with the routine (virtualized) that seems to be mapping a dll into the memory game. i think part of the dll is junk, is only there to make the reverse harder, but seems they are realocing constantly the dll after usage.

i've identified a few specific features on both files like:
- calls to deviceiocontrol with specific ioctls like ioctl_storage_query_property and others ioctls to get hwid related info;
- some find patterns that i havent yet tried to use them but i think one of them is d3d9 related, might be junk tbh;
- some random strings search like "Pos Aim" or even "Shoot Through Walls", might be junk tbh;
- they also are walking through the threads and modules to find suspicious modules;
- they are screenshoting the screen and probably sending the screenshot to their servers;

i would apreciate some corrections or additions to this post, ty

the screenshot is checked in the server , so if you are using esp/wh while someone reports you , you will get banned.

if you want you can check NOLF2 source to get a better understanding on how lithtech engine works ( which i think you might did since you got so far with this )

if you basically want to a better CF hacking experience , just work on the packet system and forget everything else and thank me later