CEVO Anti-Cheat Informations

[FaTaN]

CEVO uses their own anti-cheat, Paladin.

CEVO’s client will start a service under the name CelavimusClientHelper.exe and then it will map the anti-cheat module into the process.

How to evade a CEVO Ban:
CEVO uses Windows WMI to get information about system hardware.

1. • “InstallDate”,
   • “Version”,
   • “OSArchitecture”,
   • “OSLanguage”,
   • “Organization”,
   • “PAEEnabled”,
   • “Debug”,
   • “SerialNumber”,
   • “DataExecutionPrevention_32BitApplications”,
   • “DataExecutionPrevention_Available”,
   • “DataExecutionPrevention_Drivers”,
   • “DataExecutionPrevention_SupportPolicy”

You can use a tool known as Daz’s Windows Loader to generate a random Windows Serial Key which completely defeats the usefulness of this infromation.

1. • “Manufacturer”,
   • “Model”,
   • “Caption”,
   • “Product”,
   • “SerialNumber”

This information in many cases can be completely useless because plenty of companies don’t even set a Serial Number for the Motherboard.

1. • “IPAddress”,
   • “DefaultIPGateway”,
   • “DNSDomain”,
   • “DHCPEnabled”,
   • “MACAddress”,
   • “Caption”

A tool by the name Technitium MAC Address Changer can spoof this MAC address and changing your IP address and router MAC address will deal with this method as well.

Adam Spangler claims no bans are manual (by demo review, etc) and all are done by the anti-cheat.

Credits to Tristan.

 

[Admin]

The Anti Cheat module is also obfuscated with Confuser 1.9, public deobfuscators exist for it and it will give you a clean(er) DLL file.