The Unerring Punkbuster...

[pengu]

Originally Posted by Pansemuckl

COD4 signatures ... have fun with them
We already kick 10000+ players

Format
# sig_<violation number>_<start offset>_<size>.bin

pwned by netCoders.CC
now who is you daddy?

lets shoot for 6 digits or 100,000


brb spamming IRC/xfire/etc

[greenleaf]

Well when you get some new strings I can add them to my google adwords campaign for a day or two It has 1,700 key words and i am sure it will work i added a jpeg so you can see where i can add the string. Lets rock there ass

[Pansemuckl]

Maximum Damage. BTW I like Crysis

[mystic]

Panse, you should give greenleaf some strings for several games in pm, not public(otherwise they fix it too fast) so he can add i to his googleAds.

That would cause maximum damage, since Crossfire is still using GoogleAds if i am right

[mystic]

I dont doubt it, just said that it would be ownage to see the strings on GoogleAds on like every eSport page(if they are using Ads).

<3

[Foxy]

As for now i guess pb will stop scanning this way, and if they still do, we'll have a lot of strings to paste everywhere.

[greenleaf]

Oh shit, forgot, i can run an yahoo campaign too.

[Snake101]

Can someone please PM me the code to kick people for call of duty 4 please ?


all i have to say is Good Word to NC well done and i am glad someone did something about Punk Buster now we can truly see the BUSED !

Oh my...

Owned... i will get pasting at CoD4 later.

[Invision]

Incredible, can anyone confirm whether or not PB stopped scanning for the signatures? I guess thats the way they detected all the private hacks lately, (and innocent people)
Now one more CoD4 signature to spam everywhere, will posting it ingame in the chat do aswell? that way you can just join alot of servers, clear the memory or something then do it again.

[dudewtfhax]

Originally Posted by Invision

Incredible, can anyone confirm whether or not PB stopped scanning for the signatures? I guess thats the way they detected all the private hacks lately, (and innocent people)
Now one more CoD4 signature to spam everywhere, will posting it ingame in the chat do aswell? that way you can just join alot of servers, clear the memory or something then do it again.

PB was still banning People for Multi-hacks in ET. However, all the master ban lists were frozen pretty much and didn't update with any of those.


It seems that the Pbbans and stuff where ahead of PB on getting this thing fixed. Its a shame..


Edit:

And Do not PM Panse about that. Its a waste of a PM TBH

[x22]

http://www.pbbans.com/forums/index.p...0&#entry125488

[Delikon]

'm sure that these false violations will come in easily removable chunks since it's the same time period and the same violation numbers being used.

It would be much more effective to spread the violation numbers over time and randomly.

It would be most beneficial to not give all the scan strings to the public, but enough to keep the fingers pointing. If this type of detection is not corrected / removed by Even Balance, then there's always the threat of banning an innocent player using this technique.

Yup!

i created now a jpeg with a signature(of course a non public and non ascii one) in it
I use this jpeg as avatar on a few big bf2 forum...

i tested it localy and it work fine

[Bouh]

Paniccccc'

French:

Topic Multihack

First Multihack

Topic GameHack

Topic GameHack #1

I only want friends! Why do you always ruin it for me!! :(

But seriously, I've never seen so many linkbacks to this thread, and considering this thread flooded the server on it's own, absolutely brilliant work

[PhalanX]

After reading all this i lost all my confidence in PB... Now i understand those kick rows... Get a lot of $$$$$ and code a lot of crap, that bans more non cheaters than cheaters!

I was wondering how you find these strings. I tried to get them by opening this file: /pb/htm/wc002059.htm
Then i took a random line nad put it into a Hex editor...
0C46001C9D4767B6AA21CCDB1E7551BA1AB2017F4EA0FE00E6 B0737A0C5073169DD9EAB68FD1FE00 ==> my example line
and the result: .F...Gg¶ª!ÌÛ.uQº.²..N þ.æ°sz.Ps..Ùê¶.Ñþ.
Looks like chineese for me, but not like a string


Phalanx

[Invision]

Are we not risking nC members to be banned when we post it at forums that we do not know about? just saying...

[greenleaf]

The ET string still works. I been kicking people all day on et, have it bind to a key, so far, i counted 40 ppl being kicked for this LOL

[mystic]

yea greeny, its just PBBans who doesnt show the MULTIHACK 70... anymore

but you still can kick many :d

[dudewtfhax]

Originally Posted by greenleaf

The ET string still works. I been kicking people all day on et, have it bind to a key, so far, i counted 40 ppl being kicked for this LOL

Yes its working but ban list is frozen and not adding those multi-hack lines unfortunately.

As per nC customers getting kicked. PB wouldn't know any better anyways and would just remove those bans from list as well.

[greenleaf]

Ok google adwords been changed I added a screen shot. So if anyone sees this ad HAHA Kick! There is over 1,600 keywords from crossfire to punkbuster to pbbans to multihack etc.



*UPDATE*

I added the other two jpegs so you can see.

[Pansemuckl]

Yep... people now realize that it's not a story nC made up, its reality.

Nouvel "Exploit" NC like - EnemyTerritory & Quakewars

[MigrosBudget]

***UPDATE on the CF poll***

I think this really shows what most people think of PB these days

[EHXPhysX]

Hello, I am PhysX the webmaster from EliteHax, I have been browsing over this topic since yesterday and am surprised on your find.

My question is, how do you go about obtaining the signatures? I opened PBA and PBB in OlyDBG but couldn't find any strings such as what you are finding. I did a search for the strings and nothing came up. I have been fooling around for a little and just cannot come across those strings, where are the signatures coming from? It does not matter to me whether it still works or not, I just want to know the thought behind it.

Thanks

[greenleaf]

Read the frist post of this thread

[EHXPhysX]

Originally Posted by greenleaf

Read the frist post of this thread

I read the whole thread before posting, lemee read the first post again in more detail.

Edit: Ok ya, it doesnt really describe it too well.

just everything inside PnkBstrB's process memory. Thanks to helios for pointing me to this.

Which i thought I checked with olydbg.

[immunizer]

is their a string for cod uo? or cod 1?

[Simmy]

Awwww i love punkbusters new motto

Spearheading the Anti Cheat Movement

[Nardi]

External image, IP might be exposed!
http://www.glittermaker.com/temp-images/1/648/glitter-cute-120647933567819.gif

[p4rano]

punkbuster is him died according to you after this attack? still has one you it ounce of credibility after this?

[dudewtfhax]

Punkbuster Says on PunkBuster Online Countermeasures

March 25, 2008

We rarely announce anything regarding commercial cheats and hacks. However, we are aware of the numerous "You Tube" type videos and posts on various sites where hackers who sell cheats make claims that are false but sound believable about PunkBuster and hack detection status. We receive numerous emails daily by concerned honest players regarding advertisements for undetectable hacks, etc. The truth is that via recent enhancements to PunkBuster's detection capabilities, we have cracked down hard on cheaters who pay for hacks in the games we support. Some commercial cheat sites have closed down due to our new methods and others have private forums where punks routinely complain about getting caught with the "undetectable" hacks, demanding refunds, etc. We have always maintained a strict policy of not giving money to punks, but thanks to community volunteer moles who have helped us obtain access to private hacks via donations of their time, etc., PunkBuster has been catching hacks from virtually all commercial cheat sites in recent weeks and months.

One of the recent enhancements involves our memory scanner which aggressively scans for patterns included in known cheats (public and private). A commercial hack site where we have had recent success catching their subscribers has recently staged a few demonstrations of inserting text-based patterns via certain chat-related systems such as IRC, Instant Messaging, etc. directly into the memory of computers. These are specific text patterns that we have deployed in some supported games in the recent past. It is clear that many of the demonstrators are cheat-supporters willingly participating in the demonstration, but there is evidence that some innocent players had PunkBuster violations triggered during the past few days by the hackers who sent specific text patterns into the chat programs that were open during gameplay. We are removing these text based patterns from our system and encourage admins to not ban for PB violations that occurred during the past few days.

Online gamers who play with other programs running should always enable security features in their messaging and chat programs to deny auto-download of files and only accept downloads from people they know and trust. As always, from PunkBuster's standpoint, if a known cheat pattern is in the memory of the computer during gameplay, then a violation will be triggered. We have always suggested closing other programs while you are playing multiplayer games on PunkBuster servers and that remains the safest policy. Leagues that require chat room usage for competitive play should take steps to ensure that only league participants have access and suspicious activity should be reported to us when there are concerns about manipulating the system.

they be owned. Yet i wonder how hard they had to think not to make themselves look stupid

[HyPeR-X]

Thanks for this awesome stuff, I have had some fun with it thanks to HelioS for showing me loads of strings. I think PB has disabled scanning like this for the moment, since I spammed all encrypted strings into one of the largest COD4 channels on quakenet and not many bans turned up. (Even though this is a war channel, so there had to be people playing sooner or later.)