Home › Forum › MultiPlayer Game Hacks & Cheats › Steam Games Hacks & Cheats › Counter-Strike 2 Hacks › Counter-Strike 2 Tutorials › Ultimate guide to help you protect from VAC Ban.
Ultimate guide to help you protect from VAC Ban.
Ultimate guide to help you protect from VAC Ban.
This guide will help you increase your chances of not getting Vac banned. IT INCREASES YOUR CHANCES BUT NOT TO 100% I REPEAT NOT TO 100% OF GETTING AWAY WITH VAC BAN.
So this will make valve job a bit harder, let's get started.
1. MD5 Hash Changer.
To get started you will need a simple MD5 Hash changer, so it kinda of tricks valve.
There are plenty of MD5 Hash changers around the internet, I recommend using Darkwrath's as it have a simple interface and is easy to use.
2. File permissions.
I will quote this from our god hack maker Turb0z
1. Extract the hack, Right-click the hack select 'properties'
2. Under the 'General' tab select 'Advanced' at the bottom
3. Un-check the top 2 boxes, and check the box: 'Encrypt contents to secure data' If its greyed out your Windows does not support this
4. You can also check "Read-only"
This is how your .exe file should look like:
You can also deny the permissions for your system.
3. External Devices.
Valve scans your main HDD not your external devices like USB or external Hard Drivers. So download the .exe to your USB run it and when you are done using it simply disconnect the USB.
4. Encrypt your hack output.
You can use programs to encrypt more the hack you're using security, programs like VeraCrypt (whole hdd) or AxCrypt(file per file) you can also use 7-Zip or Bitlocker, it's your choice, you can read more here.
5. Vac reads every website you visited.
A user on reddit decompiled a module on steam which reads all your cache entries, hash them with MD5 and send it back to valve.
You can read more here.
6. The most obvious one, don't rage hack, as people will get so mad they will directly report you from your steam profile.
7. SMURF SMURF SMURF !
I know there's a lot more to cover but I will add them later, if you have any suggestions msg me.
So this will make valve job a bit harder, let's get started.
1. MD5 Hash Changer.
To get started you will need a simple MD5 Hash changer, so it kinda of tricks valve.
There are plenty of MD5 Hash changers around the internet, I recommend using Darkwrath's as it have a simple interface and is easy to use.
MD5 Explanation
A MD5 hash is nothing but a 32 digit hexadecimal number,this hash is unique for every file irrespective of its size and type. For example, two different executable files (.exe files) with the same size will not have the same MD5 hash even though they are of same type and size. So MD5 hash can be used to uniquely identify a file. The same thing applies even for messages where each message that was sent and received can be verified using the MD5 hash.
2. File permissions.
I will quote this from our god hack maker Turb0z
1. Extract the hack, Right-click the hack select 'properties'
2. Under the 'General' tab select 'Advanced' at the bottom
3. Un-check the top 2 boxes, and check the box: 'Encrypt contents to secure data' If its greyed out your Windows does not support this
4. You can also check "Read-only"
This is how your .exe file should look like:
Image
You can also deny the permissions for your system.
Code:
Open the file properties, go to the tab Security, select system click Edit and then check the first box. This is how it should look like.
Image
3. External Devices.
Valve scans your main HDD not your external devices like USB or external Hard Drivers. So download the .exe to your USB run it and when you are done using it simply disconnect the USB.
4. Encrypt your hack output.
You can use programs to encrypt more the hack you're using security, programs like VeraCrypt (whole hdd) or AxCrypt(file per file) you can also use 7-Zip or Bitlocker, it's your choice, you can read more here.
5. Vac reads every website you visited.
A user on reddit decompiled a module on steam which reads all your cache entries, hash them with MD5 and send it back to valve.
You dont have to visit the site, any query to the site (an image, a redirect link, a file on the server) will be added to the dns cache. And only the domain will be in your cache, no full urls. Entries in the cache remains till they expire or at most 1 day (might not be 100% accurate), but they dont last forever.
6. The most obvious one, don't rage hack, as people will get so mad they will directly report you from your steam profile.
7. SMURF SMURF SMURF !
I know there's a lot more to cover but I will add them later, if you have any suggestions msg me.
Hash Changer does nothing to protect you from getting VAC banned.
Hash Changer is useless against vac
Thank you buddy Simple but good infos all must know them
Originally Posted by McStyles189
Hash Changer is useless against vac
Originally Posted by Block4o
Hash Changer does nothing to protect you from getting VAC banned.
But people always told me they work so I don't know anymore.
Moved to tut section.
3 Is also wrong, VAC scans your RAM, not your HDD.
Originally Posted by Block4o
3 Is also wrong, VAC scans your RAM, not your HDD.
Check the module my man D:
Module
Code:
int __cdecl sub_1000274E(int a1, int a2, int a3)
{
unsigned int v3; // eax@8
int v4; // eax@9
signed __int64 v5; // qax@9
int ntdll; // ecx@27
int v7; // eax@44
char v8; // zf@61
signed int v9; // ecx@61
_UNKNOWN *v10; // edi@61
char *v11; // esi@61
char v12; // zf@67
signed int v13; // ecx@67
_UNKNOWN *v14; // edi@67
char *v15; // esi@67
char v16; // zf@72
signed int v17; // ecx@72
_UNKNOWN *v18; // edi@72
char *v19; // esi@72
int v20; // eax@77
int v21; // ecx@77
int v22; // edx@77
int v23; // eax@77
int v24; // edx@77
int v25; // esi@77
int v26; // edi@77
int v27; // eax@77
int v28; // ecx@77
char v29; // zf@88
signed int v30; // ecx@88
_UNKNOWN *v31; // edi@88
char *v32; // esi@88
char v33; // zf@93
signed int v34; // ecx@93
_UNKNOWN *v35; // edi@93
char *v36; // esi@93
int v37; // eax@98
int v38; // ecx@98
int v39; // edx@98
int v40; // eax@98
int v41; // edx@98
int v42; // esi@98
int v43; // edi@98
int v44; // eax@98
int v45; // ecx@98
char v46; // zf@102
signed int v47; // ecx@102
_UNKNOWN *v48; // edi@102
char *v49; // esi@102
char v50; // zf@110
signed int v51; // ecx@110
_UNKNOWN *v52; // edi@110
char *v53; // esi@110
char *v55; // [sp-10h] [bp-524h]@131
char *v56; // [sp-Ch] [bp-520h]@1
int v57; // [sp-8h] [bp-51Ch]@1
int v58; // [sp-4h] [bp-518h]@1
__int16 v59; // [sp+10h] [bp-504h]@24
__int16 v60; // [sp+14h] [bp-500h]@16
char v61; // [sp+18h] [bp-4FCh]@39
int v62; // [sp+1Ch] [bp-4F8h]@49
int v63; // [sp+20h] [bp-4F4h]@1
__int16 v64; // [sp+24h] [bp-4F0h]@1
__int16 v65; // [sp+26h] [bp-4EEh]@1
int NtFsControlFile; // [sp+28h] [bp-4ECh]@37
__int16 *v67; // [sp+2Ch] [bp-4E8h]@85
char v68; // [sp+30h] [bp-4E4h]@1
char v69; // [sp+31h] [bp-4E3h]@1
char v70; // [sp+32h] [bp-4E2h]@1
char v71; // [sp+33h] [bp-4E1h]@1
char v72; // [sp+34h] [bp-4E0h]@1
char v73; // [sp+35h] [bp-4DFh]@1
char v74; // [sp+36h] [bp-4DEh]@1
char v75; // [sp+37h] [bp-4DDh]@1
char v76; // [sp+38h] [bp-4DCh]@1
char v77; // [sp+39h] [bp-4DBh]@1
char v78; // [sp+3Ah] [bp-4DAh]@1
char v79; // [sp+3Bh] [bp-4D9h]@1
char v80; // [sp+3Ch] [bp-4D8h]@1
char v81; // [sp+3Dh] [bp-4D7h]@1
char v82; // [sp+3Eh] [bp-4D6h]@1
char v83; // [sp+3Fh] [bp-4D5h]@1
int NtFsControlFile_string; // [sp+40h] [bp-4D4h]@1
int v85; // [sp+44h] [bp-4D0h]@2
char v86; // [sp+48h] [bp-4CCh]@1
char v87; // [sp+49h] [bp-4CBh]@1
char v88; // [sp+4Ah] [bp-4CAh]@1
char v89; // [sp+4Bh] [bp-4C9h]@1
char v90; // [sp+4Ch] [bp-4C8h]@1
char v91; // [sp+4Dh] [bp-4C7h]@1
char v92; // [sp+4Eh] [bp-4C6h]@1
char v93; // [sp+4Fh] [bp-4C5h]@1
char v94; // [sp+50h] [bp-4C4h]@1
char v95; // [sp+51h] [bp-4C3h]@1
int v96; // [sp+54h] [bp-4C0h]@39
int v97; // [sp+58h] [bp-4BCh]@1
__int64 v98; // [sp+5Ch] [bp-4B8h]@9
__int16 v99[4]; // [sp+68h] [bp-4ACh]@84
int v100; // [sp+70h] [bp-4A4h]@102
int v101; // [sp+78h] [bp-49Ch]@88
int v102; // [sp+7Ch] [bp-498h]@3
int v103; // [sp+80h] [bp-494h]@3
__int64 v104; // [sp+84h] [bp-490h]@46
int v105[4]; // [sp+90h] [bp-484h]@51
unsigned int v106; // [sp+A0h] [bp-474h]@49
__int64 v107; // [sp+A4h] [bp-470h]@5
int v108; // [sp+B0h] [bp-464h]@1
__int16 v109; // [sp+B4h] [bp-460h]@1
__int16 v110; // [sp+B6h] [bp-45Eh]@1
__int16 v111; // [sp+B8h] [bp-45Ch]@1
__int16 v112; // [sp+BAh] [bp-45Ah]@1
__int16 v113; // [sp+BCh] [bp-458h]@1
int v114; // [sp+C0h] [bp-454h]@1
char v115; // [sp+C4h] [bp-450h]@61
__int16 v116[18]; // [sp+11Ch] [bp-3F8h]@3
int v117; // [sp+140h] [bp-3D4h]@11
int v118; // [sp+144h] [bp-3D0h]@52
int v119; // [sp+148h] [bp-3CCh]@55
char v120; // [sp+14Ch] [bp-3C8h]@61
int v121; // [sp+150h] [bp-3C4h]@77
int v122; // [sp+154h] [bp-3C0h]@77
int v123; // [sp+158h] [bp-3BCh]@77
__int16 v124[262]; // [sp+15Ch] [bp-3B8h]@42
__int16 *v125; // [sp+368h] [bp-1ACh]@85
__int64 v126; // [sp+36Ch] [bp-1A8h]@47
unsigned int v127; // [sp+374h] [bp-1A0h]@47
int v128; // [sp+378h] [bp-19Ch]@47
int v129; // [sp+37Ch] [bp-198h]@47
int v130; // [sp+380h] [bp-194h]@47
int v131; // [sp+384h] [bp-190h]@47
int v132; // [sp+388h] [bp-18Ch]@47
int v133; // [sp+38Ch] [bp-188h]@47
int v134; // [sp+390h] [bp-184h]@47
int v135; // [sp+398h] [bp-17Ch]@1
int v136; // [sp+39Ch] [bp-178h]@39
int v137; // [sp+3A0h] [bp-174h]@44
__int64 v138; // [sp+3ACh] [bp-168h]@122
int v139; // [sp+3D8h] [bp-13Ch]@27
int i; // [sp+3DCh] [bp-138h]@13
int v141; // [sp+3E0h] [bp-134h]@1
char v142[264]; // [sp+3E4h] [bp-130h]@9
int v143; // [sp+4ECh] [bp-28h]@49
__int16 v144[16]; // [sp+4F0h] [bp-24h]@60
int v145; // [sp+510h] [bp-4h]@61
NtFsControlFile_string = 0;
v135 = 0;
v114 = -1;
v108 = 4653127;
v109 = 53;
v110 = 71;
v111 = 120;
v112 = 33;
v113 = 0;
v63 = 2162808;
v64 = 71;
v65 = 0;
v86 = 'U';
v87 = 'o';
v88 = '_';
v89 = 'w';
v90 = 'w';
v91 = '5';
v92 = '[censored]';
v93 = 'w';
v94 = 'w';
v95 = 0;
v68 = 'U';
v69 = 'o';
v70 = ']';
v71 = 'h';
v72 = 'X';
v73 = 't';
v74 = 'u';
v75 = 'o';
v76 = 'i';
v77 = 't';
v78 = 'w';
v79 = ']';
v80 = 'r';
v81 = 'w';
v82 = '~';
v83 = 0;
sub_10001EF0((void *)a2, 0, 0x1000u);
*(_DWORD *)a3 = 4096;
v141 = a2;
*(_DWORD *)(a2 + 32) = 0xEBA903ACu;
v97 = 0;
if ( SetupWinAPI() )
{
memset(v116, 0, sizeof(v116));
v102 = 0;
v103 = 0;
while ( v7ffe0018 != v7ffe001c )
;
v107 = v7ffe0014;
while ( v7ffe0324 != v7ffe0328 )
;
if ( v7ffe0320 | v7ffe0328 )
v3 = v7ffe0004 * (v7ffe0324 << 8) + (v7ffe0320 * (unsigned __int64)v7ffe0004 >> 24);
else
v3 = v7ffe0004 * (unsigned __int64)v7ffe0000 >> 24;
v5 = 10000i64 * v3;
v98 = v5;
v107 -= v5;
LODWORD(v5) = v141;
*(_DWORD *)(v141 + 40) = v107;
*(_DWORD *)(v5 + 44) = HIDWORD(v107);
v4 = import_GetSystemDirectoryA(v142, 260);
v117 = v4;
if ( v4 )
{
for ( i = 0; *((_WORD *)&v108 + i); ++i )
{
if ( i == 4 )
v60 = v142[0];
else
v60 = *((_WORD *)&v108 + i) ^ 0x1B;
*((_WORD *)&v108 + i) = v60;
}
v114 = import_CreateFileW(&v108, 0x80000000u, 3, 0, 3, 0, 0);
if ( v114 == -1 )
{
v85 = import_GetLastError();
}
else
{
for ( i = 0; *((_WORD *)&v63 + i); ++i )
{
if ( i )
v59 = *((_WORD *)&v63 + i) ^ 0x1B;
else
v59 = v142[0];
*((_WORD *)&v63 + i) = v59;
}
v139 = import_GetVolumeInformationW(&v63, 0, 0, v141 + 56, 0, 0, 0, 0);
if ( v139 )
{
for ( i = 0; *(&v86 + i); ++i )
{
ntdll = i;
*(&v86 + i) ^= 0x1Bu;
}
v58 = 0;
v57 = 0;
v56 = &v86;
NtFsControlFile_string = import_LoadLibraryExA(ntdll);
if ( NtFsControlFile_string )
{
for ( i = 0; *(&v68 + i); ++i )
*(&v68 + i) ^= 0x1Bu;
v55 = &v68;
NtFsControlFile = import_GetProcAddress(NtFsControlFile_string);
if ( NtFsControlFile )
{
v96 = ((int (__stdcall *)(int, _DWORD, _DWORD, _DWORD, char *, unsigned int, _DWORD, _DWORD, int *, unsigned int))NtFsControlFile)(
v114,
0,
0,
0,
&v61,
0x900F4u,
0,
0,
&v136,
0x38u);
if ( v96 >= 0 )
{
v7 = v141;
*(_DWORD *)(v141 + 48) = v136;
*(_DWORD *)(v7 + 52) = v137;
v135 = import_VirtualAlloc(0, 0x4000000u, 0x3000u, 4);
if ( v135 )
{
v104 = 0i64;
do
{
v126 = v104;
v127 = 0x80000000u;
v128 = 1;
v129 = 0;
v130 = 0;
v131 = 0;
v132 = 0;
v133 = v136;
v134 = v137;
v96 = ((int (__stdcall *)(int, _DWORD, _DWORD, _DWORD, char *, unsigned int, __int64 *, signed int, int, unsigned int))NtFsControlFile)(
v114,
0,
0,
0,
&v61,
0x900BBu,
&v126,
40,
v135,
0x4000000u);
if ( v96 < 0 )
{
v85 = v96;
goto LABEL_125;
}
v104 = *(_QWORD *)v135;
v143 = v62 - 8;
v106 = 0;
for ( i = 0; (unsigned int)i < 4; ++i )
v105[i] = 0;
v118 = v135 + 8;
while ( v143 )
{
if ( (unsigned int)*(_WORD *)(v118 + 56) > 0x20 )
{
v119 = v118 + *(_WORD *)(v118 + 58) + *(_WORD *)(v118 + 56) - 32;
for ( i = 0; (unsigned int)i < 0x10; ++i )
{
if ( (signed int)*(_WORD *)v119 >= 65 )
{
if ( (signed int)*(_WORD *)v119 <= 90 )
*(_WORD *)v119 += 32;
}
v144[i] = *(_WORD *)v119;
v119 += 2;
}
*(_DWORD *)(v118 + 40) &= 0x80303370u;
v145 = *(_DWORD *)(v118 + 40);
MD5Init(&v115);
MD5Update((int)&v115, v144, 0x24u);
MD5Final(&v120, &v115);
v9 = 4;
v10 = &unk_10009008;
v11 = &v120;
v8 = 1;
do
{
if ( !v9 )
break;
v8 = *(_DWORD *)v11 == *(_DWORD *)v10;
v11 += 4;
v10 = (char *)v10 + 4;
--v9;
}
while ( v8 );
if ( v8 )
memcpy(v116, v144, sizeof(v116));
v13 = 4;
v14 = &unk_10009008;
v15 = &v120;
v12 = 1;
do
{
if ( !v13 )
break;
v12 = *(_DWORD *)v15 == *(_DWORD *)v14;
v15 += 4;
v14 = (char *)v14 + 4;
--v13;
}
while ( v12 );
if ( v12 )
goto LABEL_134;
v17 = 4;
v18 = &unk_10009018;
v19 = &v120;
v16 = 1;
do
{
if ( !v17 )
break;
v16 = *(_DWORD *)v19 == *(_DWORD *)v18;
v19 += 4;
v18 = (char *)v18 + 4;
--v17;
}
while ( v16 );
if ( v16 )
{
LABEL_134:
v20 = 32 * v97;
v21 = v141;
v22 = v118;
*(_DWORD *)(v141 + 32 * v97 + 64) = *(_DWORD *)(v118 + 8);
*(_DWORD *)(v21 + v20 + 68) = *(_DWORD *)(v22 + 12);
v23 = *(_DWORD *)(v118 + 36);
v24 = 32 * v97;
v25 = v141;
*(_DWORD *)(v141 + 32 * v97 + 72) = *(_DWORD *)(v118 + 32);
*(_DWORD *)(v25 + v24 + 76) = v23;
v26 = v141 + 32 * v97 + 80;
*(_DWORD *)v26 = *(_DWORD *)&v120;
v26 += 4;
*(_DWORD *)v26 = v121;
v26 += 4;
*(_DWORD *)v26 = v122;
*(_DWORD *)(v26 + 4) = v123;
v97 = (unsigned int)(v97 + 1) < 0x7E ? v97 + 1 : 0;
v27 = 32 * v97;
v28 = v141;
*(_DWORD *)(v141 + 32 * v97 + 64) = 0;
*(_DWORD *)(v28 + v27 + 68) = 0;
}
}
if ( (unsigned int)*(_WORD *)(v118 + 56) > 8 )
{
v119 = v118 + *(_WORD *)(v118 + 58) + *(_WORD *)(v118 + 56) - 8;
for ( i = 0; (unsigned int)i < 4; ++i )
{
if ( (signed int)*(_WORD *)v119 >= 65 )
{
if ( (signed int)*(_WORD *)v119 <= 90 )
*(_WORD *)v119 += 32;
}
v99[i] = *(_WORD *)v119;
v99[i] ^= v116[i] << 8;
v119 += 2;
}
v67 = &v116[i];
v125 = &v99[i];
for ( i = 0; (unsigned int)i < 8; ++i )
*((_BYTE *)v125 + i) = ((unsigned __int16)v67[i] >> 8) ^ v67[i];
*(_DWORD *)(v118 + 40) &= 0x80303372u;
v101 = *(_DWORD *)(v118 + 40);
MD5Init(&v115);
MD5Update((int)&v115, v99, 0x14u);
MD5Final(&v120, &v115);
v30 = 4;
v31 = &unk_10009028;
v32 = &v120;
v29 = 1;
do
{
if ( !v30 )
break;
v29 = *(_DWORD *)v32 == *(_DWORD *)v31;
v32 += 4;
v31 = (char *)v31 + 4;
--v30;
}
while ( v29 );
if ( v29 )
goto LABEL_135;
v34 = 4;
v35 = &unk_10009038;
v36 = &v120;
v33 = 1;
do
{
if ( !v34 )
break;
v33 = *(_DWORD *)v36 == *(_DWORD *)v35;
v36 += 4;
v35 = (char *)v35 + 4;
--v34;
}
while ( v33 );
if ( v33 )
{
LABEL_135:
v37 = 32 * v97;
v38 = v141;
v39 = v118;
*(_DWORD *)(v141 + 32 * v97 + 64) = *(_DWORD *)(v118 + 8);
*(_DWORD *)(v38 + v37 + 68) = *(_DWORD *)(v39 + 12);
v40 = *(_DWORD *)(v118 + 36);
v41 = 32 * v97;
v42 = v141;
*(_DWORD *)(v141 + 32 * v97 + 72) = *(_DWORD *)(v118 + 32);
*(_DWORD *)(v42 + v41 + 76) = v40;
v43 = v141 + 32 * v97 + 80;
*(_DWORD *)v43 = *(_DWORD *)&v120;
v43 += 4;
*(_DWORD *)v43 = v121;
v43 += 4;
*(_DWORD *)v43 = v122;
*(_DWORD *)(v43 + 4) = v123;
v97 = (unsigned int)(v97 + 1) < 0x7E ? v97 + 1 : 0;
v44 = 32 * v97;
v45 = v141;
*(_DWORD *)(v141 + 32 * v97 + 64) = 0;
*(_DWORD *)(v45 + v44 + 68) = 0;
}
v119 = v118 + *(_WORD *)(v118 + 58) + *(_WORD *)(v118 + 56) - 8;
for ( i = 0; (unsigned int)i < 4; ++i )
{
v99[i] = *(_WORD *)v119;
v119 += 2;
}
v100 = *(_DWORD *)(v118 + 40);
MD5Init(&v115);
MD5Update((int)&v115, v99, 0xCu);
MD5Final(&v120, &v115);
v47 = 4;
v48 = &unk_10009048;
v49 = &v120;
v46 = 1;
do
{
if ( !v47 )
break;
v46 = *(_DWORD *)v49 == *(_DWORD *)v48;
v49 += 4;
v48 = (char *)v48 + 4;
--v47;
}
while ( v46 );
if ( v46 )
{
v102 = *(_DWORD *)(v118 + 8);
v103 = *(_DWORD *)(v118 + 12);
}
if ( *(_DWORD *)(v118 + 8) == v102 )
{
if ( *(_DWORD *)(v118 + 12) == v103 )
{
v51 = 4;
v52 = &unk_10009058;
v53 = &v120;
v50 = 1;
do
{
if ( !v51 )
break;
v50 = *(_DWORD *)v53 == *(_DWORD *)v52;
v53 += 4;
v52 = (char *)v52 + 4;
--v51;
}
while ( v50 );
if ( v50 )
{
v105[v106] = v118;
v106 = (v106 + 1) % 4;
v102 = 0;
v103 = 0;
}
}
}
}
v143 -= *(_DWORD *)v118;
v118 += *(_DWORD *)v118;
}
if ( v105[0] )
{
for ( i = 0; (unsigned int)i < 3; ++i )
v124[i] = v142[i];
v124[i] = 0;
sub_10002047(v141, (int)&v97, (int)v105, (int)v124, 0);
}
}
while ( v104 < v138 );
v85 = 0;
}
else
{
v85 = ((int (__cdecl *)(char *, char *, _DWORD, _DWORD))import_GetLastError)(
&v68,
&v86,
0,
0);
}
}
else
{
v85 = v96;
for ( i = 0; (unsigned int)i < 3; ++i )
v124[i] = v142[i];
v124[i] = 0;
sub_10002047(v141, (int)&v97, 0, (int)v124, 0);
}
}
else
{
v85 = ((int (__cdecl *)(char *, char *, _DWORD, _DWORD))import_GetLastError)(&v68, &v86, 0, 0);
}
}
else
{
v85 = ((int (__cdecl *)(char *, _DWORD, _DWORD))import_GetLastError)(&v86, 0, 0);
}
}
else
{
v85 = import_GetLastError();
}
}
}
else
{
v85 = import_GetLastError();
}
}
else
{
v85 = 78;
}
LABEL_125:
if ( v114 != -1 )
import_CloseHandle(v114);
if ( v135 )
import_VirtualFree(v135, 0, 0x8000u);
if ( NtFsControlFile_string )
import_FreeLibrary(NtFsControlFile_string);
sub_10001CB9(v55, v56, v57, v58);
*(_DWORD *)(v141 + 36) = v85;
return 0;
}
Code:
int __cdecl sub_10002047(int a1, int a2, int a3, int a4, __int16 *a5)
{
int v5; // eax@1
int v6; // ecx@1
__int16 v7; // dx@2
int v8; // edi@3
int v9; // eax@3
int *v10; // eax@4
int result; // eax@6
int *v12; // eax@8
int *v13; // eax@11
int *v14; // eax@14
__int16 *v15; // esi@20
__int16 *v16; // eax@21
int v17; // ecx@21
int v18; // ecx@24
__int16 *v19; // eax@25
__int16 *v20; // eax@28
__int16 v21; // cx@29
__int16 *v22; // eax@31
int v23; // edx@31
__int16 v24; // cx@32
int v25; // edx@35
__int16 *v26; // eax@36
unsigned int v27; // ecx@37
int v28; // eax@41
__int16 v29; // cx@42
char v30; // zf@45
signed int v31; // ecx@45
_UNKNOWN *v32; // edi@45
char *v33; // esi@45
char v34; // zf@50
signed int v35; // ecx@50
_UNKNOWN *v36; // edi@50
char *v37; // esi@50
char v38; // zf@55
signed int v39; // ecx@55
_UNKNOWN *v40; // edi@55
char *v41; // esi@55
unsigned int v42; // edi@65
int v43; // eax@66
int v44; // edx@66
__int16 v45; // cx@67
int v46; // eax@69
int v47; // eax@72
int v48; // eax@72
char v49; // zf@74
int v50; // ecx@74
int v51; // edi@74
int v52; // esi@74
int v53; // eax@81
char v54; // zf@83
signed int v55; // ecx@83
_UNKNOWN *v56; // edi@83
char *v57; // esi@83
int v58; // edx@91
int v59; // eax@91
int v60; // edi@91
int v61; // eax@91
int v62; // eax@91
int v63; // eax@96
__int16 v64; // cx@97
char v65; // zf@98
signed int v66; // ecx@98
_UNKNOWN *v67; // edi@98
char *v68; // esi@98
char v69; // zf@106
signed int v70; // ecx@106
_UNKNOWN *v71; // edi@106
char *v72; // esi@106
int v73; // eax@111
int v74; // edi@113
int v75; // ecx@113
int v76; // eax@113
int v77; // [sp-Ch] [bp-90h]@69
int v78; // [sp-8h] [bp-8Ch]@69
__int16 *v79; // [sp-4h] [bp-88h]@69
char ctx; // [sp+Ch] [bp-78h]@45
int v81; // [sp+64h] [bp-20h]@89
int v82; // [sp+68h] [bp-1Ch]@3
int v83; // [sp+6Ch] [bp-18h]@31
__int16 v84; // [sp+70h] [bp-14h]@1
__int16 v85; // [sp+72h] [bp-12h]@1
__int16 v86; // [sp+74h] [bp-10h]@1
__int16 v87; // [sp+76h] [bp-Eh]@1
__int16 v88; // [sp+78h] [bp-Ch]@1
__int16 v89; // [sp+7Ah] [bp-Ah]@1
char digest; // [sp+7Ch] [bp-8h]@45
int v91; // [sp+80h] [bp-4h]@91
int v92; // [sp+84h] [bp+0h]@91
int v93; // [sp+88h] [bp+4h]@91
int v94; // [sp+8Ch] [bp+8h]@3
int v95; // [sp+90h] [bp+Ch]@1
int v96; // [sp+94h] [bp+10h]@1
int v97; // [sp+98h] [bp+14h]@1
char v98; // [sp+9Ch] [bp+18h]@1
int v99; // [sp+A0h] [bp+1Ch]@1
int v100; // [sp+A4h] [bp+20h]@1
int v101; // [sp+A8h] [bp+24h]@1
__int16 v102; // [sp+ACh] [bp+28h]@1
char v103; // [sp+AEh] [bp+2Ah]@1
int v104; // [sp+B0h] [bp+2Ch]@1
int v105; // [sp+B4h] [bp+30h]@1
int v106; // [sp+B8h] [bp+34h]@1
__int16 v107; // [sp+BCh] [bp+38h]@1
unsigned int v108; // [sp+C0h] [bp+3Ch]@71
int v109; // [sp+C4h] [bp+40h]@81
__int16 v110; // [sp+C8h] [bp+44h]@1
__int16 v111; // [sp+CAh] [bp+46h]@1
int v112; // [sp+CCh] [bp+48h]@1
int v113; // [sp+D0h] [bp+4Ch]@1
int v114; // [sp+D4h] [bp+50h]@1
__int16 v115; // [sp+D8h] [bp+54h]@1
int v116; // [sp+DCh] [bp+58h]@1
int v117; // [sp+E0h] [bp+5Ch]@43
int v118; // [sp+E4h] [bp+60h]@33
v110 = '1';
v111 = '5';
v112 = '1';
v84 = '1';
v85 = '5';
v86 = '~';
v87 = 'c';
v88 = '~';
v89 = '\0';
v98 = '\0';
v103 = '\0';
v5 = a4;
v116 = 0;
v95 = 'ui~P';
v96 = ')(w~';
v97 = 'ww[censored]5';
v99 = '[censored]ur]';
v100 = 'hir]';
v101 = 'wr]o';
v102 = 'L~';
v104 = '[censored]ur]';
v105 = 'oc~U';
v106 = '~wr]';
v107 = 'L';
v113 = '[censored]ur]';
v114 = 'htwX';
v115 = '~';
v6 = a4 + 2;
do
{
v7 = *(_WORD *)v5;
v5 += 2;
}
while ( v7 );
v9 = (v5 - v6) >> 1;
v8 = 258 - v9;
v94 = v9;
v82 = 258 - v9;
if ( FindFirstFileW )
{
LABEL_20:
v15 = a5;
if ( !a5 )
{
v17 = 0;
v16 = &v110;
do
{
*v16 ^= 0x1Bu;
++v17;
v16 = &v110 + v17;
}
while ( *v16 );
if ( !a3 )
{
v18 = 0;
if ( v84 )
{
v19 = &v84;
do
{
*v19 ^= 0x1Bu;
++v18;
v19 = &v84 + v18;
}
while ( *v19 );
}
}
v15 = &v110;
}
v20 = v15;
do
{
v21 = *v20;
++v20;
}
while ( v21 );
result = (signed int)((char *)v20 - (char *)(v15 + 1)) >> 1;
if ( v8 < (unsigned int)result )
goto LABEL_117;
v83 = a4 + 2 * v94;
v22 = v15;
v23 = v83 - (_DWORD)v15;
do
{
v24 = *v22;
*(__int16 *)((char *)v22 + v23) = *v22;
++v22;
}
while ( v24 );
result = FindFirstFileW(a4, &dword_10009E08);
v118 = result;
if ( result == -1 )
goto LABEL_117;
while ( 1 )
{
if ( dword_10009E08 & 0x400 )
goto LABEL_115;
v25 = 0;
if ( word_10009E34[0] )
{
v26 = word_10009E34;
do
{
v27 = (unsigned __int16)*v26;
if ( v27 >= 0x41 )
{
if ( v27 <= 0x5A )
*v26 = v27 + 32;
}
++v25;
v26 = &word_10009E34[v25];
}
while ( *v26 );
}
v28 = (int)word_10009E34;
do
{
v29 = *(_WORD *)v28;
v28 += 2;
}
while ( v29 );
v117 = (v28 - (_DWORD)&word_10009E34[1]) >> 1;
if ( dword_10009E08 & 0x10 )
{
if ( v94 == 3 )
{
MD5Init(&ctx);
MD5Update((int)&ctx, word_10009E34, 2 * v117);
MD5Final(&digest, &ctx);
v31 = 4;
v32 = &unk_10009088;
v33 = &digest;
v30 = 1;
do
{
if ( !v31 )
break;
v30 = *(_DWORD *)v33 == *(_DWORD *)v32;
v33 += 4;
v32 = (char *)v32 + 4;
--v31;
}
while ( v30 );
if ( v30 )
goto LABEL_115;
v35 = 4;
v36 = &unk_10009098;
v37 = &digest;
v34 = 1;
do
{
if ( !v35 )
break;
v34 = *(_DWORD *)v37 == *(_DWORD *)v36;
v37 += 4;
v36 = (char *)v36 + 4;
--v35;
}
while ( v34 );
if ( v34 )
goto LABEL_115;
v39 = 4;
v40 = &unk_100090A8;
v41 = &digest;
v38 = 1;
do
{
if ( !v39 )
break;
v38 = *(_DWORD *)v41 == *(_DWORD *)v40;
v41 += 4;
v40 = (char *)v40 + 4;
--v39;
}
while ( v38 );
if ( v38 )
goto LABEL_115;
}
if ( word_10009E34[0] == 46 && (!word_10009E36 || word_10009E36 == 46 && !word_10009E38) || a5 )
goto LABEL_115;
}
v42 = v117;
if ( v117 > (unsigned int)v82 )
goto LABEL_115;
v43 = (int)word_10009E34;
v44 = v83 - (_DWORD)word_10009E34;
do
{
v45 = *(_WORD *)v43;
*(_WORD *)(v43 + v44) = *(_WORD *)v43;
v43 += 2;
}
while ( v45 );
if ( dword_10009E08 & 0x10 )
break;
if ( a3 )
{
v108 = 0;
do
{
v48 = a3 + 4 * v108;
v112 = v48;
v47 = *(_DWORD *)v48;
if ( v47 )
{
if ( 2 * v117 == *(_WORD *)(v47 + 0x38) )
{
v50 = *(_WORD *)(*(_DWORD *)v112 + 56) - 8;
v51 = *(_DWORD *)v112 + 60;
v52 = (int)word_10009E34;
v49 = 1;
do
{
if ( !v50 )
break;
v49 = *(_BYTE *)v52++ == *(_BYTE *)v51++;
--v50;
}
while ( v49 );
if ( v49 )
{
MD5Init(&ctx);
MD5Update((int)&ctx, (char *)&unk_10009E2C + 2 * v117, 8u);
MD5Final(&digest, &ctx);
if ( !strncmp(&digest, (const char *)&unk_10009068, 16)
|| !strncmp(&digest, (const char *)&unk_10009078, 16) )
{
v53 = import_CreateFileW(a4, 0x80000000u, 7, 0, 3, 128, 0);
v109 = v53;
if ( v53 != -1 )
{
if ( import_GetFileInformationByHandle(v53, &unk_10009DD0) )
{
v55 = 4;
v56 = &unk_10009068;
v57 = &digest;
v54 = 1;
do
{
if ( !v55 )
break;
v54 = *(_DWORD *)v57 == *(_DWORD *)v56;
v57 += 4;
v56 = (char *)v56 + 4;
--v55;
}
while ( v54 );
if ( v54 )
{
if ( (unsigned int)dword_10009E28 >= 0x50 )
{
if ( import_ReadFile(v109, &unk_1000A058, 80, &v81, 0) )
{
MD5Init(&ctx);
MD5Update((int)&ctx, &unk_1000A058, 0x50u);
MD5Final(&digest, &ctx);
}
}
}
*(_DWORD *)(32 * (*(_DWORD *)a2 + 2) + a1) = dword_10009E00;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 68) = dword_10009DFC;
v58 = *(_DWORD *)v112;
v59 = 32 * *(_DWORD *)a2;
*(_DWORD *)(v59 + a1 + 72) = *(_DWORD *)(*(_DWORD *)v112 + 32);
*(_DWORD *)(v59 + a1 + 76) = *(_DWORD *)(v58 + 36);
v60 = 32 * *(_DWORD *)a2 + a1 + 80;
*(_DWORD *)v60 = *(_DWORD *)&digest;
v60 += 4;
*(_DWORD *)v60 = v91;
v60 += 4;
*(_DWORD *)v60 = v92;
*(_DWORD *)(v60 + 4) = v93;
v61 = (unsigned int)(*(_DWORD *)a2 + 1) < 0x7E ? *(_DWORD *)a2 + 1 : 0;
*(_DWORD *)a2 = v61;
v62 = 32 * (v61 + 2);
*(_DWORD *)(v62 + a1) = 0;
*(_DWORD *)(v62 + a1 + 4) = 0;
}
import_CloseHandle(v109);
}
}
}
}
}
++v108;
}
while ( v108 < 4 );
goto LABEL_115;
}
if ( a5 )
{
if ( v42 > 8 )
{
MD5Init(&ctx);
MD5Update((int)&ctx, (char *)&unk_10009E2C + 2 * v117, 8u);
MD5Final(&digest, &ctx);
v70 = 4;
v71 = &unk_10009078;
v72 = &digest;
v69 = 1;
do
{
if ( !v70 )
break;
v69 = *(_DWORD *)v72 == *(_DWORD *)v71;
v72 += 4;
v71 = (char *)v71 + 4;
--v70;
}
while ( v69 );
if ( v69 )
{
v73 = import_CreateFileW(a4, 0x80000000u, 7, 0, 3, 128, 0);
v109 = v73;
if ( v73 != -1 )
{
if ( import_GetFileInformationByHandle(v73, &unk_10009DD0) )
{
*(_DWORD *)(32 * (*(_DWORD *)a2 + 2) + a1) = dword_10009E00;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 68) = dword_10009DFC;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 72) = dword_10009DDC;
*(_DWORD *)(32 * *(_DWORD *)a2 + a1 + 76) = dword_10009DE0;
v74 = 32 * *(_DWORD *)a2 + a1 + 80;
*(_DWORD *)v74 = *(_DWORD *)&digest;
v74 += 4;
*(_DWORD *)v74 = v91;
v74 += 4;
*(_DWORD *)v74 = v92;
*(_DWORD *)(v74 + 4) = v93;
v75 = (unsigned int)(*(_DWORD *)a2 + 1) < 0x7E ? *(_DWORD *)a2 + 1 : 0;
*(_DWORD *)a2 = v75;
v76 = 32 * (v75 + 2);
*(_DWORD *)(v76 + a1) = 0;
*(_DWORD *)(v76 + a1 + 4) = 0;
}
import_CloseHandle(v109);
}
}
}
goto LABEL_115;
}
MD5Init(&ctx);
v63 = (int)word_10009E34;
do
{
v64 = *(_WORD *)v63;
v63 += 2;
}
while ( v64 );
MD5Update((int)&ctx, word_10009E34, 2 * ((v63 - (_DWORD)&word_10009E34[1]) >> 1));
MD5Final(&digest, &ctx);
v66 = 4;
v67 = &unk_100090B8;
v68 = &digest;
v65 = 1;
do
{
if ( !v66 )
break;
v65 = *(_DWORD *)v68 == *(_DWORD *)v67;
v68 += 4;
v67 = (char *)v67 + 4;
--v66;
}
while ( v65 );
if ( v65 )
{
*(_WORD *)v83 = 0;
v79 = &v84;
v78 = a4;
v77 = 0;
goto LABEL_104;
}
LABEL_115:
if ( !FindNextFileW(v118, &dword_10009E08) )
{
result = FindClose(v118);
goto LABEL_117;
}
}
v79 = a5;
v46 = a4 + 2 * (v94 + v117);
*(_WORD *)v46 = 92;
v78 = a4;
v77 = a3;
*(_WORD *)(v46 + 2) = 0;
LABEL_104:
sub_10002047(a1, a2, v77, v78, v79);
goto LABEL_115;
}
v10 = &v95;
do
{
*(_BYTE *)v10 ^= 0x1Bu;
v10 = (int *)((char *)v10 + 1);
}
while ( *(_BYTE *)v10 );
result = import_LoadLibraryExA(v6);
v116 = result;
if ( result )
{
if ( (_BYTE)v99 )
{
v12 = &v99;
do
{
*(_BYTE *)v12 ^= 0x1Bu;
v12 = (int *)((char *)v12 + 1);
}
while ( *(_BYTE *)v12 );
}
FindFirstFileW = (int (__stdcall *)(_DWORD, _DWORD))import_GetProcAddress(v116);
if ( (_BYTE)v104 )
{
v13 = &v104;
do
{
*(_BYTE *)v13 ^= 0x1Bu;
v13 = (int *)((char *)v13 + 1);
}
while ( *(_BYTE *)v13 );
}
FindNextFileW = (int (__stdcall *)(_DWORD, _DWORD))import_GetProcAddress(v116);
if ( (_BYTE)v113 )
{
v14 = &v113;
do
{
*(_BYTE *)v14 ^= 0x1Bu;
v14 = (int *)((char *)v14 + 1);
}
while ( *(_BYTE *)v14 );
}
result = import_GetProcAddress(v116);
FindClose = (int (__stdcall *)(_DWORD))result;
if ( !FindFirstFileW || !FindNextFileW || !result )
{
FindFirstFileW = 0;
LABEL_117:
if ( v116 )
result = import_FreeLibrary(v116);
return result;
}
goto LABEL_20;
}
return result;
}
The truth about VAC detection This is Mercy's thread about VAC detection, it says it all 
Originally Posted by Block4o
The truth about VAC detection This is Mercy's thread about VAC detection, it says it all
Oh wait I bet you couldn't read the module my bad, stop hating the topic.
So many posts of these.
Originally Posted by Teuvin
Get out of here cubeworld guy go back to your forum.
Oh wait I bet you couldn't read the module my bad, stop hating the topic.
Oh wait I bet you couldn't read the module my bad, stop hating the topic.
Very useful thanks!
Did they scan AHK like ESEA did ?
Similar Threads
- 3Last post
- 3Last post
- 9Last post
- 2Last post
- 8Last post