[Poll] - Who has been banned?

**wuat** · 07-05-2013

Originally Posted by MeepDarknessMeep

Well would it still be detected if I crypted it? I found this auto crypter a few days ago...

Probably would be fine

**iMythik** · 07-05-2013

That's why you don't use Winject,
I'm using wuat's, and dcinjector
I'm hacking just fine.

**wuat** · 07-05-2013

Originally Posted by iMythik

That's why you don't use Winject,
I'm using wuat's, and dcinjector
I'm hacking just fine.

Chances are he's doing something really dumb like checking the process name to detect it, he did that before

Code:

GMod "Anti-Cheat" Analysis
The anti-cheat in Garry’s Mod resides entirely in client.dll. It all begins in CGarrysMod::LevelInit(). Given a random 1 in 100 chance and that the user is not in singleplayer, the anti-cheat will engage after 30 to 360 seconds. However, if g_bHighPriBigEye is true, there is a 1 in 3 chance the anti-cheat will engage after 20 to 60 seconds. g_bHighPriBigEye is set to true in the Lua function Surface.CreateFont() if the argument new_font_name matches the pattern /shm.n.+/. This targets a private cheat for Garry’s Mod  known as SethHack, since  it creates a font called “shmenufont”. 
The second part of the anti-cheat resides in CGarrysMod::PaintVGUIOverlay(), which calls a function every frame that will calls the main anti-cheat routine under the following conditions:
The time set in LevelInit() has passed.
The user is not in the menu.
The user is not in singleplayer.
The user is not in the Sandbox gamemode.
The main routine hasn’t been executed before.
        The main routine of the anti-cheat assembles a payload and sends it over insecure HTTP as application/x-www-form-urlencoded to https://api.garrysmod.com/stats/001/ (obfuscated using ROT13 in the executable). The payload consists of:
The API version.
A chunk of data consisting of the user’s process list (and their loaded modules) encoded in JSON and the game’s console log, obfuscated using a cipher mostly equivalent to XORing with 0x40.
The user’s 64-bit Steam ID.
A screenshot of the game, compressed with JPEG, encoded in Base64.
Certain processes will be excluded from the process list if their executable names match one of the following:
tsvncache.exe
spotify.exe
tortoiseproc.exe
skype.exe
rundll32.exe
system
mspdbsrv.exe
devenv.exe
googlecrashhandler64.exe
googlecrashhandler.exe
fraps64.dat
presentationfontcache.exe
ccc.exe
wmpnetwk.exe
mom.exe
adobearm.exe
jusched.exe
*******.exe
spotifywebhelper.exe
msseces.exe
puush.exe
fraps.exe
explorer.exe
taskeng.exe
dwm.exe
searchindexer.exe
wlidsvcmM.exe
mdnsresponder.exe
spoolsv.exe
conhost.exe
nvvsvc.exe
nvxdsync.exe
atieclxx.exe
winlogon.exe
atiesrxx.exe
lsm.exe
lsass.exe
services.exe
csrss.exe
wininit.exe
smss.exe
[system process]
svchost.exe
chrome.exe
        From this analysis, we can conclude that this is literally the most retarded shit ever. The fact that it has caught SethHack users is fucking hilarious. Why?
You can block the HTTP request (so easy even Garry could do it, maybe) and absolutely nothing will happen.
You can hide processes from the process list scan by simply renaming them to something from the whitelist (a.k.a. Garry’s process list).
It primarily targets SethHack. It’s just a matter of time before someone less retarded than Seth, Avaster, or Flapadar starts selling a private cheat.
Because of the use of URL and Base64 encoding, the payload ends up being unnecessarily huge. Like, 1.6 times larger than it should be. Garry doesn’t know how to send binary data over HTTP it seems.
The payload is not authenticated, unless it’s done out-of-band from the HTTP request. Massive abuse potential, and no way of validating the data.
BONUS! Garry doesn’t know what the XOR operator is either, so he ends up implementing his cipher using conditionals and arithmetic.

Published by Google Docs–Report Abuse–Updated automatically every 5 minutes