//-/~ NOTE BY PARADOX:
-- Reversed engineered Garry's Mod anti-cheat system.
-- Circa 2013~


  _____            _               _____                   
 / ____|          | |             / ____|                  
| |  __  ___ _ __ | |_ ___   ___ | |  __  __ _ _ __   __ _ 
| | |_ |/ _ \ '_ \| __/ _ \ / _ \| | |_ |/ _` | '_ \ / _` |
| |__| |  __/ | | | || (_) | (_) | |__| | (_| | | | | (_| |
 \_____|\___|_| |_|\__\___/ \___/ \_____|\__,_|_| |_|\__, |
                                                      __/ |
                                                     |___/ 
------------------------------------------------

Patched server.dll which will let you play on singleplayer once again if banned: http://www.sendspace.com/file/urp5ge
Place in: GarrysMod/garrysmod/bin

-------------------------------------------------

Module: server.dll (Serverside)
Uses: engine::ServerCommand or similar
In function: PlayerAuthed

Check [1]:
String: ASCII "kickid %d "cheating previously"

Check [2]:
String: ASCII "kickid %d "globally banned for cheating (%s)"


Starting Signature: "\xE8\x00\x00\x00\x00\x83\xC4\x10\x85\xC0\x74\x4D\x57\x53\x8D\x8E\x00\x00\x00\x00\x51\x8D\x55\xFC\x68\x00\x00\x00\x00\x52"
Offset: "x????xxxxxxxxxxx????xxxxx????x"

Function that determines if you're a cheater (Possibly incorrect):
"\xE8\x00\x00\x00\x00\x83\xC4\x10\x85\xC0\x75\x4D\x57"
"x????xxxxxxxx"

Check [1]:
5F2B8954   E8 F7E9FFFF      CALL server.5F2B7350
5F2B8959   83C4 10          ADD ESP,10
5F2B895C   85C0             TEST EAX,EAX
5F2B895E   75 4D            JNZ SHORT server.5F2B89AD
5F2B8960   57               PUSH EDI
5F2B8961   53               PUSH EBX
5F2B8962   8D8E 54200000    LEA ECX,DWORD PTR DS:[ESI+2054]
5F2B8968   51               PUSH ECX
...
5F2B8989   8BCE             MOV ECX,ESI
5F2B898B   E8 A0EDD5FF      CALL server.5F017730
5F2B8990   50               PUSH EAX
5F2B8991   68 B49A685F      PUSH server.5F689AB4                     ; ASCII "kickid %d "cheating previously"
5F2B8996   E8 8578FBFF      CALL server.5F270220

Check [2]:
5F2B89CE   E8 CDE9FFFF      CALL server.5F2B73A0
5F2B89D3   8BF8             MOV EDI,EAX
5F2B89D5   83C4 10          ADD ESP,10
5F2B89D8   85FF             TEST EDI,EDI
5F2B89DA   75 58            JNZ SHORT server.5F2B8A34
...
5F2B8A18   68 4C9A685F      PUSH server.5F689A4C                     ; ASCII "kickid %d "globally banned for cheating (%s)"
"
5F2B8A1D   E8 FE77FBFF      CALL server.5F270220
5F2B8A22   8B0D 3C698A5F    MOV ECX,DWORD PTR DS:[5F8A693C]          ; engine.624BA3DC
5F2B8A28   8B93 90000000    MOV EDX,DWORD PTR DS:[EBX+90]

To bypass this (Serverside/Will only work on LAN/Singleplayer/Listen Server):
Just patch all of the \x74 (JE) instructions to \x75 (JNE).
Conditional Jumps -> {
/*
Coded in browser, probably has errors.
*/

unsigned char JNE = 0x75;

GetModuleHandle("server.dll") + 0x895E;
GetModuleHandle("server.dll") + 0x89B2;
GetModuleHandle("server.dll") + 0x89DA;
GetModuleHandle("server.dll") + 0x8938;

}

Or modify the string from "kickid" to "echo  ".

Hex Editor -> GarrysMod/garrysmod/bin/server.dll -> {
Search for bytes: 6B 69 63 6B 69 64 20 25 64 20 22 67 6C 6F 62 61 6C 6C 79 20 62 61 6E 6E 65 64 20 66 6F 72 20 63 68 65 61 74 69 6E 67 20 28 25 73 29 22
Replace "kickid" with "echo  "

Search for bytes: 6B 69 63 6B 69 64 20 25 64 20 22 63 68 65 61 74 69 6E 67 20 70 72 65 76 69 6F 75 73 6C 79 22
Replace "kickid" with "echo  "
}