Login

~~d0h!~~ · (This post was last modified: 01-12-2011, 20:56 by d0h!.)

VAC3 appears to be here. Valve is apparently streaming code to steam now.

They're manual mapping now instead of using LoadLibrary as they did with VAC2.

As for how it is loaded, they are streaming it on connection to a secure server

It appears to be active in Source Engine games, COD games, streamed from SteamService.dll in steam.exe.

runfunc appears to be the meat of the deal

edit// looks like they changed from crc to md5 to verifiy the file integrity
edit2//active since november in black ops and other games alongside with vac2. probably still in testing

Quote:Couple pieces of news, VAC3 does direct syscalls, namely:

ZwOpenProcess
ZwQueryVirtualMemory
ZwReadProcessMemory
ZwQuerySystemInformation
ZwQueryInformationProcess
ZwClose

The actual code to do the syscalls resides in VAC3 itself.

As for the scan packet sent from the server, it appears the decrypt Ice Key is sent along with it and the packet is validated with CRC32_ProcessBuffer from the SDK.

dumped vac3.dll attached
thx to wav & GD

DONT ASK IF THIS OR THAT HACK IS DETECTED DUE TO THIS CHANGE!
We dont know it yet, i will keep this Thread up-to-date

blackout612 · 01-11-2011, 02:17

Thanks for the heads up

Killingdyl · (This post was last modified: 01-11-2011, 04:01 by Killingdyl.)

does this effect the modloader in anyway?
because aosma told me there was a beta ever since BO came out

aosma8 · 01-11-2011, 04:34

(01-11-2011, 04:01)Killingdyl Wrote: does this effect the modloader in anyway?
because aosma told me there was a beta ever since BO came out

JUST BLAME THE BLACK GUY!

lol :

Quote:edit2//active since november in black ops and other games alongside with vac2. probably still in testing

Seee.

***SuperNovaAO*** · 01-11-2011, 13:19

The thing about LoadLibrary is for way longer. July or August '10.

~~Ivankec~~ · 02-23-2011, 17:29

Uhh..

Kazaa · 02-27-2011, 21:54

VAC sucks :/

Pjotrkiller · 03-01-2011, 19:52

(01-11-2011, 04:01)Killingdyl Wrote: does this effect the modloader in anyway?
because aosma told me there was a beta ever since BO came out

Probably not, as you can turn off VAC in private matches.

~~d0h!~~ · 03-01-2011, 20:06

doesnt matter if you choose on or off. this option is a left over and has no function

blahblah75 · (This post was last modified: 03-09-2011, 13:12 by blahblah75.)

(02-27-2011, 21:54)Kazaa Wrote: VAC sucks :/

Roger that been playing Half-Life mods since the old days of VAC its always been a POS Angry