I saw the "Experienced Developer" role, but I've also heard that he's reselling the product, so I'm a bit confused, is he actually the developer of the product he sells, or is he a reseller?
@[Only registered and activated users can see links. Click Here To Register...]
edit:
I also left out many of the things I found to avoid exposing sensitive information and to stay within the forum rules, I will not release the broken auth version, so don't DM me asking for it.
After getting no answer from him directly, while seeing him tell other people that he's the developer, I decided to do my own research, and these are the results.
TL;DR
There's really not much to prove here. Sheintan / MaxiCheats is literally reselling ez-val.com, a known product provider for resellers. He did try to hide it by registering a second domain, 666auth.pro, but it's 1:1 with ez-val.com. The loader he ships with both his public and private versions points at ez-val.com. A key sold by MaxiCheats works on both 666auth.pro and ez-val.com, They are also using a publicly available vulnerable driver and Discord overlay, which makes them risky rather than "UD" as they claim.
same backend as 666auth.pro 1:1 loader, 1:1 protocol, 1:1 keys
Public & Private Are the Same Product
Both the Public and Private versions are the same product
It's not only the core and features that are the same, as he previously said, both versions also appear to use the same vulnerable driver and even have a traceable loader signature.
Considering I was able to find this amount of information, potential detection vectors, and things that I know are detected in around an hour and a half, I personally wouldn't consider either version safe
If I could identify this much in such a short period of time, imagine what Vanguard's own security team could find with considerably more time and resources
The CSP giveaway
Weirdly enough, 666auth.pro's Content-Security-Policy response header includes a reference to keyauth.win:
[Only registered and activated users can see links. Click Here To Register...]
Anyone can verify this in their own browser:
Error mapping 1:1 with ez-val's loader
The MaxiCheats loader recognises exactly the same JSON error fragments and maps them to exactly the same E-3xxx codes and user strings as ez-val:
Loader pipeline (any MaxiCheats user can confirm)
Even though a few modules are named "public", these are the exact same modules as the private version. Both operate using the same vulnerable driver and the same public Discord overlay method.
The vulnerable driver
The vulnerable driver is P*********.sys, from P** **** *****. It's literally known/public and I'm surprised it's not blacklisted yet by Vanguard.
[Only registered and activated users can see links. Click Here To Register...]
The loader first checks if \\.\P******** exists, if the handle opens, the device is already loaded and the download request to the server is skipped.
Otherwise, the loader proceeds to load it in this sequence:
Disclosure boundary
I'm not going to disclose how to bypass any of the security checks of ez-val's loaders. I was able to successfully remove every single one of them, including the VM checks. Most of the important routines were virtualized; after lifting and cleaning them up I was able to recover most of the protected strings as well.
@[Only registered and activated users can see links. Click Here To Register...]
edit:
MaxiCheats / Sheintan is realiable ?
First of all, this post was made for members who don't know much about coding or reversing, so I tried to use common language that normal users can understandI also left out many of the things I found to avoid exposing sensitive information and to stay within the forum rules, I will not release the broken auth version, so don't DM me asking for it.
After getting no answer from him directly, while seeing him tell other people that he's the developer, I decided to do my own research, and these are the results.
TL;DR
There's really not much to prove here. Sheintan / MaxiCheats is literally reselling ez-val.com, a known product provider for resellers. He did try to hide it by registering a second domain, 666auth.pro, but it's 1:1 with ez-val.com. The loader he ships with both his public and private versions points at ez-val.com. A key sold by MaxiCheats works on both 666auth.pro and ez-val.com, They are also using a publicly available vulnerable driver and Discord overlay, which makes them risky rather than "UD" as they claim.
same backend as 666auth.pro 1:1 loader, 1:1 protocol, 1:1 keys
Public & Private Are the Same Product
Both the Public and Private versions are the same product
It's not only the core and features that are the same, as he previously said, both versions also appear to use the same vulnerable driver and even have a traceable loader signature.
Considering I was able to find this amount of information, potential detection vectors, and things that I know are detected in around an hour and a half, I personally wouldn't consider either version safe
If I could identify this much in such a short period of time, imagine what Vanguard's own security team could find with considerably more time and resources
| Proof of other sellers listing ez-val | |
|
|
The CSP giveaway
Weirdly enough, 666auth.pro's Content-Security-Policy response header includes a reference to keyauth.win:
[Only registered and activated users can see links. Click Here To Register...]
Anyone can verify this in their own browser:
- Visit [Only registered and activated users can see links. Click Here To Register...]
- Open DevTools -> Network
- Search the response headers for keyauth.win
Error mapping 1:1 with ez-val's loader
The MaxiCheats loader recognises exactly the same JSON error fragments and maps them to exactly the same E-3xxx codes and user strings as ez-val:
Code:
"error":"expired" E-3012 License expired "error":"paused" E-3003 License paused "error":"hwid" E-3004 HWID mismatch — contact support "error":"invalid" E-3005 Invalid license key "error":"blacklisted" E-3006 Access denied "error":"maintenance" E-3007 Server maintenance "error":"version" E-3010 Update required
Code:
1. DNS ez-val.com (A, IPv4)
2. POST https://ez-val.com/handshake
{ clientPubKeyBase64 }
→ sessionId, serverPubKeyBase64, challenge{iv,data,tag}
3. POST https://ez-val.com/loader/create-session
{ hwid, productId:"valorant-public" }
→ sessionId, token, url
4. Loader opens in browser https://ez-val.com/<url>
5. GET https://ez-val.com/loader/session-status/<sessionId>?token=<token>
polled 1×/s, sign-in phase
6. GET https://ez-val.com/loader/session-status/<sessionId>?token=<token>
polled 1×/s, license-pick phase → returns licenseKey
From here on: POST https://ez-val.com/secure
body encrypted, action in plaintext inside envelope
7. action="login" { key, hwid, ver, product, metadata }
8. action="getvar" { name:"package_type", product }
9. action="getoffsets" { product }
10. action="downloadfile" { filename:"config.json", product }
11. action="geticons" { }
12. action="downloadfile" { filename:"public-driver.sys", product } skipped if \\.\PGRHostControl exists
13. action="downloadfile" { filename:"overlay_public.dll", product }
14. action="create-claim" { productId } → claimToken
The vulnerable driver
The vulnerable driver is P*********.sys, from P** **** *****. It's literally known/public and I'm surprised it's not blacklisted yet by Vanguard.
[Only registered and activated users can see links. Click Here To Register...]
The loader first checks if \\.\P******** exists, if the handle opens, the device is already loaded and the download request to the server is skipped.
Otherwise, the loader proceeds to load it in this sequence:
- Enables SeLoadDriverPrivilege
- Generates a randomized Windows-looking service name (from a pool of ~20 plausible names like WdiCacheAgent, TpmMonHost, SysCfgHost) + 6 hex chars
- Writes bytes to %SystemRoot%\drivers\<name>.sys via fopen("...","wb")
- Opens SCM and calls CreateService: access 0xF01FF, Type=1 (SERVICE_KERNEL_DRIVER), Start=3 (SERVICE_DEMAND_START), ErrorControl=0
- StartService, then immediately deletes the service and staged file
- In-memory driver bytes are zeroed after the load attempt
Disclosure boundary
I'm not going to disclose how to bypass any of the security checks of ez-val's loaders. I was able to successfully remove every single one of them, including the VM checks. Most of the important routines were virtualized; after lifting and cleaning them up I was able to recover most of the protected strings as well.
