From 50940e88c4cf44d9c85cf0124d1636cef1839858 Mon Sep 17 00:00:00 2001 From: Starz0r Date: Fri, 15 Nov 2024 03:42:22 -0600 Subject: [PATCH 1/3] Rules for Phanuel --- descriptions/AntiCheat.Phanuel.md | 1 + rules.ini | 3 +++ tests/types/AntiCheat.Phanuel.txt | 3 +++ tests/types/_NonMatchingTests.txt | 19 +++++++++++++++++++ 4 files changed, 26 insertions(+) create mode 100644 descriptions/AntiCheat.Phanuel.md create mode 100644 tests/types/AntiCheat.Phanuel.txt diff --git a/descriptions/AntiCheat.Phanuel.md b/descriptions/AntiCheat.Phanuel.md new file mode 100644 index 000000000..3cd8af1b1 --- /dev/null +++ b/descriptions/AntiCheat.Phanuel.md @@ -0,0 +1 @@ +**Phanuel** also known as NEAC Protect, is anti-cheating software created, developed, and maintained by NetEase. \ No newline at end of file diff --git a/rules.ini b/rules.ini index 270ad75c2..366605105 100644 --- a/rules.ini +++ b/rules.ini @@ -239,6 +239,9 @@ PunkBuster[] = (?:^|/)Punkbuster(?:$|/) Ricochet = (?:^|/)Randgrid\.sys$ TenProtect = (?:^|/)TP3Helper\.exe$ XIGNCODE3 = \.xem$ +Phanuel[] = (?:^|/)NeacInterface\.dll$ +Phanuel[] = (?:^|/)NeacSafe64\.sys$ +Phanuel[] = NeacClient\.exe$ [SDK] Adobe_Flash[] = (?:^|/)Flash[ _]?Player(?:$|/|\.) diff --git a/tests/types/AntiCheat.Phanuel.txt b/tests/types/AntiCheat.Phanuel.txt new file mode 100644 index 000000000..5500025d2 --- /dev/null +++ b/tests/types/AntiCheat.Phanuel.txt @@ -0,0 +1,3 @@ +NeacInterface.dll +NeacSafe64.sys +*NeacClient.exe \ No newline at end of file diff --git a/tests/types/_NonMatchingTests.txt b/tests/types/_NonMatchingTests.txt index 402122f83..fad30cd21 100644 --- a/tests/types/_NonMatchingTests.txt +++ b/tests/types/_NonMatchingTests.txt @@ -1345,3 +1345,22 @@ odin_dll libodin_so notodin.dll notlibodin.so +NeacInterface +NeacInterface_dll +notactuallyNeacInterface.dll +NeacInterface.dllwhoops +sub/dir/notactuallyNeacInterface.dll +sub/dir/NeacInterface.dllwhoops +NeacSafe64 +NeacSafe64_sys +notactuallyNeacSafe64.sys +NeacSafe64.syswhoops +sub/dir/notactuallyNeacSafe64.sys +sub/dir/NeacSafe64.syswhoops +NeacClient +NeacClient_exe +NeacClient.exewhoops +sub/dir/NeacClient.exewhoops +NeacClient.exe/sub/dir +NeacClient_exe/sub/dir +NeacClient_exenope/sub/dir \ No newline at end of file From 403f4ff9c4929e7dd3656820d54f795212fe7214 Mon Sep 17 00:00:00 2001 From: Starz0r Date: Fri, 15 Nov 2024 03:48:20 -0600 Subject: [PATCH 2/3] Move Phanuel Rules to before PunkBuster --- rules.ini | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rules.ini b/rules.ini index 366605105..9ecb28366 100644 --- a/rules.ini +++ b/rules.ini @@ -233,15 +233,15 @@ EQU8 = (?:^|/)equ8_conf\.json$ FredaikisAntiCheat = (?:^|/)FredaikisAntiCheat/ HackShield = (?:^|/)HShield/HSInst\.dll$ nProtect_GameGuard = (?:^|/)gameguard\.des$ +Phanuel[] = (?:^|/)NeacInterface\.dll$ +Phanuel[] = (?:^|/)NeacSafe64\.sys$ +Phanuel[] = NeacClient\.exe$ PunkBuster[] = (?:^|/)(?:PnkBstrA|pbsvc)\.exe$ PunkBuster[] = (?:^|/)pbsv\.dll$ PunkBuster[] = (?:^|/)Punkbuster(?:$|/) Ricochet = (?:^|/)Randgrid\.sys$ TenProtect = (?:^|/)TP3Helper\.exe$ XIGNCODE3 = \.xem$ -Phanuel[] = (?:^|/)NeacInterface\.dll$ -Phanuel[] = (?:^|/)NeacSafe64\.sys$ -Phanuel[] = NeacClient\.exe$ [SDK] Adobe_Flash[] = (?:^|/)Flash[ _]?Player(?:$|/|\.) From 166e3c4394279e4b10884048ded986beec4ad0cc Mon Sep 17 00:00:00 2001 From: Starz0r Date: Sat, 16 Nov 2024 13:07:40 -0600 Subject: [PATCH 3/3] Reduce Phanuel's overall scope --- rules.ini | 4 +--- tests/types/AntiCheat.Phanuel.txt | 4 +--- tests/types/_NonMatchingTests.txt | 15 +-------------- 3 files changed, 3 insertions(+), 20 deletions(-) diff --git a/rules.ini b/rules.ini index 9ecb28366..db33f2650 100644 --- a/rules.ini +++ b/rules.ini @@ -233,9 +233,7 @@ EQU8 = (?:^|/)equ8_conf\.json$ FredaikisAntiCheat = (?:^|/)FredaikisAntiCheat/ HackShield = (?:^|/)HShield/HSInst\.dll$ nProtect_GameGuard = (?:^|/)gameguard\.des$ -Phanuel[] = (?:^|/)NeacInterface\.dll$ -Phanuel[] = (?:^|/)NeacSafe64\.sys$ -Phanuel[] = NeacClient\.exe$ +Phanuel = (?:^|/)NeacSafe64\.sys$ PunkBuster[] = (?:^|/)(?:PnkBstrA|pbsvc)\.exe$ PunkBuster[] = (?:^|/)pbsv\.dll$ PunkBuster[] = (?:^|/)Punkbuster(?:$|/) diff --git a/tests/types/AntiCheat.Phanuel.txt b/tests/types/AntiCheat.Phanuel.txt index 5500025d2..3d5bbaaa0 100644 --- a/tests/types/AntiCheat.Phanuel.txt +++ b/tests/types/AntiCheat.Phanuel.txt @@ -1,3 +1 @@ -NeacInterface.dll -NeacSafe64.sys -*NeacClient.exe \ No newline at end of file +NeacSafe64.sys \ No newline at end of file diff --git a/tests/types/_NonMatchingTests.txt b/tests/types/_NonMatchingTests.txt index fad30cd21..b5d590957 100644 --- a/tests/types/_NonMatchingTests.txt +++ b/tests/types/_NonMatchingTests.txt @@ -1345,22 +1345,9 @@ odin_dll libodin_so notodin.dll notlibodin.so -NeacInterface -NeacInterface_dll -notactuallyNeacInterface.dll -NeacInterface.dllwhoops -sub/dir/notactuallyNeacInterface.dll -sub/dir/NeacInterface.dllwhoops NeacSafe64 NeacSafe64_sys notactuallyNeacSafe64.sys NeacSafe64.syswhoops sub/dir/notactuallyNeacSafe64.sys -sub/dir/NeacSafe64.syswhoops -NeacClient -NeacClient_exe -NeacClient.exewhoops -sub/dir/NeacClient.exewhoops -NeacClient.exe/sub/dir -NeacClient_exe/sub/dir -NeacClient_exenope/sub/dir \ No newline at end of file +sub/dir/NeacSafe64.syswhoops \ No newline at end of file