So take the least significant byte of each of these values and XOR them against the key to get the decoded string. The Fallout devs cleverly only use the least significant byte of each 4 byte wide value as a character in the string. This particular scan makes heavy use of string obfuscation.

EnumLibrariesTask is started the same way as the other two. Instead, the strings are stored in the clear, encoded, then decoded for comparison.Įnumerates modules in the game process and executable names of other processes and checks their names against a whitelist and blacklist of substrings. Get used to this, it happens a lot in the Fallout76 anti-cheat. Which is kind of weird to see in but whatever. That indirect call lands in a function that calls EnumWindow with the scanning callback. It's Way Too Easy to Cheat in 'Fallout 76'

On line 12 you can see the indirect call to the EnumWindowsTask object that leads to the actual scan. Each of the three primary anti-cheat scans are implemented as IOTasks, created, dispatched, and destructed with each iteration of the anti-cheat scanning loop. But if the new Battle Royale seems attractive to you here are a few easy and simple ways to get caught by their anti-cheat.

Fallout 76 anti cheat