Poker-AI.org

I want to talk about PS.log.0 and how to use stealth with it.

In the P****S****.log.0 I saw some parameters that should be changed, to avoid detection.

I was researching and the mac address can be changed using a 3d party app or changing the windows registry.

But does the same happen with SYSVOL and GUID?
What is GUID? Is it generated by PS? or is it generated by Windows? Is it in the registry too?
http://www.webopedia.com/TERM/G/GUID.html

I think SYSVOL can be changed from the registry too:
http://itcontractors.org/content/view/245/37/

An example:

Fix Permissions Script
========= Mac OS X 10.8.2 (Intel MacPro5,1 - 2147Mhz - 8192MB) Client PokerStars - 6597 ( Dec 24 2012 )
setting locale to 0...
loaded 182740 localized messages
TransportThread::run() - Starting
_createTransport:
Started Local thread #0 - type 'replay'
Sending CREATESERVER msg to local thread #0
LocalThread[ 0 ]: Creating Server 'replayInstance'
_CommRWAcceptThreadUnix: listen( 25 )
HandReplayServer v1.0.0.0, protocol v0.1.32
CommRoutingTable: server object 'replayInstance' registered
LocalThread[ 0 ]: ServerObject 'replayInstance' created in slot 0
LocalThread[ 0 ]: ServerObject( 0 ) registered
CommServerConnectionPool: _COMM_MSGTYPE_PHYSICAL_CONNECT
GUID 71000671007600747003700170077106
SYSVOL 5A952C8988E9
MAC 002500ef0880
layout on all monitors
layout management disabled
Animation mode: 2 Zoom animation mode: 0
Auto-rebuy 0 (0,0 - 0,0)
Auto-rebuy 1 (0,0 - 0,0)
soundOn
CashInBonusParam::clear called
LobbyHelperConnection::connect
LobbyServerConnection::connect
CommIdMap: 1/2 capacity limit exceeded - rehashing
CommIdMap: rehash completed
CommIdMap: 1/2 capacity limit exceeded - rehashing
CommIdMap: rehash completed
[2012/12/30 17:09:23]

This data is not mine, I found it on the internet: http://pastie.org/pastes/5599558

So the normal way to do something similar is using Virtual Machines, right?

I'd like to avoid using VMs in order to look less suspicious for PS.

Because I imagine that they can know that the client is being executed from a VM.

Am I right?

yes

And how can you hide the fact that the client room is being executed in a VM? or it isn't necessary, is it?

I think no poker room is going to ban you because you are executing the client in a VM, they can just suspect.
Although they can ban you whenever they want without a big justification.

Is there any thread in the archived forum that talks about it?

You'd have to modify the client or the system functions it calls: ie hooks, trampolines, rootkits, code injection etc

Yes, just one of many flags that will arouse suspicion.


There are lots. Google site:poker-ai.org vm