Outdated😎 PolyMeme V2 [PolyLoader] [ESP & Radar] [Fully External]

Posts 16–30 of 45 · Page 2 of 3
waiting for approving looks nice i will give it a try
What actually makes this safe?

I've been away for a long while so I'm not going to pretend I know everything about whats going on right now.



Merccy's post states that he assumes it is a string based detection that caused the PolyHack detection, If this is correct then what makes yours any different?

You say that you use "Merccy's PolyLoader's string swapping and encryption" but all you have done is add some swaps. There is no runtime encryption at all.


ps. I'm back bitches.
Quote Originally Posted by Blueblood1 View Post
....
What an entrance
To elaborate on my earlier post, after more research apparently people have being going up to 2 months so far by replacing strings, Only string that remains constant is "csgo.exe", "client.dll" and "engine.dll". Simply because these can't be changed without a lot of effort.

If it is a string based detection it seems strange that these aren't causing VAC Bans unless its just super delayed.

Quote Originally Posted by coconts View Post
What an entrance
I like to enter in style.
Quote Originally Posted by Blueblood1 View Post
To elaborate on my earlier post, after more research apparently people have being going up to 2 months so far by replacing strings, Only string that remains constant is "csgo.exe", "client.dll" and "engine.dll". Simply because these can't be changed without a lot of effort.

If it is a string based detection it seems strange that these aren't causing VAC Bans unless its just super delayed.



I like to enter in style.
So how can we change that?
Quote Originally Posted by l1m3w1r3 View Post
So how can we change that?
When you start a process, it gets its own unique process id (PID), we could potentially use that to remove the need for a string to target the process. Each PID is unique and different on startup, it would only be a matter of Launching Task Manager, getting the ID and updating a variable in the source.

Due to there being a different PID on startup, it wouldn't be possible for VAC to just simply look for a certain number.
Quote Originally Posted by Blueblood1 View Post
When you start a process, it gets its own unique process id (PID), we could potentially use that to remove the need for a string to target the process. Each PID is unique and different on startup, it would only be a matter of Launching Task Manager, getting the ID and updating a variable in the source.

Due to there being a different PID on startup, it wouldn't be possible for VAC to just simply look for a certain number.
what about client and engine ?
.
Quote Originally Posted by Blueblood1 View Post
When you start a process, it gets its own unique process id (PID), we could potentially use that to remove the need for a string to target the process. Each PID is unique and different on startup, it would only be a matter of Launching Task Manager, getting the ID and updating a variable in the source.

Due to there being a different PID on startup, it wouldn't be possible for VAC to just simply look for a certain number.
or just XOR runtime string encryption.. ?
Quote Originally Posted by Radu97 View Post
what about client and engine ?
.
Splitting the name into 3 parts, clientStart, clientContain, clientEnd.

clientStart = "cli";
clientContain = "ent";
clientEnd = ".dll";

All you would need to do is edit your memory class, Search for a module that starts with clientStart, contains clientContain and ends with clientEnd.

So long as you never piece all 3 parts together, The blacklisted word "client.dll" is never found.

This would be a temporary fix but should work.

- - - Updated - - -

Quote Originally Posted by pean153 View Post
or just XOR runtime string encryption.. ?
That works too but I'm faaaaaar to lazy for that shit.

Also passing the XOR encrypted string to a module finder would be a bit of hassle.
Quote Originally Posted by Blueblood1 View Post
Splitting the name into 3 parts, clientStart, clientContain, clientEnd.

clientStart = "cli";
clientContain = "ent";
clientEnd = ".dll";

All you would need to do is edit your memory class, Search for a module that starts with clientStart, contains clientContain and ends with clientEnd.

So long as you never piece all 3 parts together, The blacklisted word "client.dll" is never found.

This would be a temporary fix but should work.

- - - Updated - - -



That works too but I'm faaaaaar to lazy for that shit.

Also passing the XOR encrypted string to a module finder would be a bit of hassle.
thanks for this
p.s welcome back. you have been missed
Quote Originally Posted by Blueblood1 View Post
quote
That was a guess tho, noone really knows what caused the banwave but there are many speculations. Welcome back, times have changed.
Quote Originally Posted by pean153 View Post
That was a guess tho, noone really knows what caused the banwave but there are many speculations. Welcome back, times have changed.
it is the most common
Awesome thanks for the post!
All the sudden stoped working for me??
Posts 16–30 of 45 · Page 2 of 3
This thread is closed for replies.

Similar Threads

Tags for this Thread

Talk with us