
Originally Posted by
WasserEsser
I use the most obvious variable/funtion names you can ever have, everyone can take my exe and decompile it with ILSpy and almost see the full source code and haven't got VAC banned ever.
Variable names wont matter, strings will tho.
afaik (Haven't actually reversed VAC module myself, its only from experience, which you can choose to trust if you want)
They must have more complex way then simply JUST scaning for signatures, for them to be able to detect PolyCheats they must have either done one of the following:
1. Create patterns and masks for bytes in memory (Like normal pattern scanning that cheats do to get offsets) and just create a big pattern/mask collection and check certain bytes at certain positions to see if it matches anything from the raw source code compilation (Without Poly junk added). Merccy made a post about this a while ago when people supposedly said it was detected, it wasn't tho, at that point it went on to live for 1 or so months longer.
2. Detect by strings, litterally all PolyCheats that were released had the same strings insdie them for each compilation, it should have been 10 tiems easier for VAC to detect it just by checking for strings instead of creating a bunch of complicated Patterns/Mask like the first solution.
3. They could be detecting open handles, I feel like most external hacks using normal TLhelp32 functions would probably get detected then as well, so I doubt this is the method used.
- In conlusion:
Number 2 is the most reliable option for them to choose, and the easiest, but with the time it took to take the hacks down I doubt this was used.
Number 1 has a high chance as well, especially with the time it took.
- Other:
Obviously it could have been detected months ago, but they just decided to gather lots and lots of people to finally strike with a gigantic ban wave.

Originally Posted by
WasserEsser
VAC scans when you are on a VAC Secure Server, so leaving the USB drive in when you are cheating and plugging it out when you dont makes no sense at all and doesn't help.
afaik they load the VAC module as soon as you open CS:GO (If you have internet connection since VAC isn't stored physically on your computer)