Osiris icon indicating copy to clipboard operation
Osiris copied to clipboard

AddCircleImageFilled() + Upgrade Osiris Detection

Open techzin opened this issue 3 years ago • 15 comments

A simple Circle Image pasted from another imgui. VMP is an away to make cheat more undetectable. XorStr is an string encrypt at compile time, the best in my opinion, you can use to make cheat more undetectable and more secure against crack.

If you want you can add xorstr_("your string") to all strings to protect them.

techzin avatar Jun 13 '21 14:06 techzin

What's the point of xorstr when it's public.

3Ld4D avatar Jun 14 '21 04:06 3Ld4D

What's the point of xorstr when it's public. sorry if it was unnecessary, i just wanted to try to help the way i know.

techzin avatar Jun 15 '21 00:06 techzin

:thonk:

wemanzoz avatar Jun 15 '21 07:06 wemanzoz

What's the point of xorstr when it's public.

LWSS fuzion uses xorstr and its public too

mkot2 avatar Jun 16 '21 13:06 mkot2

@techzin how can i add this to my build, do i need to add the .lib file aswell? orr

wemanzoz avatar Jun 17 '21 10:06 wemanzoz

@wemanzoz add VMP path to Project Properties -> C++ Directories -> Lib Path

techzin avatar Jun 18 '21 01:06 techzin

If an anticheat cared to look for strings, they wouldn't look solely at .rdata, they'd have the ability to be intrusive and make pages they read have EXECUTE_READWRITE permissions and access the contents of what's pushed as an argument if it's valid, as an example, or simply go over .data at runtime if the access pointers are valid.

cristeigabriel avatar Jun 20 '21 10:06 cristeigabriel

@wemanzoz add VMP path to Project Properties -> C++ Directories -> Lib Path

can i have ur discord? i have some questions

wemanzoz avatar Jun 21 '21 04:06 wemanzoz

@wemanzoz add VMP path to Project Properties -> C++ Directories -> Lib Path

can i have ur discord? i have some questions

Yeah, my nick: TechZiN#7640

techzin avatar Jun 21 '21 14:06 techzin

Se um anticheat se preocupasse em procurar strings, eles não olhariam apenas para .rdata, eles teriam a capacidade de ser intrusivos e fazer com que as páginas lidas tivessem permissões EXECUTE_READWRITE e acessassem o conteúdo do que é enviado como um argumento se for válido como exemplo, ou simplesmente examine .data em tempo de execução se os ponteiros de acesso forem válidos.

Some friends have told me before, that xorstr helps change signature (in theory), this could help since the VAC detects most cheats free, because of signatures.

techzin avatar Jun 21 '21 14:06 techzin

Se um anticheat se preocupasse em procurar strings, eles não olhariam apenas para .rdata, eles teriam a capacidade de ser intrusivos e fazer com que as páginas lidas tivessem permissões EXECUTE_READWRITE e acessassem o conteúdo do que é enviado como um argumento se for válido como exemplo, ou simplesmente examine .data em tempo de execução se os ponteiros de acesso forem válidos.

Some friends have told me before, that xorstr helps change signature (in theory), this could help since the VAC detects most cheats free, because of signatures.

No, it only changes strings to random numbers. They get unhashed on runtime.

3Ld4D avatar Jun 21 '21 20:06 3Ld4D

Se um anticheat se preocupasse em procurar strings, eles não olhariam apenas para .rdata, eles teriam a capacidade de ser intrusivos e fazer com que as páginas lidas tivessem permissões EXECUTE_READWRITE e acessassem o conteúdo do que é enviado como um argumento se for válido como exemplo, ou simplesmente examine .data em tempo de execução se os ponteiros de acesso forem válidos.

Some friends have told me before, that xorstr helps change signature (in theory), this could help since the VAC detects most cheats free, because of signatures.

I mean, it does change the signature because it adds more instructions to be executed to unhash the string at runtime, whereas the result is inlined in place from being processed at compiletime, but that doesn't make sense to do whatsoever. Anywho if they were to sig shit, they'd look into more important stuff, you'd be better using a lazy importer for API methods, or changing optimization settings, or using alternative compilers, etc.

cristeigabriel avatar Jun 23 '21 08:06 cristeigabriel

https://i.imgur.com/vznDEJR.png I don't understand where my mistake is... image

Shuvi-Moro avatar Jul 28 '21 21:07 Shuvi-Moro

@Shuvi-Moro you are building it as x64

3Ld4D avatar Jul 28 '21 21:07 3Ld4D

Build as x86

JukoiDev avatar Aug 24 '21 09:08 JukoiDev