[Only registered and activated users can see links. Click Here To Register...]
1. General
Today we want to show you our analysis of [Only registered and activated users can see links. Click Here To Register...].
The provider also offers an [Only registered and activated users can see links. Click Here To Register...] which probably uses the exact same bypass, so this analysis is suitable for both his products.
status0 didn't want to hand out a vouch copy to us, even though we agreed on signing anything that would prevent us from leaking his cheat and said he doesn't trust us.
This was the first sign that the cheat is a scam, as a proper analysis would only benefit him if the product was well made.
Shortly after this discussion, one of his SoundESP customers contacted us, providing us with all the information and files he received.
[Only registered and activated users can see links. Click Here To Register...]
In the next paragraphs we're going to analyze the ESEA Bypass he is offering and point out why his cheat is not worth any money.
2. Protection
The whole thing is barely protected at all.
DreamBoard.exe, which is the cheat loader, is protected with a simple password check which can easily be patched.
[Only registered and activated users can see links. Click Here To Register...]
helper.dll, which is the actual cheat itself, is protected with VMProtect but the coder didn't use the VMProtect SDK, resulting in a generally unprotected dll with only a mutated Entrypoint.
This can be "undone" by simply performing a runtime dump.
[Only registered and activated users can see links. Click Here To Register...]
3. Security
The provider claims to have a lot of security features in his cheat and lists a few examples:
- We can't verify the unique signatures as we only have one build available, but it is highly unlikely that anything in here is unique per customer.
- String encryption is not present in the cheat loader, only in the cheat itself.
[Only registered and activated users can see links. Click Here To Register...]
- Code mutation does not exist.
- The ring0 part is actually performed from ring3 (read 4. Bypass)
- After looking for the many undisclosed ones we were unable able to find anything except VMProtect and the Launcher.exe being removed from the Windows prefetch folders, which should not be counted as proper Security.
[Only registered and activated users can see links. Click Here To Register...]
4. Bypass
4.1. General
This is from Readme-lg.txt:
The first thing that got us suspicious was the fact that a user needs to install and run thirdparty software in order to use the hack. The next thing that we noticed was, Netlimiter is using a driver.
Why this is so suspicious is the fact, that earlier this year an exploit was released on *************, which lets you [Only registered and activated users can see links. Click Here To Register...] in order to inject into processes like csrss.exe.
4.2. Magic (not really)
The creator of the UC post also mentioned the following:
Here's where Netlimiter gets interesting, because their driver could potentially be used for the above.
In the ************* thread, you can find some sample code to get a Handle.
[Only registered and activated users can see links. Click Here To Register...]
and after a quick look we found the exact same code inside DreamBoard.exe.
[Only registered and activated users can see links. Click Here To Register...]
With this information, it was obvious that the hack simply exploits a public vulnerability to hide itself.
The fact that the bypass is public and the cheat got released way after the exploit, clearly shows the sketchy mentality of the provider and makes this product basically worthless.
5. Hack
This will be very short, as the hack itself is very basic and nothing that we found was worth mentioning.
The hack does what it's supposed to do. It uses OpenAL, which is the Audio Library counterpart of OpenGL, to properly position the sounds in 3D space.
6. Conclusion
Even though the cheat itself works and is doing what it's supposed to do, the bypass used is public since early 2018 and the provider is blatantly lying about the security.
The product appears to be written by someone with little to no knowledge about what he/she does while still trying to look somewhat legit to the naked eye.
Due to the fact that all the valuable parts of the cheat are public, this is not worth a single cent in our opinion, but definitely not worth 150€ per month.
greetings,
imi-tat0r, aequabit and the ev0lve.xyz Team
1. General
Today we want to show you our analysis of [Only registered and activated users can see links. Click Here To Register...].
The provider also offers an [Only registered and activated users can see links. Click Here To Register...] which probably uses the exact same bypass, so this analysis is suitable for both his products.
status0 didn't want to hand out a vouch copy to us, even though we agreed on signing anything that would prevent us from leaking his cheat and said he doesn't trust us.
This was the first sign that the cheat is a scam, as a proper analysis would only benefit him if the product was well made.
Shortly after this discussion, one of his SoundESP customers contacted us, providing us with all the information and files he received.
[Only registered and activated users can see links. Click Here To Register...]
In the next paragraphs we're going to analyze the ESEA Bypass he is offering and point out why his cheat is not worth any money.
2. Protection
The whole thing is barely protected at all.
DreamBoard.exe, which is the cheat loader, is protected with a simple password check which can easily be patched.
[Only registered and activated users can see links. Click Here To Register...]
helper.dll, which is the actual cheat itself, is protected with VMProtect but the coder didn't use the VMProtect SDK, resulting in a generally unprotected dll with only a mutated Entrypoint.
This can be "undone" by simply performing a runtime dump.
[Only registered and activated users can see links. Click Here To Register...]
3. Security
The provider claims to have a lot of security features in his cheat and lists a few examples:
Code:
Security Unique signatures String encryption Code mutation ring0 & many undisclosed ones
- String encryption is not present in the cheat loader, only in the cheat itself.
[Only registered and activated users can see links. Click Here To Register...]
- Code mutation does not exist.
- The ring0 part is actually performed from ring3 (read 4. Bypass)
- After looking for the many undisclosed ones we were unable able to find anything except VMProtect and the Launcher.exe being removed from the Windows prefetch folders, which should not be counted as proper Security.
[Only registered and activated users can see links. Click Here To Register...]
4. Bypass
4.1. General
This is from Readme-lg.txt:
Code:
- Start Netlimiter and make sure its minimized into tray - Start Lauchner.exe as ADMIN (important) - Follow the instructions in the command prompt - A Message Box should appear that indicates Success, press ok(else contact the support with provided error code) - Disconnect the usb stick - Start the Anti-Cheat + Game - Enjoy and dont play obvious ;)
Why this is so suspicious is the fact, that earlier this year an exploit was released on *************, which lets you [Only registered and activated users can see links. Click Here To Register...] in order to inject into processes like csrss.exe.
4.2. Magic (not really)
The creator of the UC post also mentioned the following:
Code:
Keep stealth in mind [...] - Rename the genuine driver as *.sys.tmp - Move & rename MalwareFox driver to be at the exact location of the genuine driver that we just moved - Load driver, get your handle, unload driver - Delete MalwareFox driver from where we copied it - Rename the genuine driver back to its original name
In the ************* thread, you can find some sample code to get a Handle.
[Only registered and activated users can see links. Click Here To Register...]
and after a quick look we found the exact same code inside DreamBoard.exe.
[Only registered and activated users can see links. Click Here To Register...]
With this information, it was obvious that the hack simply exploits a public vulnerability to hide itself.
The fact that the bypass is public and the cheat got released way after the exploit, clearly shows the sketchy mentality of the provider and makes this product basically worthless.
5. Hack
This will be very short, as the hack itself is very basic and nothing that we found was worth mentioning.
The hack does what it's supposed to do. It uses OpenAL, which is the Audio Library counterpart of OpenGL, to properly position the sounds in 3D space.
6. Conclusion
Even though the cheat itself works and is doing what it's supposed to do, the bypass used is public since early 2018 and the provider is blatantly lying about the security.
The product appears to be written by someone with little to no knowledge about what he/she does while still trying to look somewhat legit to the naked eye.
Due to the fact that all the valuable parts of the cheat are public, this is not worth a single cent in our opinion, but definitely not worth 150€ per month.
greetings,
imi-tat0r, aequabit and the ev0lve.xyz Team
