Why AHK(s) are detectable and being banned by battle eye!

[rayan20]

So, I was researching on AHK scripts and found that the real reason behind AHK Scripts getting banned is that they actually don't get compiled to the HEX code.

Here is an example of both :



If someone is able to convert that into a Hex code, Battle Eye won't be able to Bat an EYE!

Software used : Resource Hacker!

P.S I already used UPX to pack it, No changes.

[edups yellow homie]

Neat I'll do some testing and see how it goes
Hopefully battleye won't get around this too

[rayan20]

Neat I'll do some testing and see how it goes
Hopefully battleye won't get around this too

Yeah, HOPE SO

[DmE]

"The real reason"... this is in no way the real reason for you getting kicked/banned. But try it, maybe it helps

//EDIT: In case u won't belive me, just start AHK without Script loaded. You will get kicked too

[Beast]

"The real reason"... this is in no way the real reason for you getting kicked/banned. But try it, maybe it helps

//EDIT: In case u won't belive me, just start AHK without Script loaded. You will get kicked too

What do you mean? You get kicked for only running AHK without even loading the script?

[balckice]

You can load an empty script and get kicked or banned. I've tested this as it were kick only.

[Beast]

You can load an empty script and get kicked or banned. I've tested this as it were kick only.

Even if the script is compiled?

[demisehi111]

Even if the script is compiled?

Yes, even if compiled.

[Syntxi]

You don't understand, BE doesn't read your script it looks for the AHK process that runs in the background when you start any AHK script empty/compiled/exe etc..
They sit there and laugh at you trying to baypass such a thing...just saying google other macro programs.

[demisehi111]

You don't understand, BE doesn't read your script it looks for the AHK process that runs in the background when you start any AHK script empty/compiled/exe etc..
They sit there and laugh at you trying to baypass such a thing...just saying google other macro programs.

Compiled AHK, resource edited everything, process name, signature, everything was different and still it resulted in a kick. I think they worked specifically with the AHK devs on a detection mode.

[qwertyman3]

Compiled AHK, resource edited everything, process name, signature, everything was different and still it resulted in a kick. I think they worked specifically with the AHK devs on a detection mode.

Unless you rewrite and recompile AHK from source you are not going to bypass any kind of signature detection battleye might have for AHK.

[rayan20]

that's what i said actually. No matter what AHK is too open to get detected. U need to create hex and then use it as exe, that way AHK won't run as hex code is embedded directly into Registers. Instead it uses code directly from exe to do things which is detectable by BE easily.

[DmE]

that's what i said actually

No its not, you asked to mask the script within HEX Codes, which is in no way the same. (See your Screenshot, you stated that AutoIT scripts are HEX and AHK are not which will cause your kick)
Even if you'd mask the Script it would still be an ease for BE to detect AHK running in your background.

[PhantomV]

BE Disable random Process by my Pc, Explorer Teamviewer and and and after each start another task ;-) the know that o hack but dont find the task i think!

[DmE]

BE Disable random Process by my Pc, Explorer Teamviewer and and and after each start another task ;-) the know that o hack but dont find the task i think!

BE doesnt just disable random programs. And they will never disable your explorer.exe, i call BS. If they know you are hacking, they would ban you without searching for your hack.