0

I've been playing a game that has an HWID limit and a bunch of other limitations, such as:

a) Cannot be ran in a VM b) Cannot be ran using Sandboxie and other Sandbox environments c) Limits 3 Instances of the game per computer d) Limits 6 Instances per IP

All of these limitations come from a dll that is injected to the process, since this DLL acts also as a handshake for the gameserver, I cannot eject it.

[a) and b) bypass] - Done I was able to bypass a) and b) by using Detours.dll and hooking the VM/Sandbox checks by intercepting the necessary functions for it to work properly.

[d) bypass] - Done Socks 5 Proxy works just fine, so no issues there.

[c) wut?] - What trickery is this?

Now, I want to run more than 3 instances of the Game, without getting the message (Hardware Limit Max bla bla bla).

I've noticed that, if I try to spoof common identifiers such as: MAC ADDRESS, HDD SERIAL, CPU SERIAL and others, it simply does not work, it keeps detecting me. It is not getting the HWID Limitation from there.

I've created a Virtual Machine, and there, I can run 3 instances of the game just fine. So I created a bunch of VM's, each one running 3 instances of the game. No big deal. But I want to open all instances in a single VM.

I've moved my VM's to a different location, and I kept a copy of ONE of these VM's @ my own computer, so I can test out how to bypass this limitation.

So I open this VM Image@My Computer [Remember, I have a copy @ the cloud running 3 instances of the game] And guess what, 0 Instances of the game opened on my LOCAL VM copy, when I try to open the first instance of the game, I get the HWID error. Ofcourse it is registering something from my VM on their servers, as mentioned above, it is not MAC, or HDD Serial or something else.

Doesn't matter what I spoof on this VM, I still get the Hardware Limit reached message, if I go to my VPS who has a clone of this VM and close one instance of the game, I can then open one instance of the game on my VM Copy running @ my home's PC.

The only thing that works is: If you create a new Windows User on this Machine, you'll be able to open 3 instances without a problem. So this DLL is actually getting information from the current logged user. This is a domain I know very little and is not so well documented by Microsoft.

It's "weakpoint" is the newly created user: I've tried search the registry and used various tools to see the API Calls, File Calls, Registry and I couldn't find anything.

I've trying changing the user SID and I still getting the same message.

WISNTA

So my question actually is now HOW TO DO IT, but WHAT to check. What are the Unique Identifiers for a User in a Windows Environment?

We have SID, Username, what else? The DLL makes use of WINSTA.dll which holds some 'session' information, I was able to hook it, but with no success on spoofing the calls.

Suspicious imports are:

"C:\Windows\SysWOW64\dhcpcsvc.dll" "C:\Windows\SysWOW64\sspicli.dll" "C:\Windows\SysWOW64\winsta.dll" "C:\Windows\SysWOW64\wtsapi32.dll"

-1

Well.. if a new user works, that is to say any other user works (whether new or not) right ?

If so they could simply be counting the number of processes, window (handles), files written/logged.. There are many ways to go about this. Basically any form of data that is not shared among users could work.

Your probably just better off tracing from the error message, and just go backwards from there, than blindly testing each api.

5
  • Yeah, any user will work, but it has a trick to detect if multiple users are logged in. It is indeed user specific data, number of processes I doubt, it is some sort of session I guess? But it is not the User SID.
    – layer07
    Aug 30 at 7:31
  • While this is sensible advice, it's not really an answer. More like commentary ...
    – 0xC0000022L
    Aug 30 at 9:22
  • Your scope is still too wide - I do think it is more likely one of the ones I've mentioned above, at least based on what I've seen in the past (although limited by the information you provide). My suggestion is still the same - are you able to debug, breakpoint and trace the error message? Are you able to perform static analysis using tools like ida? This is a much easier way to identify the checking mechanism, rather than simply guessing the API call. If you are able to perform either, I can probably provide more guidance on how to go about reversing it, rather than me trying to guess an API.
    – Niraeth
    Aug 30 at 11:59
  • The Hardware Check is done 'remotely', so I only get an error message saying I've reached the MAX_LIMIT (3 connections per computer). So the "HWID Limit DLL" grabs my 'UID' from the current 'windows session', sends to their server and stores it there, as long as a socket conn is active, the user session is on 'hold'. As I've said, if I send you a clone of this VM, and you try to open the game @ your house, you'll get the same error (HWID LIMIT 3). I'll have to shut down the original VM to 'free' a 'HWID' slot for that "User". Logging at a different windows user solves the issue;
    – layer07
    Aug 31 at 9:02
  • Technically SIDs are supposed to be unique per machine. Meaning this info alone could be sufficient. Holds true for the user which itself is relative to the machine's SID (or a domain SID if that's where the user account lives). A count of sorts could be achieved by a semaphore in the local or global namespace. Global requires elevation (or the assistance of a privileged service, for example). Windows itself stores some sort of hardware ID in the registry, so theoretically a third party software could also use that.
    – 0xC0000022L
    Sep 29 at 8:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.