gmh5225/eac-kernel-packet-fuckerBypass reverse-engineered del driver kernel di Easy Anti-Cheat che intercetta l'allocazione di memoria per sopprimere i pacchetti di violazione, con routine di decrittazione dei report e note di analisi.
Non è il mio codice. Solo per conservarlo https://www.unknowncheats.me/forum/anti-cheat-bypass/503052-easy-anti-cheat-kernel-packet-fucker.html
Questo è l'Easy Anti-Cheat Kernel Packet Fucker (in breve, EACKPFucker). Cos'è? In pratica, i pacchetti tramite il loro driver in modalità kernel non verranno inviati a loro, il che significa che i tuoi bypass FUD pasta pasta 2023 kdmapper possono essere usati senza alcun problema.
Ok, mi hai fatto uscire dai gangheri. Come cazzo funziona? Semplicemente cambiando un indirizzo. Ora, immergiamoci a fondo in come funziona realmente EAC.
Dall'inizio, Easy Anti-Cheat deve effettivamente ottenere i tuoi dati per bannarti. Questi pacchetti vengono inviati attraverso il loro canale Hydra e sono crittograficamente sicuri. Questo è tutto ciò che devi sapere per questo bypass, non entrerò in maggiori dettagli al riguardo.
Diamo un'occhiata a come funziona all'interno del loro driver kernel, con una violazione casuale:
Non ti sembra vulnerabile? Perché a me sembra proprio di sì.
Diamo un'occhiata alla nostra prima funzione: kalloc_rt
Hmm, okay. Saltiamo dentro alloc_pool_with_tag
Importa dinamicamente ExAllocatePoolWithTag. Hmmmm... mi chiedo cosa succederebbe se qualcuno modificasse quel qword con la propria funzione malloc modificata... (sì, funziona -- e dato che stai modificando una sezione scrivibile, EAC non se ne accorge)
Okay, ora abbiamo il controllo sull'allocazione di memoria. Figo! Cosa possiamo farci?
Sono contento che tu l'abbia chiesto! Ecco il punto: tutti i pacchetti dalla modalità kernel hanno la dimensione di 33096i64.. eee in precedenza, abbiamo visto che se la memoria non viene allocata, EAC semplicemente.. ignora la violazione.
Okay, diciamo che qualcuno semplicemente.. facesse questo:
---------------------------------------------------------------------------------------------------------------------------------------```C++ // report encryption looks like this (some parts may vary for each report, i believe they use key1, key2, key3 to use only 1 function for decryption) static report_t* encrypt(uint8_t* data, uint64_t size) {
report_t* packet = (report_t*)malloc(sizeof(report_t));
if (!packet) return nullptr;
uint32_t seed = 0x80BE5ED5 * ((uint64_t)&data >> 2);
memset(&packet->key1, 0, 0x8200);
packet->raw_size = 0;
packet->key1 = 0x66259F86; // gives key4?
packet->key2 = 0x21EBA81; // gives key5?
packet->key3 = 0xACE987AF; // gives key6?
packet->key4 = 0x50BFC583; // gives seed
packet->key5 = 0x3C61A927; // gives dynamic_key (from end)
packet->key6 = 0x70881859; // gives actual payload size
uint8_t* raw_data = packet->raw;
uint64_t raw_size = 24;
uint8_t* payload_data = packet->payload;
uint64_t payload_size = 0;
uint32_t dynamic_key = seed ^ 0x6957FDB6;
while (payload_size < size && payload_size < 0x8000) {
uint32_t a = (dynamic_key << 0xD) ^ dynamic_key;
uint32_t b = (a >> 0x11) ^ a;
uint32_t c = (b << 0x5) ^ b;
uint32_t d = _rotr(c, 2);
uint8_t shift = 8 * (payload_size & 3);
payload_data[payload_size] = data[payload_size] ^ (d >> shift);
dynamic_key = data[payload_size] ^ d;
payload_size++;
raw_size++;
}
uint64_t aligned_size = (raw_size + 0xFF) & ~0xFF; // align up by 0x100
while (raw_size < aligned_size) {
dynamic_key *= 0x80BE5ED5;
raw_data[raw_size++] = dynamic_key;
}
packet->key4 ^= seed;
packet->key5 ^= dynamic_key;
packet->key6 ^= payload_size;
packet->raw_size = raw_size;
return packet;
}
// thus my decryption looks like this static void decrypt(report_t* packet) {
uint32_t seed = packet->key4 ^ 0x50BFC583;
uint32_t dynamic_key = seed ^ 0x6957FDB6;
//uint32_t dynamic_key = packet->key5 ^ 0x3C61A927;
uint8_t* payload_data = packet->payload;
uint32_t payload_size = packet->key6 ^ 0x70881859;
for (uint32_t i = 0; i < payload_size; i++) {
uint32_t a = (dynamic_key << 0xD) ^ dynamic_key;
uint32_t b = (a >> 0x11) ^ a;
uint32_t c = (b << 0x5) ^ b;
uint32_t d = _rotr(c, 2);
uint8_t shift = 8 * (i & 3);
payload_data[i] ^= (d >> shift);
dynamic_key = payload_data[i] ^ d;
}
}
dopo aver scaricato alcuni report e averli decifrati:
REPORT ID: 0x107531A1 (text)```
[Ob] N: MsMpEng.exe T: E37B095A C: 000280DE E: 0000BE90
[Lib] N: ntdll.dll B: 00007FFD4D310000 S: 1F7000 P: ntdll.pdb
[Lib] N: kernel32.dll B: 00007FFD4CFF0000 S: BD000 P: kernel32.pdb
[Lib] N: KernelBase.dll B: 00007FFD4AF90000 S: 2CD000 P: kernelbase.pdb
[Lib] N: advapi32.dll B: 00007FFD4D220000 S: AE000 P: advapi32.pdb
[Ob] N: ProcessHacker. T: 86B67A1B C: 002A2F41 E: 0019D960
[Ob] N: Discord.exe T: 6255D9BD C: 0708B371 E: 030AAD10
[Lib] N: msvcrt.dll B: 00007FFD4CAE0000 S: 9E000 P: msvcrt.pdb
[Lib] N: X3DAudio1_7.dll B: 00000000620E0000 S: 9000 P: X3DAudio1_7.pdb
[Lib] N: xinput1_3.dll B: 0000000000400000 S: 1E000 P: XInput1_3.pdb
[Lib] N: XAPOFX1_5.dll B: 00007FFD2FC30000 S: 15000 P: XAPOFX1_5.pdb
[Ob] N: EasyAntiCheat. T: 6273A229 C: 0011DA03 E: 0006D465
[Lib] N: msvcrt.dll B: 000002AAA3540000 S: 9E000 P: msvcrt.pdb
[Lib] N: msvcrt.dll B: 000002AAA3730000 S: 9E000 P: msvcrt.pdb
[Lib] N: setupapi.dll B: 00007FFD4CB80000 S: 46F000 P: setupapi.pdb
[Lib] N: dxgi.dll B: 00007FFD49330000 S: F3000 P: dxgi.pdb
[Lib] N: sechost.dll B: 00007FFD4B3A0000 S: 9C000 P: sechost.pdb
[Lib] N: ole32.dll B: 00007FFD4C950000 S: 12A000 P: ole32.pdb
[Lib] N: rpcrt4.dll B: 00007FFD4BA00000 S: 125000 P: rpcrt4.pdb
[Lib] N: ucrtbase.dll B: 00007FFD4AAD0000 S: 100000 P: ucrtbase.pdb
[Lib] N: win32u.dll B: 00007FFD4ABD0000 S: 22000 P: win32u.pdb
[Lib] N: user32.dll B: 00007FFD4BB30000 S: 1A0000 P: user32.pdb
[Lib] N: d3d9.dll B: 00007FFD38750000 S: 1CF000 P: d3d9.pdb
[Lib] N: combase.dll B: 00007FFD4B440000 S: 354000 P: combase.pdb
[Lib] N: cfgmgr32.dll B: 00007FFD4B260000 S: 4E000 P: cfgmgr32.pdb
[Lib] N: bcrypt.dll B: 00007FFD4B340000 S: 27000 P: bcrypt.pdb
[Lib] N: gdi32.dll B: 00007FFD4BFD0000 S: 2A000 P: gdi32.pdb
[Lib] N: gdi32.dll B: 000002AAA3570000 S: 2A000 P: gdi32.pdb
[Lib] N: d3d11.dll B: 00007FFD47110000 S: 263000 P: d3d11.pdb
[Lib] N: combase.dll B: 000002AAA39A0000 S: 354000 P: combase.pdb
[Lib] N: gdi32full.dll B: 00007FFD4AE80000 S: 10B000 P: gdi32full.pdb
[Lib] N: D3DCompiler_43.dll B: 00007FFD187E0000 S: 26F000 P: D3DCompiler_43.pdb
[Lib] N: msvcp_win.dll B: 00007FFD4AA30000 S: 9D000 P: msvcp_win.pdb
[Lib] N: kernel.appcore.dll B: 00007FFD49310000 S: 12000 P: Kernel.Appcore.pdb
[Lib] N: windows.storage.dll B: 00007FFD48B10000 S: 794000 P: Windows.Storage.pdb
[Lib] N: dwmapi.dll B: 00007FFD48200000 S: 2F000 P: dwmapi.pdb
[Lib] N: ws2_32.dll B: 00007FFD4C880000 S: 6B000 P: ws2_32.pdb
[Lib] N: crypt32.dll B: 00007FFD4AD20000 S: 156000 P: crypt32.pdb
[Lib] N: Wldap32.dll B: 00007FFD4CA80000 S: 56000 P: wldap32.pdb
[Lib] N: normaliz.dll B: 00007FFD4BCD0000 S: 8000 P: normaliz.pdb
[Lib] N: winmm.dll B: 00007FFD39FD0000 S: 27000 P: winmm.pdb
[Lib] N: shell32.dll B: 00007FFD4C120000 S: 744000 P: shell32.pdb
[Lib] N: wldp.dll B: 00007FFD4A490000 S: 2C000 P: WLDP.pdb
[Lib] N: oleaut32.dll B: 00007FFD4B930000 S: CD000 P: oleaut32.pdb
[Lib] N: IPHLPAPI.DLL B: 00007FFD49E90000 S: 3B000 P: iphlpapi.pdb
[Lib] N: imm32.dll B: 00007FFD4B370000 S: 30000 P: imm32.pdb
[Lib] N: UIAutomationCore.dll B: 00007FFD22240000 S: 2F5000 P: UIAutomationCore.pdb
[Lib] N: winhttp.dll B: 00007FFD44920000 S: 10A000 P: winhttp.pdb
[Lib] N: dsound.dll B: 00007FFD10F40000 S: 9C000 P: dsound.pdb
[Lib] N: vcruntime140.dll B: 00007FFD3F380000 S: 1B000 P: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb
[Lib] N: msvcp140.dll B: 00007FFD3D5E0000 S: 8E000 P: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\msvcp140.amd64.pdb
[Lib] N: vcruntime140_1.dll B: 00007FFD3F370000 S: C000 P: D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb
[Lib] N: powrprof.dll B: 00007FFD49FB0000 S: 4B000 P: powrprof.pdb
[Lib] N: powrprof.dll B: 000002AAA3570000 S: 4B000 P: powrprof.pdb
[Lib] N: winmmbase.dll B: 00007FFD3F210000 S: 26000 P: WINMMBASE.pdb
[Lib] N: propsys.dll B: 00007FFD46280000 S: F6000 P: propsys.pdb
[Lib] N: umpdc.dll B: 00007FFD49E70000 S: 12000 P: UMPDC.pdb
[Lib] N: nvapi64.dll B: 00007FFD40030000 S: 747000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\nvapi\gpu\_out\wddm2_amd64_release\nvapi64.pdb
[Lib] N: version.dll B: 00007FFD433F0000 S: A000 P: version.pdb
[Lib] N: shlwapi.dll B: 00007FFD4BCE0000 S: 55000 P: shlwapi.pdb
[Lib] N: msasn1.dll B: 00007FFD4A620000 S: 12000 P: msasn1.pdb
[Lib] N: cryptnet.dll B: 00007FFD424B0000 S: 31000 P: cryptnet.pdb
[Lib] N: drvstore.dll B: 00007FFD41800000 S: 148000 P: drvstore.pdb
[Lib] N: devobj.dll B: 00007FFD4A7E0000 S: 2C000 P: devobj.pdb
[Lib] N: cryptbase.dll B: 00007FFD4A400000 S: C000 P: cryptbase.pdb
[Lib] N: bcryptprimitives.dll B: 00007FFD4B2B0000 S: 82000 P: bcryptprimitives.pdb
[Lib] N: SHCore.dll B: 00007FFD4BF20000 S: AD000 P: shcore.pdb
[Lib] N: profapi.dll B: 00007FFD4A970000 S: 1F000 P: profapi.pdb
[Ob] N: explorer.exe T: F7B2A2B2 C: 004E72AA E: 000A1920
[Ob] N: svchost.exe T: 1F37EB46 C: 0001A0FA E: 00005040
[Lib] N: sspicli.dll B: 00007FFD4A920000 S: 32000 P: sspicli.pdb
[Lib] N: dbghelp.dll B: 00007FFCFB450000 S: 1E3000 P: dbghelp.pdb
[Lib] N: nsi.dll B: 00007FFD4BD40000 S: 8000 P: nsi.pdb
[Lib] N: dhcpcsvc6.dll B: 00007FFD41620000 S: 17000 P: dhcpcsvc6.pdb
[Lib] N: dhcpcsvc.dll B: 00007FFD424F0000 S: 1D000 P: dhcpcsvc.pdb
[Lib] N: mswsock.dll B: 00007FFD4A1F0000 S: 6A000 P: mswsock.pdb
[Lib] N: wintrust.dll B: 00007FFD4ACB0000 S: 67000 P: wintrust.pdb
[Lib] N: secur32.dll B: 00007FFD3F6C0000 S: C000 P: secur32.pdb
[Lib] N: version.dll B: 00007FFD433F0000 S: A000 P: version.pdb
[Lib] N: cryptsp.dll B: 00007FFD4A3E0000 S: 18000 P: cryptsp.pdb
[Lib] N: rsaenh.dll B: 00007FFD49B00000 S: 34000 P: rsaenh.pdb
[Lib] N: imagehlp.dll B: 00007FFD4BF00000 S: 1D000 P: imagehlp.pdb
[Lib] N: gpapi.dll B: 00007FFD492C0000 S: 23000 P: gpapi.pdb
[Lib] N: opengl32.dll B: 00007FFD18A50000 S: 126000 P: opengl32.pdb
[Lib] N: glu32.dll B: 00007FFD26CA0000 S: 2C000 P: glu32.pdb
[Lib] N: ResourcePolicyClient.dll B: 00007FFD48100000 S: 14000 P: ResourcePolicyClient.pdb
[Ob] N: svchost.exe T: 1F37EB46 C: 0001A0FA E: 00005040
[Lib] N: msctf.dll B: 00007FFD4C000000 S: 115000 P: msctf.pdb
[Lib] N: nvldumdx.dll B: 00007FFD38C80000 S: 117000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\nvldumd\_out\wddm2_amd64_release\nvldumdx.pdb
[Lib] N: nvwgf2umx.dll B: 00007FFD13260000 S: 29FB000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\wgf2um\_out\wddm2_amd64_release\nvwgf2umx.pdb
[Lib] N: NvCameraAllowlisting64.dll B: 00007FFCFB2F0000 S: AE000 P: C:\BuildAgent\work\e4cd6e8028b37277\bin\Release\NvCameraAllowlisting64.pdb
[Lib] N: nvspcap64.dll B: 00007FFD10940000 S: 2C7000 P: C:\dvs\p4\build\sw\rel\gfclient\rel_03_25_1\shadowplay2\proxy\win7_amd64_release\nvspcap64.pdb
[Lib] N: ntmarta.dll B: 00007FFD49730000 S: 33000 P: ntmarta.pdb
[Lib] N: NvCamera64.dll B: 00007FFCFAB50000 S: 84F000 P: C:\BuildAgent\work\e4cd6e8028b37277\bin\Release\NvCamera64.pdb
[Lib] N: dinput8.dll B: 00007FFD2FB90000 S: 45000 P: dinput8.pdb
[Lib] N: XInput9_1_0.dll B: 00007FFD2FBE0000 S: 7000 P: XInput9_1_0.pdb
[Lib] N: WindowsCodecs.dll B: 00007FFD44AA0000 S: 1B4000 P: WindowsCodecs.pdb
[Lib] N: hid.dll B: 00007FFD492B0000 S: D000 P: hid.pdb
[Lib] N: InputHost.dll B: 00007FFD2C350000 S: 152000 P: InputHost.pdb
[Lib] N: CoreUIComponents.dll B: 00007FFD478F0000 S: 35E000 P: CoreUIComponents.pdb
[Lib] N: CoreMessaging.dll B: 00007FFD47C50000 S: F2000 P: CoreMessaging.pdb
[Lib] N: WinTypes.dll B: 00007FFD46590000 S: 154000 P: WinTypes.pdb
[Lib] N: DXCore.dll B: 00007FFD44CF0000 S: 3B000 P: DXCore.pdb
[Lib] N: d3dcompiler_47_64.dll B: 00007FFCFA740000 S: 404000 P: D3DCompiler_47.pdb
[Lib] N: nvapi64.dll B: 00007FFD40030000 S: 747000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\nvapi\gpu\_out\wddm2_amd64_release\nvapi64.pdb
[Lib] N: nvcuda64.dll B: 00007FFCF8920000 S: 1515000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\gpgpu\_out\wddm2_amd64_release\nvcuda.pdb
[Ob] N: nvcontainer.ex T: 621DBDA6 C: 000FF234 E: 00036BD0
[Lib] N: NapiNSP.dll B: 00007FFD23680000 S: 17000 P: NapiNSP.pdb
[Lib] N: pnrpnsp.dll B: 00007FFD22CE0000 S: 1B000 P: pnrpnsp.pdb
[Lib] N: wshbth.dll B: 00007FFD28020000 S: 15000 P: wshbth.pdb
[Lib] N: nlaapi.dll B: 00007FFD45B40000 S: 1D000 P: nlaapi.pdb
[Lib] N: dnsapi.dll B: 00007FFD49EE0000 S: CB000 P: dnsapi.pdb
[Lib] N: winrnr.dll B: 00007FFD22CC0000 S: 12000 P: winrnr.pdb
[Lib] N: uxtheme.dll B: 00007FFD48010000 S: 9E000 P: UxTheme.pdb
[Ob] N: svchost.exe T: 1F37EB46 C: 0001A0FA E: 00005040
[Lib] N: clbcatq.dll B: 00007FFD4B880000 S: A9000 P: CLBCatQ.pdb
[Lib] N: gameux.dll B: 00007FFD2FBE0000 S: B000 P: gameux.pdb
[Lib] N: PxFoundation_x64.dll B: 00007FFD2FB70000 S: 13000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PxFoundation_x64.pdb
[Lib] N: PhysX3Common_x64.dll B: 00007FFCFB0E0000 S: 18C000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PhysX3Common_x64.pdb
[Lib] N: PxPvdSDK_x64.dll B: 00007FFCFB0A0000 S: 32000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PxPvdSDK_x64.pdb
[Lib] N: PhysX3_x64.dll B: 00007FFCFAE90000 S: 20B000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PhysX3_x64.pdb
[Lib] N: ApexFramework_x64.dll B: 00007FFCFAD80000 S: 108000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\ApexFramework_x64.pdb
[Lib] N: APEX_Legacy_x64.dll B: 00007FFCFAA10000 S: 367000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\APEX_Legacy_x64.pdb
[Lib] N: APEX_Clothing_x64.dll B: 00007FFCFA8D0000 S: 137000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\APEX_Clothing_x64.pdb
[Lib] N: PhysX3Cooking_x64.dll B: 00007FFCFA890000 S: 40000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\PhysX3Cooking_x64.pdb
[Lib] N: PhysXUpdateLoader64.dll B: 00007FFCFA860000 S: 2A000 P: N/A
[Lib] N: PhysXUpdateLoader64.dll B: 00007FFCFA860000 S: 2A000 P: N/A
[Ob] N: ctfmon.exe T: 60C3FE88 C: 000118E7 E: 000011C0
[Lib] N: TextInputFramework.dll B: 00007FFD2C7E0000 S: F9000 P: TextInputFramework.pdb
[Lib] N: ExplorerFrame.dll B: 00007FFD27170000 S: 220000 P: ExplorerFrame.pdb
[Lib] N: nvldumdx.dll B: 00007FFD38C80000 S: 117000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\nvldumd\_out\wddm2_amd64_release\nvldumdx.pdb
[Lib] N: nvwgf2umx.dll B: 00007FFD13260000 S: 29FB000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\wgf2um\_out\wddm2_amd64_release\nvwgf2umx.pdb
[Lib] N: NvCameraAllowlisting64.dll B: 00007FFCFA7E0000 S: AE000 P: C:\BuildAgent\work\e4cd6e8028b37277\bin\Release\NvCameraAllowlisting64.pdb
[Lib] N: NvCamera64.dll B: 00007FFCF2F20000 S: 84F000 P: C:\BuildAgent\work\e4cd6e8028b37277\bin\Release\NvCamera64.pdb
[Lib] N: XInput9_1_0.dll B: 00007FFD2FBE0000 S: 7000 P: XInput9_1_0.pdb
[Lib] N: WindowsCodecs.dll B: 00007FFD44AA0000 S: 1B4000 P: WindowsCodecs.pdb
[Lib] N: hid.dll B: 00007FFD492B0000 S: D000 P: hid.pdb
[Lib] N: d3dcompiler_47_64.dll B: 00007FFCFA480000 S: 404000 P: D3DCompiler_47.pdb
[Lib] N: d3d10warp.dll B: 00007FFD39400000 S: 6F6000 P: d3d10warp.pdb
[Proc] N: svchost.exe T: 1F37EB46 C: 0001A0FA E: 00005040
[Lib] N: nvldumdx.dll B: 00007FFD38C80000 S: 117000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\nvldumd\_out\wddm2_amd64_release\nvldumdx.pdb
[Lib] N: nvwgf2umx.dll B: 00007FFD13260000 S: 29FB000 P: C:\dvs\p4\build\sw\rel\gpu_drv\r515\r516_10\drivers\wgf2um\_out\wddm2_amd64_release\nvwgf2umx.pdb
[Lib] N: NvCameraAllowlisting64.dll B: 00007FFCFA780000 S: AE000 P: C:\BuildAgent\work\e4cd6e8028b37277\bin\Release\NvCameraAllowlisting64.pdb
[Lib] N: NvCamera64.dll B: 00007FFCF2F20000 S: 84F000 P: C:\BuildAgent\work\e4cd6e8028b37277\bin\Release\NvCamera64.pdb
[Lib] N: WindowsCodecs.dll B: 00007FFD44AA0000 S: 1B4000 P: WindowsCodecs.pdb
[Lib] N: hid.dll B: 00007FFD492B0000 S: D000 P: hid.pdb
[Lib] N: XInput9_1_0.dll B: 00007FFD2FBE0000 S: 7000 P: XInput9_1_0.pdb
[Lib] N: d3dcompiler_47_64.dll B: 00007FFCFA420000 S: 404000 P: D3DCompiler_47.pdb
[Ob] N: svchost.exe T: 1F37EB46 C: 0001A0FA E: 00005040
[Lib] N: DataExchange.dll B: 00007FFD27390000 S: 3E000 P: DataExchange.pdb
[Lib] N: dcomp.dll B: 00007FFD47380000 S: 1E4000 P: dcomp.pdb
[Lib] N: twinapi.appcore.dll B: 00007FFD44D30000 S: 200000 P: twinapi.appcore.pdb
[Ob] N: GameBarFTServe T: 6274C5DE C: 00000000 E: 0005AA40
[Lib] N: NvCameraAllowlisting64.dll B: 00007FFCFA370000 S: AE000 P: C:\BuildAgent\work\e4cd6e8028b37277\bin\Release\NvCameraAllowlisting64.pdb
[Ob] N: EpicGamesLaunc T: 629FB8BA C: 01F2B27C E: 017C9C84
[Ob] N: WmiPrvSE.exe T: 5DA7AB91 C: 000860A3 E: 00012580
[Lib] N: apphelp.dll B: 00007FFD47F60000 S: 90000 P: apphelp.pdb
[Lib] N: MessageBus.dll B: 00007FFD3A000000 S: 737000 P: C:\dvs\p4\build\sw\gcomp\dev\src\NvContainer\_out\x86_64\release\bus\MessageBus.pdb
[Lib] N: NvCloth_x64.dll B: 00007FFCEC1C0000 S: 47000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\NvCloth_x64.pdb
[Lib] N: mf.dll B: 00007FFD10DB0000 S: 84000 P: mf.pdb
[Lib] N: mfplat.dll B: 00007FFD20800000 S: 1BC000 P: MFPLAT.pdb
[Lib] N: RTWorkQ.dll B: 00007FFD207C0000 S: 34000 P: rtworkq.pdb
[Lib] N: MFPlay.dll B: 00007FFCEC130000 S: 8C000 P: MFPlay.pdb
[Lib] N: mfcore.dll B: 00007FFCEBCA0000 S: 48E000 P: mfcore.pdb
[Lib] N: ksuser.dll B: 00007FFD2FB60000 S: 9000 P: ksuser.pdb
[Lib] N: mfmp4srcsnk.dll B: 00007FFCEBA90000 S: 204000 P: mfmp4srcsnk.pdb
[Lib] N: MMDevAPI.dll B: 00007FFD43BF0000 S: 85000 P: MMDevAPI.pdb
[Lib] N: AudioSes.dll B: 00007FFD43F70000 S: 182000 P: audioses.pdb
[Lib] N: APEX_Destructible_x64.dll B: 00007FFCEB890000 S: 1FF000 P: D:\Build\++Fortnite\Sync\Engine\Binaries\ThirdParty\PhysX3\Win64\VS2015\APEX_Destructible_x64.pdb
[Lib] N: ResourcePolicyClient.dll B: 00007FFD48100000 S: 14000 P: ResourcePolicyClient.pdb
[Lib] N: PhysXUpdateLoader64.dll B: 00007FFCFA310000 S: 2A000 P: N/A
[Ob] N: svchost.exe T: 1F37EB46 C: 0001A0FA E: 00005040
[Lib] N: CompPkgSup.dll B: 00007FFD3E9B0000 S: 37000 P: CompPkgSup.pdb
[Lib] N: MSAudDecMFT.dll B: 00007FFCEB820000 S: 6F000 P: MSAudDecMFT.pdb
[Proc] N: svchost.exe T: 1F37EB46 C: 0001A0FA E: 00005040
[Lib] N: mfperfhelper.dll B: 00007FFD42640000 S: 12D000 P: mfperfhelper.pdb
[Lib] N: Windows.Media.dll B: 00007FFD127B0000 S: 727000 P: Windows.Media.pdb
[Lib] N: RESAMPLEDMO.DLL B: 00007FFCEB7E0000 S: 3F000 P: RESAMPLEDMO.pdb
[Lib] N: msdmo.dll B: 00007FFD27140000 S: B000 P: msdmo.pdb
[Lib] N: AkSilenceGenerator.dll B: 00007FFCFA320000 S: 1D000 P: D:\Jenkins\ws\wwise_v2021.1\Wwise\SDK\x64_vc160\Release\bin\AkSilenceGenerator.pdb
[Lib] N: Windows.ApplicationModel.dll B: 00007FFD36210000 S: E6000 P: Windows.ApplicationModel.pdb
[Lib] N: COLORCNV.DLL B: 00007FFCEB7A0000 S: 3C000 P: COLORCNV.pdb
[Lib] N: AkParametricEQ.dll B: 00007FFCEB770000 S: 25000 P: D:\Jenkins\ws\wwise_v2021.1\Wwise\SDK\x64_vc160\Release\bin\AkParametricEQ.pdb
[Lib] N: AppXDeploymentClient.dll B: 00007FFD42A10000 S: F7000 P: AppXDeploymentClient.pdb
[Lib] N: msmpeg2vdec.dll B: 00007FFD07CF0000 S: 27A000 P: msmpeg2vdec.pdb
[Lib] N: AkDelay.dll B: 00007FFCEB750000 S: 20000 P: D:\Jenkins\ws\wwise_v2021.1\Wwise\SDK\x64_vc160\Release\bin\AkDelay.pdb
[Ob] N: audiodg.exe T: C40FE88F C: 0009A59F E: 0001CFD0
[Lib] N: Windows.UI.dll B: 00007FFD2C8E0000 S: 141000 P: Windows.UI.pdb
[Lib] N: WindowManagementAPI.dll B: 00007FFD45160000 S: A1000 P: WindowManagementAPI.pdb
[Lib] N: AkCompressor.dll B: 00007FFCEB730000 S: 20000 P: D:\Jenkins\ws\wwise_v2021.1\Wwise\SDK\x64_vc160\Release\bin\AkCompressor.pdb
[Lib] N: avrt.dll B: 00007FFD45990000 S: A000 P: avrt.pdb
[Lib] N: AkPeakLimiter.dll B: 00007FFD19840000 S: 20000 P: D:\Jenkins\ws\wwise_v2021.1\Wwise\SDK\x64_vc160\Release\bin\AkPeakLimiter.pdb
[Lib] N: AkRoomVerb.dll B: 00007FFCEB6F0000 S: 3B000 P: D:\Jenkins\ws\wwise_v2021.1\Wwise\SDK\x64_vc160\Release\bin\AkRoomVerb.pdb
REPORT ID: 0x107531A1 (raw bytes)``` 0 FF FF FF FF 0 0
REPORT ID: 0x6829432C (raw bytes, cpuid_1 + HvTimingAttack)```
struct CPU_INFO_REPORT {
uint32_t cpuid_1_eax; // 0x0
uint32_t cpuid_1_ebx; // 0x4
uint32_t cpuid_1_ecx; // 0x8
uint32_t cpuid_1_edx; // 0xC
uint64_t quotient; // 0x10 // cpuid_iet / nop_iet (if > 15 = hv present)
uint64_t cpuid_iet; // 0x18 // 100 iterations
uint64_t nop_iet; // 0x20 // 100 iterations
};
TEXTUAL REPRESENTATION: EAX[A50F00] EBX[40C0800] ECX[7ED8320B] EDX[178BFBFF] QUOTIENT[4] CPUID_IET[397E] NOP_IET[E2E]
REPORT ID: 0x2511F5D9 (text)
REPORT ID: 0x55AD0F18 (text)``` \SystemRoot\System32\drivers\CLASSPNP.SYS
ho redatto alcuni dei report, perché contengono dati riservati
ecco tutti i report inviati mentre il gioco è aperto```
14.46319485 [!] CreateThread: 0
14.46319675 [!] Entering waiting loop...
26.55835915 [!] Found!
27.44778633 [!] <ALLOC> (BUFFER: FFFFB5036AC7D000) (CALLER: 00000000007372D5) (PV: 0) (START: FFFFF807550BF9E0)
27.45028877 [!] <FREE> (BUFFER: FFFFB5036AC7D000) (IDX: 0) (IQRL: 0)
27.46345901 [!] <ALLOC> (BUFFER: FFFFB5036AC7D000) (CALLER: 0000000000101514) (PV: 0) (START: FFFFF8075559CFA0)
27.49540138 [!] <ALLOC> (BUFFER: FFFFB5036AD34000) (CALLER: 0000000000B0DC9B) (PV: 0) (START: FFFFF807550BF9E0)
27.49777222 [!] <FREE> (BUFFER: FFFFB5036AD34000) (IDX: 1) (IQRL: 0)
27.49875259 [!] <ALLOC> (BUFFER: FFFFB5036AD34000) (CALLER: 0000000000B0DC9B) (PV: 0) (START: FFFFF807550BF9E0)
27.50095367 [!] <FREE> (BUFFER: FFFFB5036AD34000) (IDX: 2) (IQRL: 0)
27.51844215 [!] <ALLOC> (BUFFER: FFFFB5036AD0B000) (CALLER: 00000000005804C1) (PV: 0) (START: FFFFF807550BF9E0)
27.52266502 [!] <FREE> (BUFFER: FFFFB5036AD0B000) (IDX: 3) (IQRL: 0)
27.62048340 [!] <FREE> (BUFFER: FFFFB5036AC7D000) (IDX: 4) (IQRL: 0)
27.84068871 [!] <ALLOC> (BUFFER: FFFFB5036AC7D000) (CALLER: 0000000000A0DAB2) (PV: 0) (START: FFFFF8075559CFA0)
27.94095421 [!] <FREE> (BUFFER: FFFFB5036AC7D000) (IDX: 5) (IQRL: 0)
27.94399452 [!] <ALLOC> (BUFFER: FFFFB5036AC7D000) (CALLER: 0000000000040E9C) (PV: 0) (START: FFFFF8075559CFA0)
27.94753265 [!] <FREE> (BUFFER: FFFFB5036AC7D000) (IDX: 6) (IQRL: 0)
27.95534134 [!] <ALLOC> (BUFFER: FFFFB5036AC7D000) (CALLER: 00000000004E598A) (PV: 0) (START: FFFFF8075559CFA0)
27.95627785 [!] <FREE> (BUFFER: FFFFB5036AC7D000) (IDX: 7) (IQRL: 0)
27.96207619 [!] <ALLOC> (BUFFER: FFFFB5036AD21000) (CALLER: 00000000003B8C95) (PV: 0) (START: FFFFF807550BF9E0)
27.96610260 [!] <FREE> (BUFFER: FFFFB5036AD21000) (IDX: 8) (IQRL: 0)
28.33023071 [!] <ALLOC> (BUFFER: FFFFB5036AD3C000) (CALLER: 00000000001C9E77) (PV: 0) (START: FFFFF8075559CFA0)
28.33943367 [!] <FREE> (BUFFER: FFFFB5036AD3C000) (IDX: 9) (IQRL: 0)
28.46156883 [!] <ALLOC> (BUFFER: FFFFB5036AD3C000) (CALLER: 000000000070BF5C) (PV: 0) (START: FFFFF8075559CFA0)
28.46789360 [!] <ALLOC> (BUFFER: FFFFB5036AD9E000) (CALLER: 000000000005E48B) (PV: 0) (START: FFFFF807550BF9E0)
28.47018242 [!] <FREE> (BUFFER: FFFFB5036AD9E000) (IDX: 10) (IQRL: 0)
28.49411774 [!] <FREE> (BUFFER: FFFFB5036AD3C000) (IDX: 11) (IQRL: 0)
28.75633049 [!] <ALLOC> (BUFFER: FFFFB5036AD2C000) (CALLER: 00000000009EB074) (PV: 0) (START: FFFFF807550BF9E0)
28.75914001 [!] <FREE> (BUFFER: FFFFB5036AD2C000) (IDX: 12) (IQRL: 0)
61.45036697 [!] <ALLOC> (BUFFER: FFFFB5036B165000) (CALLER: 00000000009331AA) (PV: 0) (START: FFFFF80754E207C0)
61.48706055 [!] <FREE> (BUFFER: FFFFB5036B165000) (IDX: 13) (IQRL: 0)
67.27204132 [!] <ALLOC> (BUFFER: FFFFB5036B165000) (CALLER: 0000000000048520) (PV: 0) (START: FFFFF8075559CFA0)
67.29238129 [!] <FREE> (BUFFER: FFFFB5036B165000) (IDX: 14) (IQRL: 0)
67.29380798 [!] <ALLOC> (BUFFER: FFFFB5036B165000) (CALLER: 0000000000751132) (PV: 0) (START: FFFFF8075559CFA0)
67.29904175 [!] <FREE> (BUFFER: FFFFB5036B165000) (IDX: 15) (IQRL: 0)
68.36171722 [!] <ALLOC> (BUFFER: FFFFB5036B165000) (CALLER: 00000000007F6556) (PV: 0) (START: FFFFF8075559CFA0)
68.45364380 [!] <FREE> (BUFFER: FFFFB5036B165000) (IDX: 16) (IQRL: 0)
70.06682587 [!] <ALLOC> (BUFFER: FFFFB5036AF2A000) (CALLER: 00000000008E428A) (PV: 0) (START: FFFFF8075559CFA0)
70.07866669 [!] <FREE> (BUFFER: FFFFB5036AF2A000) (IDX: 17) (IQRL: 0)
70.91152191 [!] <ALLOC> (BUFFER: FFFFB5036AF2A000) (CALLER: 0000000000AA53C8) (PV: 0) (START: FFFFF8075559CFA0)
70.91969299 [!] <FREE> (BUFFER: FFFFB5036AF2A000) (IDX: 18) (IQRL: 0)
78.18015289 [!] <ALLOC> (BUFFER: FFFFB5036AF2A000) (CALLER: 00000000005C0923) (PV: 0) (START: FFFFF8075559CFA0)
78.28571320 [!] <FREE> (BUFFER: FFFFB5036AF2A000) (IDX: 19) (IQRL: 0)
79.56472778 [!] <ALLOC> (BUFFER: FFFFB5036AF2A000) (CALLER: 000000000042AF7C) (PV: 0) (START: FFFFF8075559CFA0)
79.62374878 [!] <FREE> (BUFFER: FFFFB5036AF2A000) (IDX: 20) (IQRL: 0)
79.63484192 [!] <ALLOC> (BUFFER: FFFFB5036AF2A000) (CALLER: 000000000005CB69) (PV: 0) (START: FFFFF8075559CFA0)
79.65575409 [!] <FREE> (BUFFER: FFFFB5036AF2A000) (IDX: 21) (IQRL: 0)
91.38448334 [!] <ALLOC> (BUFFER: FFFFB5036AF2A000) (CALLER: 00000000000529FE) (PV: 0) (START: FFFFF8075559CFA0)
91.40061188 [!] <FREE> (BUFFER: FFFFB5036AF2A000) (IDX: 22) (IQRL: 0)
327.62762451 [!] <ALLOC> (BUFFER: FFFFB5036B18E000) (CALLER: 0000000000101514) (PV: 0) (START: FFFFF8075559CFA0)
327.69091797 [!] <FREE> (BUFFER: FFFFB5036B18E000) (IDX: 23) (IQRL: 0)
635.37713623 [!] <ALLOC> (BUFFER: FFFFB5036C633000) (CALLER: 00000000006CD8EB) (PV: 0) (START: FFFFF807555D2B00)
635.45568848 [!] <FREE> (BUFFER: FFFFB5036C633000) (IDX: 24) (IQRL: 0)
660.46936035 [!] <ALLOC> (BUFFER: FFFFB5036C633000) (CALLER: 00000000001B48F7) (PV: 0) (START: FFFFF8075559CFA0)
660.47485352 [!] <FREE> (BUFFER: FFFFB5036C633000) (IDX: 25) (IQRL: 0)
660.73034668 [!] <ALLOC> (BUFFER: FFFFB5036C633000) (CALLER: 0000000000B3BE52) (PV: 0) (START: FFFFF8075559CFA0)
660.75280762 [!] <FREE> (BUFFER: FFFFB5036C633000) (IDX: 26) (IQRL: 0)
927.69372559 [!] <ALLOC> (BUFFER: FFFFB5036B2C7000) (CALLER: 0000000000101514) (PV: 0) (START: FFFFF8075559CFA0)
927.72619629 [!] <FREE> (BUFFER: FFFFB5036B2C7000) (IDX: 27) (IQRL: 0)
939.71856689 [!] <ALLOC> (BUFFER: FFFFB5036C633000) (CALLER: 000000000050E6AF) (PV: 0) (START: FFFFF8075559CFA0)
939.71948242 [!] <FREE> (BUFFER: FFFFB5036C633000) (IDX: 28) (IQRL: 0)
958.45611572 [!] <ALLOC> (BUFFER: FFFFB5036B2C7000) (CALLER: 000000000012AF7C) (PV: 0) (START: FFFFF8075559CFA0)
958.47155762 [!] <FREE> (BUFFER: FFFFB5036B2C7000) (IDX: 29) (IQRL: 1)
1060.63464355 [!] <ALLOC> (BUFFER: FFFFB5036C87F000) (CALLER: 0000000000A7CAD4) (PV: 0) (START: FFFFF8075559CFA0)
1060.64123535 [!] <FREE> (BUFFER: FFFFB5036C87F000) (IDX: 30) (IQRL: 0)
1064.00781250 [!] <ALLOC> (BUFFER: FFFFB5036C87F000) (CALLER: 0000000000A7CAD4) (PV: 0) (START: FFFFF8075559CFA0)
1064.01342773 [!] <FREE> (BUFFER: FFFFB5036C87F000) (IDX: 31) (IQRL: 0)
1741.98950195 [!] <ALLOC> (BUFFER: FFFFB5036CAA7000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
1742.00671387 [!] <FREE> (BUFFER: FFFFB5036CAA7000) (IDX: 32) (IQRL: 0)
1977.99316406 [!] <ALLOC> (BUFFER: FFFFB5036AAAB000) (CALLER: 0000000000A7CAD4) (PV: 0) (START: FFFFF8075559CFA0)
1977.99853516 [!] <FREE> (BUFFER: FFFFB5036AAAB000) (IDX: 33) (IQRL: 0)
2127.74389648 [!] <ALLOC> (BUFFER: FFFFB5036AAAB000) (CALLER: 0000000000101514) (PV: 0) (START: FFFFF8075559CFA0)
2127.76245117 [!] <FREE> (BUFFER: FFFFB5036AAAB000) (IDX: 34) (IQRL: 0)
2228.88964844 [!] <ALLOC> (BUFFER: FFFFB5036E7F2000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
2228.91699219 [!] <FREE> (BUFFER: FFFFB5036E7F2000) (IDX: 35) (IQRL: 0)
2230.83740234 [!] <ALLOC> (BUFFER: FFFFB5036EA29000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
2230.86010742 [!] <FREE> (BUFFER: FFFFB5036EA29000) (IDX: 36) (IQRL: 0)
2275.82666016 [!] <ALLOC> (BUFFER: FFFFB5036E9EE000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
2275.84399414 [!] <FREE> (BUFFER: FFFFB5036E9EE000) (IDX: 37) (IQRL: 0)
2280.82226563 [!] <ALLOC> (BUFFER: FFFFB5036E9EE000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
2280.84570313 [!] <FREE> (BUFFER: FFFFB5036E9EE000) (IDX: 38) (IQRL: 0)
2290.88281250 [!] <ALLOC> (BUFFER: FFFFB5036E9EE000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
2290.90014648 [!] <FREE> (BUFFER: FFFFB5036E9EE000) (IDX: 39) (IQRL: 0)
2585.81738281 [!] <ALLOC> (BUFFER: FFFFB5036E9EE000) (CALLER: 0000000000A7CAD4) (PV: 0) (START: FFFFF8075559CFA0)
2585.82812500 [!] <FREE> (BUFFER: FFFFB5036E9EE000) (IDX: 40) (IQRL: 0)
4527.77343750 [!] <ALLOC> (BUFFER: FFFFB5036E9EE000) (CALLER: 0000000000101514) (PV: 0) (START: FFFFF8075559CFA0)
4527.90234375 [!] <FREE> (BUFFER: FFFFB5036E9EE000) (IDX: 41) (IQRL: 0)
4799.58203125 [!] <ALLOC> (BUFFER: FFFFB50370A8A000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
4799.60449219 [!] <FREE> (BUFFER: FFFFB50370A8A000) (IDX: 42) (IQRL: 0)
4851.77734375 [!] <ALLOC> (BUFFER: FFFFB50370B17000) (CALLER: 00000000005EF7BC) (PV: 0) (START: FFFFF8075559CFA0)
4851.79687500 [!] <FREE> (BUFFER: FFFFB50370B17000) (IDX: 43) (IQRL: 0)
4885.99707031 [!] <ALLOC> (BUFFER: FFFFB50374648000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
4886.02099609 [!] <FREE> (BUFFER: FFFFB50374648000) (IDX: 44) (IQRL: 0)
4901.03710938 [!] <ALLOC> (BUFFER: FFFFB50374648000) (CALLER: 00000000005EF7BC) (PV: 0) (START: FFFFF8075559CFA0)
4901.05664063 [!] <FREE> (BUFFER: FFFFB50374648000) (IDX: 45) (IQRL: 0)
5085.52636719 [!] <ALLOC> (BUFFER: FFFFB50374617000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
5085.54785156 [!] <FREE> (BUFFER: FFFFB50374617000) (IDX: 46) (IQRL: 0)
5100.55175781 [!] <ALLOC> (BUFFER: FFFFB50374617000) (CALLER: 00000000005EF7BC) (PV: 0) (START: FFFFF8075559CFA0)
5100.56933594 [!] <FREE> (BUFFER: FFFFB50374617000) (IDX: 47) (IQRL: 0)
5343.82910156 [!] <ALLOC> (BUFFER: FFFFB50374617000) (CALLER: 00000000005EF7BC) (PV: 0) (START: FFFFF8075559CFA0)
5343.84667969 [!] <FREE> (BUFFER: FFFFB50374617000) (IDX: 48) (IQRL: 0)
5348.29443359 [!] <ALLOC> (BUFFER: FFFFB50374617000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
5348.31982422 [!] <FREE> (BUFFER: FFFFB50374617000) (IDX: 49) (IQRL: 0)
9327.91210938 [!] <ALLOC> (BUFFER: FFFFB503727E7000) (CALLER: 0000000000101514) (PV: 0) (START: FFFFF8075559CFA0)
9327.99609375 [!] <FREE> (BUFFER: FFFFB503727E7000) (IDX: 50) (IQRL: 0)
12538.43066406 [!] <ALLOC> (BUFFER: FFFFB503727E7000) (CALLER: 00000000005EF7BC) (PV: 1) (START: 00007FFD4D362630)
12538.45605469 [!] <FREE> (BUFFER: FFFFB503727E7000) (IDX: 51) (IQRL: 0)
12553.46386719 [!] <ALLOC> (BUFFER: FFFFB503727E7000) (CALLER: 00000000005EF7BC) (PV: 0) (START: FFFFF8075559CFA0)
12553.48339844 [!] <FREE> (BUFFER: FFFFB503727E7000) (IDX: 52) (IQRL: 0)
13447.64062500 [!] <ALLOC> (BUFFER: FFFFB503727E7000) (CALLER: 00000000005EF7BC) (PV: 0) (START: FFFFF8075559CFA0)
13447.65917969 [!] <FREE> (BUFFER: FFFFB503727E7000) (IDX: 53) (IQRL: 0)
PATCHED:https://www.unknowncheats.me/forum/3457323-post50.html
Sembra che EAC abbia modificato il proprio codice di importazione dinamica per rompere il metodo dopo aver visto questo thread.
Ora risolvono ExAllocatePoolWithTag una volta all'avvio con il vecchio metodo find-by-hash, ma viene memorizzato cifrato.
Poi, quando vogliono chiamarla, chiamano di nuovo la funzione di cifratura ma con il terzo parametro impostato a 0 invece di 1 per decifrare invece di cifrare.
Per riferimento, questo è come facevano prima: chiamavano semplicemente la funzione di risoluzione inline al primo tentativo di chiamata e poi memorizzavano nella cache il puntatore in chiaro per le chiamate future.
Conoscendo EAC, probabilmente potresti semplicemente chiamare import_cipher con il tuo indirizzo di hook e impostare l'ultimo parametro a 1 per bypassare ciecamente questo meccanismo.