Sicheats (h4x0r) trainers now contain DRM but why?

[darkedone02]

What a "guild" war we have here in one "hub", battling each other like a cold war, showing both "fakes" and "real" "Products" to see which one is better then the other, perhaps? Deception is always on the shadows, but some are caught by the "hub polices", penalizing both the "Agent" and the "Trader". The End is still yet undetermined, will one win "support" or will the "hub" barred the "Traders" from the "hub"?

[dabhandisback]

i didnt plan a comeback but i cant stand the major stupidity here anymore. joe, you wanted an actual, verifiable proof? here is one for you. http://www.megaupload.com/?d=S1SQP6BC.

this is the fear3 trainer i downloaded from sicheats an hour ago. when it exits it leaves a background process called "chsuxx.exe" behind which searches for executables on c: containing "cheathappens" and changes their "This program cannot be run in DOS mode." stub to "Cheathappens sucks!!!". you can clearly see the code responsible for this starting at offset 000782be in the main executable. btw both the exe and the dll already have the stub replaced. how pathetic.

i also found the "llsass" string Traziz referred to in the dll. how you joe managed to miss it i have no idea. well, on a second though i actually do.

i havent found the other references _yet_ but its only a matter of time and my mates here at ch are also working on it. you can ban me and you can delete this post if you like but the truth is already out there. bad luck for you i guess...

[Joe Forster/STA]

DABhand, you've been banned for a reason back then so don't bother to come back. I won't waste my time with checking out anything that you provide, because I know for sure it's just some kind of fake shit, so whatever you uploaded, I don't care about it. Now, away with you but the post stays as a memento for your stupidity!

[cocodrilo.]

dabhand you are liar. this is not real sicheats trainer, you modified it. nothing more to say.

[Geri]

Originally Posted by dabhandisback

i didnt plan a comeback but i cant stand the major stupidity here anymore. joe, you wanted an actual, verifiable proof? here is one for you. http://www.megaupload.com/?d=S1SQP6BC.

this is the fear3 trainer i downloaded from sicheats an hour ago. when it exits it leaves a background process called "chsuxx.exe" behind which searches for executables on c: containing "cheathappens" and changes their "This program cannot be run in DOS mode." stub to "Cheathappens sucks!!!". you can clearly see the code responsible for this starting at offset 000782be in the main executable. btw both the exe and the dll already have the stub replaced. how pathetic.

i also found the "llsass" string Traziz referred to in the dll. how you joe managed to miss it i have no idea. well, on a second though i actually do.

i havent found the other references _yet_ but its only a matter of time and my mates here at ch are also working on it. you can ban me and you can delete this post if you like but the truth is already out there. bad luck for you i guess...

I rarely visit this forum at all but today I have checked on this and this topic is the most epic conspiracy ever.

1. Traziz is an idiot, there is no LLSASS reference at all and on the address that he said, there is an LSASS reference. Nothing is wrong with that. The dbghelp.dll file is needed because the old file in XP is not working with some games and it would shut down the trainer immediately.

2. There is nothing running in the background, doing anything with CH trainers. Complete bullshit.

And then, when you would think ok, it is done, it is a lie and end of the story, here is this post from dabhandisback which is full of fake info, not to mention that the uploaded file is not even the trainer. Haha. Is he related to CH at all or just a random troll? Why would CH post obviously fake info about something when this just makes them even more suspicious?

Like a professional drama, full of twists, lies, evil mischiefs everywhere. I hope this is the kind of drama where everyone dies at the end (go Hamlet go!).

[Ronburi]

whats funny is that there is a nice big notice on h4x0r's website that says:

"Hi SiCheats Members!

We Recommend downloading Trainers only on our Site.If you Download Our Trainer on other Sites and you have Problems with one of our Trainer we not Support this.

Download our Trainer on other Sites can be not good.

Downloading our Trainer on other Sites can be have a contain troyans, virus, keyloggers or others."

So h4x0r is basically telling people not to download his trainers from GCW or anywhere else, yet GCW continues to post them despite this AND the new DRM. That's some major h4x0r love right there.

[Joe Forster/STA]

Originally Posted by Ronburi

So h4x0r is basically telling people not to download his trainers from GCW or anywhere else

That he personally uploads his trainers to GCW is probably something he forgot (to add).

Originally Posted by Ronburi

yet GCW continues to post them despite this AND the new DRM. That's some major h4x0r love right there.

Which word of "Empire has a real life and is away from the forum for sometimes even days" don't you understand? He'll make his choice and announce it whenever he has time to. We, moderators, have no access to the machinery behind either GCW or this forum so we can only make guesses and give him suggestions, nothing more.

Originally Posted by Geri

And then, when you would think ok, it is done, it is a lie and end of the story, here is this post from dabhandisback which is full of fake info, not to mention that the uploaded file is not even the trainer.

I'm sorry but I'm not willing to even download that shit he uploaded. Would you care to give some more explanation about why the info is fake and how come the upload is not the trainer? Thanks!

[...] I just found out that there's a moderator on Cheathappens' forum called Neo7 who has the very same signature ("A Limited-area amalgamated alternate timespace with non-corrosive tendencies is independently occurring in restricted mode within this room.") as Desu[Shield] in this thread. This cannot be a coincidence so the two persons must be the same, which makes Desu[Shield]'s neutrality in this matter questionable, to put it very mildly. You can check out this thread at the Cheathappens forum: http://www.cheathappens.com/show_boa...&titleID=14183 . And, by the way, can you notice the complete lack of concrete information about how h4x0r's trainers are supposed to execute this or that malicious operation, if there's any at all?

[Desu[Shield]]

I never suggested that I was going to analyze such a file. I'm a web developer, not a trainer developer. Though thanks for the accusation like tone, really appreciate it. Though if you were actually paying attention to posts as you should as a moderator, you would've seen crocodrilo addressed me by my name and I never denied it in this thread (and even offered an explaination for this name which I'll do in full detail in the paragraph below).

Desu[Shield] is one of the handles I use in the game StarCraft Brood War. It came after I used to hang out in the Korean semi-pro clan Shield where I was given a test game after which I was allowed to be part of Shield.

Attention to detail is fine-tuned in all the wrong places eh? BTW the quote comes from the Haruhi anime and is a rather popular one.

[Geri]

Would you care to give some more explanation about why the info is fake and how come the upload is not the trainer?

The uploaded file is:
NVIDIA Control Panel Application, 3.6.750.0

It really is. It is just renamed to F.E.A.R. 3 v15.20.0992 + 10 Trainer.exe
Since I didn't notice that h4x0r is disguising his trainers as NVIDIA control panels and changing the brightness or gamma cannot be considered as a real cheat, I assume this has nothing to do with a trainer.
From that point, it is not hard to assume that the whole post is random trolling. Of course I didn't bother to see if this fake file is really doing anything with anything as it is not relevant anymore.

Besides, the h4x0r trainers did not contain the LLSASS reference (as it was to be expected) and they do nothing with CH files. I copied some older free CH trainer files to C:\, copied them next to the h4x0r trainer, I was also running the h4x0r trainer and the CH trainer at the same time, but nothing happened at all. And obviously, there is no "chsuxx.exe" and the "This program cannot be run in DOS mode." stub in the trainers are unchanged (as the whole file is also unchanged).

So dabhandisback is trolling with you, haha. His file is obviously not containing any evidence and the original trainer is not doing anything at all. And when I say nothing at all, I mean including that the v16 trainer is not running without authentication and if I close the program, I get an error message... (Division by zero) and I have to shut down the shit from the task manager. It is not malicious, but wtf? You can consider this as a bugreport.

I myself came to the conclusion that this whole topic is just plain trolling and whoever started these accusation are h4x0r haters. I don't have a clue about who is dabhandisback (I don't even know the real DABHand) but I remember that Caliber has mentioned this FEAR3 thing too, so I assume the trolls are CH agents.

I wouldn't trust any of these guys as the war has raged for so long, I am surprised that "weapons of mass destruction" were not included so far. I would say give them 1 nuke per faction and see which faction is firing it first.

Unless someone can point out where are these malicious codes in the ORIGINAL trainer that I have, I say this is +1 for h4x0r in the scoring. No. Sorry. It is not +1 for h4x0r because he has done nothing to gain that point. It is better to say h4x0r unchanged, -1 for CH for the lies. As for what are the current scores, I don't have a fuckin clue because this is the first time that I have ever bothered to look into such shit at all. I believe they have all lost any credit that they had in the past with their actions.

War... war never changes.

[Joe Forster/STA]

Geri, thanks for your analyzation report, I'll, perhaps, download and check out that file myself later. In hte meantime, Maxgrilo, tazzoun, cocodrilo, any comments on Geri's results? Is dabhandisback's upload anything similar to what you reported? (Well, it's too late to ask Traziz, I guess. )

Originally Posted by Desu[Shield]

Though thanks for the accusation like tone, really appreciate it.

For me, the timing and this weird signature, that I've never seen before, makes it very unlikely that you're a person different than Neo7, a moderator on Cheathappens forum. On the other hand, I also find it strange that someone who wants to remain incognito would be stupid enough to use his signature on this forum, too, but, you see, if you've lived through the Cheathappens vs. h4x0r war like we, FileForums staff, did then you'd know that no level of paranoia is insane in this case. That you fell prey to this accusation is unfortunate but people need to know about everything so that they can make their own deductions/decisions with the greatest amount of verifiable (!) information possible.

Apparently, those people who have registered on our forum a few days/weeks ago can be anyone, I repeat, anyone: Cheathappens staff and agents, Sicheats staff and agents who do speak English properly, even the president of BSA one of whose favorite passtimes is stirring shit on forums he doesn't like. Do you understand this? Haven't you seen forums without any kind of moderation where there's less and less discussion that is more than plain flame wars, which contain not much more than name-calling and quasi-arguments from the whole family of "argumentum ad [...]" (ad verecundiam, ad hominem, you name it), and not only you have no idea who these people, flaming each other, really are but there are rumors around that some forum members are, actually, staff who stir shit intentionally to keep the "discussion" alive, attract visitors and make money via advertisements?

Without a background on this forum that would've shown a deeper insight into their personality, beliefs, expertise etc., there's absolutely no way of telling whether or not people really are who they say they are. (At least, I know that I am who I say I am and there surely are people who know that I usually think before I speak because I have a decade of history on this forum as a verifiable (!) proof.) Is that insane paranoia? Oh, yeah, in most cases but not related to this topic! I understand that people don't understand this paranoia, because they never experienced such a situation, but, then again, it's their problem, not ours.

I admit, the worst part in all this is that you can hardly show anything that would undeniably (!) prove that you're not the same person as Neo7 on the Cheathappens forum. Well, this is an inherent major problem with new forum members and whatever you achieved on some other forum does not have much weight, if any at all, as that person on that other forum may or may not also be you. And, sorry, I have no software that would analyze posts and show how likely it is that the two persons are the same, according to their style, wording, grammar, punctuation etc.

You know, some of the greatest differences between Cheathappens and us is that 1) we don't troll on their forum and 2) we don't ban on sight people who have different ideas or who complain about what we do (if they have sensible arguments, that is!!!). They do both. Along these lines, I'm willing to believe that you are who you say you are (and are not). Any comments on this above?

[TwwIX]

Originally Posted by cocodrilo

know and understand you, if you can give us a better solution to verify that the trainers are downloaded from secure sites I am willing to listen.

I download your trainers directly from your site. Are you telling me that those uploads aren't secure?

If you are referring to websites like this, then it's simple. The people who are running this site need to stop allowing everybody and their grandmother to upload stuff to this site. If you are not an actual content provider, you should not be allowed to upload anything at all.

[Joe Forster/STA]

Originally Posted by TwwIX

The people who are running this site need to stop allowing everybody and their grandmother to upload stuff to this site.

Which word of "Empire personally checks h4x0r's trainers, accepting them only from him" don't you understand?

Originally Posted by TwwIX

If you are not an actual content provider, you should not be allowed to upload anything at all.

I see. And how exactly do you suggest to solve in general the task of checking whether the uploader is also the author of whatever he uploads? What is your suggestion about handling in the future the current situation when (supposedly) benevolent people upload all kinds of good trainers they found on their favorite trainer sites? Furthermore, should this be generalized to all kinds of uploads? If so, how are we supposed to ask all cracker groups to, please, upload their own cracks themselves?

Or you're just blabbering without any prior consideration of further details...?

[Geri]

Geri, thanks for your analyzation report, I'll, perhaps, download and check out that file myself later.

There is no need to say thanks because I have looked into it only to form my own opinion, not to help out any factions in their battle. I still say people should form their own opinion and take a look for it themselves. It wasn't an analyzation report, just sharing what do I think about the whole mess. I will trust no one in this matter just my own observations.

[cocodrilo]

So h4x0r is basically telling people not to download his trainers from GCW or anywhere else, yet GCW continues to post them despite this AND the new DRM. That's some major h4x0r love right there.

GCW is a secure site, read entire thread GCW uploads te same file of sicheats .

[Phucker]

This is DAB, I can tell you right now I don't know who that is up there or why they used my name.

But I will find out.

I must admit that other guy made some interesting points, what is with that www.uploading.com addy? And why is there registry API's being called from the trainer?

I dunno why Jose has gone to lengths to have a DRM, seems strange, he isn't selling anything, he isn't going to pre anything (wouldn't get pre'd with DRM involved anyway), not much to protect from, just going to annoy people with having to do multiple steps to run a free trainer.

But anyways, again dunno who that was trying to be me, hopefully it aint you Joe as that would be kinda childish to do so.

As for coming back here to kick up a fuss, wouldn't waste my time to be honest, I talked to TippeX when he PM'd me (well I think it was TippeX) and he knows what I said to him. And I am sure he can assure you that I was in a "Can't be arsed" mood.

Like I said to him I am sure Jose isn't stealing code anymore since he seems to have a following I think that may possibly do it for him now, you can only go so far with pointers you know, but he is digging his own grave with those over bloated all over the crap built trainers. But that is his decision.

Also as for your "attack" Joe when you thought whoever that was who used my name was me, just remember your nothing special either, just because your on a warez "email list from last century" and did a few apps does not make you any better than anyone else. Remember that.