Punkbuster Debugger Detection Bypass

On lunes, 27 de diciembre de 2010 0 comentarios

Punkbuster Debugger Detection Bypass

/*
Anti-PB Plugin (Fixes ZwQueryObject Detection)

Credits:
CDetour: Tetsuo/LanceVorgin (also check CDetour.cpp)
Bits & Bats: RunningBon/panzer/Xen/Sparten/Kosire
Volcano Master: h1web
EngRish Lessons: Pansemuckl!


Remember These Simple Rules of Coding to Make the Source Code Work!
1.) Remember to rename any voids, and remove any traces of _asm!
2.) static const char *[1000] Couch = { (Couch = leet) }; YEAH BOI!
3.) No on one's own account releases of hacks released by eliteCoders!
4.) Use lots of 0xglDisable!!

*/


This is something i wrote up a while ago (Detect.zip) it is based from a unseen at the time debugger detection from Punkbuster, a lot of people at netcoders were wondering why their games crashed while debuggin, upon futher investigation by my self, it turned out to be a debugger check.

My friend Peter[Pan] later posted the info at a Reverse Engineering Board (www.exetools.com/forum) and thus we had a technical explination.

Quote Originally Posted by Opc0de
When you create/attach a program inside the debugger, the debug api will call a native function called "NtCreateDebugObject" that will create a DebugObject and set the EPROCESS->DebugPort = DebugObject.
Anyways its found in some games, i saw it in COD 1, ET, AAO and it seems to work best on WinXP Based OS'S, patching it was easy enough but this becomes boring to patch everytime manually, so i wrote a quick plugin to inject, which can easily fix using CDetour by Tetsuo & LanceVorgin.

Attached is Detect.zip (Standalone Detection) & Anti-PB.zip (DLL to be Injected to Fix the Detection)

-PizzaPan
Attached Files

0 comentarios:

Publicar un comentario