I've been playing a game that has an HWID limit and a bunch of other limitations, such as:
a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 Instances of the game per computer d) Limits 6 Instances per IP
All of these limitations come from a dll that is injected to the process, since this DLL acts also as a handshake for the gameserver, I cannot eject it.
[a) and b) bypass] - Done I was able to bypass a) and b) by using Detours.dll and hooking the VM/Sandbox checks by intercepting the necessary functions for it to work properly.
[d) bypass] - Done Socks 5 Proxy works just fine, so no issues there.
[c) wut?] - What trickery is this?
Now, I want to run more than 3 instances of the Game, without getting the message (Hardware Limit Max bla bla bla).
I've noticed that, if I try to spoof common identifiers such as: MAC ADDRESS, HDD SERIAL, CPU SERIAL and others, it simply does not work, it keeps detecting me. It is not getting the HWID Limitation from there.
I've created a Virtual Machine, and there, I can run 3 instances of the game just fine. So I created a bunch of VM's, each one running 3 instances of the game. No big deal. But I want to open all instances in a single VM.
I've moved my VM's to a different location, and I kept a copy of ONE of these VM's @ my own computer, so I can test out how to bypass this limitation.
So I open this VM Image@My Computer [Remember, I have a copy @ the cloud running 3 instances of the game] And guess what, 0 Instances of the game opened on my LOCAL VM copy, when I try to open the first instance of the game, I get the HWID error. Ofcourse it is registering something from my VM on their servers, as mentioned above, it is not MAC, or HDD Serial or something else.
Doesn't matter what I spoof on this VM, I still get the Hardware Limit reached message, if I go to my VPS who has a clone of this VM and close one instance of the game, I can then open one instance of the game on my VM Copy running @ my home's PC.
The only thing that works is: If you create a new Windows User on this Machine, you'll be able to open 3 instances without a problem. So this DLL is actually getting information from the current logged user. This is a domain I know very little and is not so well documented by Microsoft.
It's "weakpoint" is the newly created user: I've tried search the registry and used various tools to see the API Calls, File Calls, Registry and I couldn't find anything.
I've trying changing the user SID and I still getting the same message.
So my question actually is now HOW TO DO IT, but WHAT to check. What are the Unique Identifiers for a User in a Windows Environment?
We have SID, Username, what else? The DLL makes use of WINSTA.dll which holds some 'session' information, I was able to hook it, but with no success on spoofing the calls.
Suspicious imports are:
"C:\Windows\SysWOW64\dhcpcsvc.dll" "C:\Windows\SysWOW64\sspicli.dll" "C:\Windows\SysWOW64\winsta.dll" "C:\Windows\SysWOW64\wtsapi32.dll"
