PolyMeme V2 [PolyLoader] [ESP & Radar] [Fully External]

....

quote

That was a guess tho, noone really knows what caused the banwave but there are many speculations. Welcome back, times have changed.

What an entrance

To elaborate on my earlier post, after more research apparently people have being going up to 2 months so far by replacing strings, Only string that remains constant is "csgo.exe", "client.dll" and "engine.dll". Simply because these can't be changed without a lot of effort.

If it is a string based detection it seems strange that these aren't causing VAC Bans unless its just super delayed.



I like to enter in style.

So how can we change that?

When you start a process, it gets its own unique process id (PID), we could potentially use that to remove the need for a string to target the process. Each PID is unique and different on startup, it would only be a matter of Launching Task Manager, getting the ID and updating a variable in the source.

Due to there being a different PID on startup, it wouldn't be possible for VAC to just simply look for a certain number.

When you start a process, it gets its own unique process id (PID), we could potentially use that to remove the need for a string to target the process. Each PID is unique and different on startup, it would only be a matter of Launching Task Manager, getting the ID and updating a variable in the source.

Due to there being a different PID on startup, it wouldn't be possible for VAC to just simply look for a certain number.

what about client and engine ?
.

or just XOR runtime string encryption.. ?

Splitting the name into 3 parts, clientStart, clientContain, clientEnd.

clientStart = "cli";
clientContain = "ent";
clientEnd = ".dll";

All you would need to do is edit your memory class, Search for a module that starts with clientStart, contains clientContain and ends with clientEnd.

So long as you never piece all 3 parts together, The blacklisted word "client.dll" is never found.

This would be a temporary fix but should work.

- - - Updated - - -



That works too but I'm faaaaaar to lazy for that shit.

Also passing the XOR encrypted string to a module finder would be a bit of hassle.