Testing Dectection Using Sandboxie

I'm going to be testing a few EXTERNAL hacking programs while running DayZ commander in Sandboxie and setting the sandboxie settings not to detect them, I know these programs will get me banned in under 24 hours if this does not work. So expect results soon.

Programs I will be testing;

Snow Nav: map and item spawner (avaiable on MPGH fourms) and Older Versions of Survival hack/Newer versions of YoloHack. This will be a test to see whether or not Sandboxie does completely mask external programs from being spotted by battleye. Wish me luck, and GF to my CD key!

I will be posting results on this forum before Monday. I KNOW these hacks are detected, so if I'm not banned by then, I'm going to consider them undected while using sandboxie. (or they will at least get you a delayed ban.)

I hope this will be valuable information for you coders out there, keep it up with the awesome hacks!

Results:

YoloHack: crashes arma (detected?)
Snow Nav / Item Spawner; Both are UNDECTED but are unable to function. (im guessing this is because I restricted access to them within the sandboxie settings to prevent detection) SO IT HALF WORKS ;P
Survival hack: crashes arma (detected?)

Conclusion:
What I think I've learned from this is that if you used a up to date program, that injects scripts into Arma2OA without using the old CTR+P method, then Sandboxie will be able to make it COMPLETELY undetected by BattleEye (although not from server admins checking logs) This is because Sandboxie will restrict access to the injector, but not the Dll or sqf. then again I'm not a coder, so let me know what you guys think of this, and if you want me to test anything else, let me know and send the forum link for the download.

Hope it works for you buddie

All of this will become unnecessary if I find that my theory of writing metamorphic code to prevent BE detections is correct. It's not a revolutionary idea considering viruses already have this capability against AV sig detections. It's the same concept, but I've just never heard about it when it comes to game hacking. Seemingly impossible for you to get banned since the executable will be completely different every time it is ran. College applications are done so I have more time on my hands. Unfortunately, the Standalone release is approaching, and a lot of what is possible now won't be because everything is going to be server sided. They're moving to VAC protection which may or may not change things as far as my concept goes.

EDIT: I saw someone who is familiar with VAC protocol post this:

1) Your hack does something suspicious (opening a handle to the process via ReadProcessMemory, hooking Source functions, etc.). VAC detects this and flags you. It uploads all the information on you to the servers -- running processes, actual running code, etc.

2) A VAC engineer reviews all the information. If they determine they've discovered a new hack, various information about it is added to a database (md5s, etc.)

3) You get banned.

4) If anyone else is found to be running code that matches the signatures they also get banned.

Side note: A lot of the older hacks won't work regardless of what you considering they were made for different versions and rely on updated offsets which is probably why they are crashing. Also, Sandboxie is a virtual machine enviroment and was made to protect users from potentially malicious software. So of course it's going to restrict access of certain programs and cause problems/leave things not working. Way too much work to nuke a few servers if you ask me.

Originally Posted by Woodhouse

Another thing, they're moving to VAC protection which may or may not change things as far as my concept goes.

Definitely:

VAC is loaded by SteamService.exe before the game is even started.
VAC can and will detect stuff like: RPM, WPM, ZwReadVirtualMemory, __asm Keyword in C/C++.

Also:

If your hack does something suspicious (like opening a handle to the process via ReadProcessMemory, hooking functions, etc.). VAC detects this and flags you. It uploads all the information on you to the VAC servers -- running processes, actual running code, etc.
After that, a VAC engineer reviews all the information. If they determine they've discovered a new hack, various information about it is added to a database (md5s, etc.)

You can't compare BattlEye with VAC. Absolutely not.

Greets

Originally Posted by eth0

You can't compare BattlEye with VAC. Absolutely not.

I never did. Or else I wouldn't have brought it up. Anyway, none of that changes what I am thinking of doing. And I'm sure there are ways of getting around all of this.

EDIT: The more and more I'm reading, it sounds like this stuff is give VAC more credit than it deserves. Definitely a step up from Battleye though.

This is all you need to test for detections:

Code:

  d1 = ((unsigned __int8)Random & (BYTE3(Random) | ~BYTE1(Random))) << 8;
  k = Detected ^ d1 ^ (41616 * Random + *((_BYTE *)&Random + 204 * Random % 3u));
  detected = (unsigned __int16)(Detected ^ d1 ^ (unsigned __int16)(-23920 * Random
                                                                 + *((_BYTE *)&Random + 204 * Random % 3u)));

Originally Posted by Douggem

This is all you need to test for detections:

Code:

  d1 = ((unsigned __int8)Random & (BYTE3(Random) | ~BYTE1(Random))) << 8;
  k = Detected ^ d1 ^ (41616 * Random + *((_BYTE *)&Random + 204 * Random % 3u));
  detected = (unsigned __int16)(Detected ^ d1 ^ (unsigned __int16)(-23920 * Random
                                                                 + *((_BYTE *)&Random + 204 * Random % 3u)));

Thanks. No one who is active in this section codes, btw. Also, if you want to post images, use something like Imgur. If you upload a picture, you have to wait for it to be approved.

Originally Posted by Woodhouse

Thanks. No one who is active in this section codes, btw. Also, if you want to post images, use something like Imgur. If you upload a picture, you have to wait for it to be approved.

Hey... not all of us are script kiddies. I may be slower than others from another website but still have written my own.

I can't post links.

Originally Posted by Douggem

I can't post links.

You can. Depends on the site. Obvious advertising is filtered. But no, use the image code/tags they give you so it's embedded.

e.g.

Code:

[IMG][/IMG]

I do use those, says I can't post links. I use Gyazo.

Originally Posted by Douggem

I do use those, says I can't post links. I use Gyazo.

Weird. Maybe it's your low post count. I dunno. Oh well.

What about about running the loader of a certain sold bypass that uses an engine hack in sandboxie, since that seems to be the only way battleye detects it is if it's open, and you have to inject on the main menu, and be sure to close it before entering a server. It gets kinda of tedious though and have accidentally left it open once. Anybody know if this would work?

Originally Posted by UltraJosue

What about about running the loader of a certain sold bypass that uses an engine hack in sandboxie, since that seems to be the only way battleye detects it is if it's open, and you have to inject on the main menu, and be sure to close it before entering a server. It gets kinda of tedious though and have accidentally left it open once. Anybody know if this would work?

Ooh. Smart idea. if i had a key and private bypass I would try this.

All of SD's hacks will auto close anyway because they have a feature built in that self closes itself down if it detects a different battleye version than the one specified which will be the one at the time of release like months ago.

Testing Dectection Using Sandboxie

Similar Threads

Tags for this Thread