PDA

View Full Version : Few confirmations please, corrupt Memory and unknown hook

.dm'TroY.
23rd November, 2006, 05:55 AM
[UTDCv18] +---------------------------------------------------+
[UTDCv18] Client have corrupt memory
[UTDCv18] Player name......: ***
[UTDCv18] Player IP........: ***
[UTDCv18] Client UT version: v.4.36
[UTDCv18] Client OS........: WindowsXP
[UTDCv18] Corruption hash..: F4416726C5C66FA19BEAC78DC546DCB1
[UTDCv18] Altered addresses: 77F7663C-25FF0008/1B80008,77F76640-5F0E001E/BA000001,
[UTDCv18] Date/Time........: 22-11-2006 / 21:07:14
[UTDCv18] +---------------------------------------------------+

[UTDCv18] +---------------------------------------------------+
[UTDCv18] Client have corrupt memory
[UTDCv18] Player name......: ***
[UTDCv18] Player IP........: ***
[UTDCv18] Client UT version: v.4.36
[UTDCv18] Client OS........: WindowsXP
[UTDCv18] Corruption hash..: DC75B03DA903207E6DC95FA15177C33C
[UTDCv18] Altered addresses: 7C90E88C-25FF9090/1B89090,7C90E890-5F0E001E/BA000001,
[UTDCv18] Date/Time........: 22-11-2006 / 21:05:55
[UTDCv18] +---------------------------------------------------+

[UTDCv18] +---------------------------------------------------+
[UTDCv18] Client have corrupt memory
[UTDCv18] Player name......: ***
[UTDCv18] Player IP........: ***
[UTDCv18] Client UT version: v.4.36
[UTDCv18] Client OS........: WindowsXP
[UTDCv18] Corruption hash..: DC1019A5C9E56B3C9A75C3CDF27FCB4B
[UTDCv18] Altered addresses: 7C931344-9FE85700/9E85700,7C931348-3BE16CED/3BFFFDC4,
[UTDCv18] Date/Time........: 22-11-2006 / 21:55:06
[UTDCv18] +---------------------------------------------------+

[UTDCv18] +---------------------------------------------------+
[UTDCv18] Client have hooked functions
[UTDCv18] Player Name......: ***
[UTDCv18] Player IP........: ***
[UTDCv18] Client UT Version: v.4.36
[UTDCv18] Client OS........: WindowsXP
[UTDCv18] Server Received..: Initial check
[UTDCv18] Altered addresses: 10B00000?10300000?10100000?NTST?
[UTDCv18] Hook Match.......: Unknown (Get confirmation at the UTDC forum)
[UTDCv18] Date/Time........: 14-11-2006 / 20:01:00
[UTDCv18] +---------------------------------------------------+
[UTDCv18] +---------------------------------------------------+
[UTDCv18] Additional memory scan information for player: ***/***
[UTDCv18] Corruption hash..: 4C4729EE357EC18F8A9B07949AFB8219
[UTDCv18] Altered addresses: 7C91D7D0-15E99090/35B89090,7C91D7D4-BA9372DE/BA000000,
7C91E448-65E99090/CDB89090,7C91E44C-BA9372D2/BA000000,
7C91E45C-E9909090/B8909090,7C91E460-9372D228/CE,
7C91E4F0-1DE99090/D5B89090,7C91E4F4-BA9372D1/BA000000,
7C91E7BC-72CFE7E9/F7B8,7C91E7C0-300BA93/300BA00,
7C91E838-C5E99090/FDB89090,7C91E83C-BA9372CE/BA000000,
7C91E84C-E9909090/B8909090,7C91E850-9372CE88/FE,
7C91E88C-C5E99090/1B89090,7C91E890-BA9372CE/BA000001,
7C91EA30-49E99090/15B89090,7C91EA34-BA9372CD/BA000001,
7C9261C8-29E99090/6C689090,7C9261CC-68937256/68000002,
7C927188-E9909090/68909090,7C92718C-93724640/C4,NSTC-72d11de9,
[UTDCv18] +---------------------------------------------------+


I think these are false, but confirmation would be fine. :)

thx
.dm'TroY.
23rd November, 2006, 03:17 PM
Ok, I saw the statement, that every altered address beginning with 7C is usually a false detection - so what about the first detection mentioned above? It's beginning with 77 which isn't that far away from 7C... :confused:
Sardukar
23rd November, 2006, 04:43 PM
The first 3 are false-catches, the last one I would wait for confirmation, parts of the hooked address seem familiar.
LeeBe
23rd November, 2006, 05:37 PM
Ok, I saw the statement, that every altered address beginning with 7C is usually a false detection - so what about the first detection mentioned above? It's beginning with 77 which isn't that far away from 7C... :confused:

only 'corrupt memory' kicks are false - 'hooked functions' kicks with 7C* could still be a cheat.
.dm'TroY.
1st December, 2006, 12:17 PM
*bump* :)
.dm'TroY.
3rd January, 2007, 09:13 PM
Any news? :X
Baiter
14th February, 2007, 07:45 PM
bump
A|ice
15th February, 2007, 10:17 PM
When those players join with the corrupt memory...are they all the same player? I'm wondering because I have a regular player and I was thinking of adding the hash to UTDC so it'll stop logging it. If I allow UTDC to kick (which was what I was going to do as soon as I get all my errors ironed out) I don't want this player kicked from my server.
Is that possible? They have the same corruption hash every time:
[UTDCv18] +---------------------------------------------------+
[UTDCv18] Client have corrupt memory
[UTDCv18] Player name......: XXXX
[UTDCv18] Player IP........: xx.xx.xx.xxx:2633
[UTDCv18] Client UT version: v.4.36
[UTDCv18] Client OS........: Windows98
[UTDCv18] Corruption hash..: DA621EAB5902A7D0B7A669CFA77E3994
[UTDCv18] Altered addresses: 7C900400-0/80CC4,7C900404-0/80CD0,7C900408-0/80CE2,7C90040C-0/80CF2,7C900410-0/80D04,7C900414-0/80D12,7C900418-0/80D20,7C90041C-0/80D3A,7C900420-0/80D4A,7C900424-0/80D68,7C900428-0/80D80,7C90042C-0/80D8E,7C900430-0/80DA4,7C900434-0/80DBC,7C900438-0/80DD2,7C90043C-0/80DEA,7C900440-0/80DF4,7C900444-0/80E0C,7C900448-0/80E16,7C90044C-0/80E32,7C900450-0/80E3C,7C900454-0/80E48,7C900458-0/80E52,7C90045C-0/80E64,7C900460-0/80E70,7C900464-0/80E7E,7C900468-0/80E8E,7C90046C-0/80E9C,7C900470-0/80EB4,7C900474-0/80ECC,7C900478-0/80EEC,7C90047C-0/80EF6,7C900480-0/80F16,7C900484-0/80F34,7C900488-0/80F48,7C90048C-0/80F68,7C900490-0/80F7C,7C900494-0/80FA0,7C900498-0/80FAA,7C90049C-0/80FB4,7C9004A0-0/80FC6,7C9004A4-0/80FD2,7C9004A8-0/80FEA,7C9004AC-0/81006,7C9004B0-0/81022,7C9004B4-0/81040,7C9004B8-0/81054,7C9004BC-0/8106C,7C9004C0-0/81080,7C9004C4-0/81094,7C9004C8-0/810B0,7C9004CC-0/810C6,7C9004D0-0/810D8,7C9004D4-0/810EE,7C9004D8-0/8110A,7C9004DC-0/81126,7C9004E0-0/81140,7C9004E4-0/8115E,7C9004E8-0/81168,7C9004EC-0/81178,7C9004F0-0/81186,7C9004F4-0/811A6,7C9004F8-0/811C4,7C9004FC-0/811DE,7C900500-0/811EE,7C900504-0/811FE,7C900508-0/8121C,7C90050C-0/81228,7C900510-0/81238,7C900514-0/8124A,7C900518-0/81264,7C90051C-0/81278,7C900520-0/81292,7C900524-0/812B0,7C900528-0/812CC,7C90052C-0/812E8,7C900530-0/8130C,7C900534-0/81324,7C900538-0/81334,7C90053C-0/8134A,7C900540-0/8136A,7C900544-0/81382,7C900548-0/81398,7C90054C-0/813A4,7C900550-0/813BC,7C900554-0/813CA,7C900558-0/813E6,
[UTDCv18] Date/Time........: 14-02-2007 / 11:41:12
[UTDCv18] +---------------------------------------------------+



A|ice
Baiter
16th February, 2007, 12:48 AM
How would you add the hash to UTDC to prevent kick in the first place?:confused:
oofki
16th February, 2007, 06:10 PM
Only thing you can do is disable memory scanning...