What I don't understand is why the cheats can't just prevent the shellcode from running, or preempting the exception handler from being called by installing their own. Is spoofing the return of NtQueryVirtualMemory not possible, either?
[deleted]
How anti-cheats catch cheaters using memory heuristics
21–30 of 148 posts
Re: How anti-cheats catch cheaters using memory heuristics
#22Serious question for you gamers out there: Why would a person go to such great lengths to cheat at a video game? Is there a monetary incentive? Otherwise, it seems like a lot of effort just to increase one's standing on a leader board.
As someone who likes to cheat at single player video games, the cheating itself is a lot of fun (at least it was until I started doing reverse engineering professionally; now it just feels like work). My sense of the multiplayer cheating scene (which I never looked at closely) is that most of the cheaters use tools developed by others. So, it seems possible that the people doing the bulk of the work are motivated in…
I see a weird side of it since I'm a big fan of a hong kong pubg game called hopelessland oUT of hon kong. Great game, huge amount of hackers. I looked into it, and on the android side of things, it looks like their is one major community that opens up apks and gives them away for free. I'm sure their is a business model. But that game, is fun, runs on a low spec device and has a global base. But not as horribly hacked as it was. I would love to know if they even spun up the binary save file in unity or if their are millions of kids with the same laptop I have in 3rd world countries. A 64 core duo with 4 gigs of ram, or if they have my other laptop, which is 32 bit.
Re: How anti-cheats catch cheaters using memory heuristics
#23Earlier quoted context omitted.
Playing by the rules favors those who the rules were set up to benefit. Are you poor, "ugly", unlucky, "stupid", uncoordinated? Cheating is your chance to win when our "just" society tells you you must lose. The transgression itself feels right and good.
No one forces, or even pressures, anyone to play multiplayer video games.
Right but if you spend your day resenting the rules you're expected to obey, you might spend your leisure time disobeying rules that have lesser consequences.
Re: How anti-cheats catch cheaters using memory heuristics
#24Serious question for you gamers out there: Why would a person go to such great lengths to cheat at a video game? Is there a monetary incentive? Otherwise, it seems like a lot of effort just to increase one's standing on a leader board.
As someone that's written a game "cheating" tool there's good technical / reverse engineering value from modding or cheating games. Plus it's fun to just be able to change a game (I fondly remember the days playing with Game Genie).
It is indeed a bit immoral when one tries to cheat in a way that unfairly puts themselves ahead of other humans.
Re: How anti-cheats catch cheaters using memory heuristics
#25What I don't understand is why the cheats can't just prevent the shellcode from running, or preempting the exception handler from being called by installing their own. Is spoofing the return of NtQueryVirtualMemory not possible, either?
There's an emulator: https://github.com/vmcall/battleye_emulation/blob/master/bat...
Apparently it sends 2 packets over the pipe and disables the anti-cheat completely. That's been patched but presumably it wouldn't be too hard to expand the emulator to handle the patch.
Re: How anti-cheats catch cheaters using memory heuristics
#26Serious question for you gamers out there: Why would a person go to such great lengths to cheat at a video game? Is there a monetary incentive? Otherwise, it seems like a lot of effort just to increase one's standing on a leader board.
A lot of games are just grinding, and cheating reduces the grinding. Usually it makes them more fun but sometimes it doesn't, in cases where the game is terrible to begin with. After a while cheating is more fun than the game. One could also look at Twitch streamers and ask why the people watching don't just play the game; the answer for a lot of games is that the games are incredibly difficult and the streamer can get through a level in a few hours while it might take the viewer months.
I don't think money enters into it. People just do weird things, like painting miniatures or climbing Mt. Everest, and hacking is another of those hobbies.
Re: How anti-cheats catch cheaters using memory heuristics
#27By installing spyware.
I wouldn't call this spyware; it doesn't seem to reach outside of its own process (though I guess it does report back what you could call analytics).
BattlEye apparently comes with a kernel component called BEDaisy which preemptively tries to block attempts to patch Windows API functions. That has some people calling it a root kit or spyware.
Re: How anti-cheats catch cheaters using memory heuristics
#28Serious question for you gamers out there: Why would a person go to such great lengths to cheat at a video game? Is there a monetary incentive? Otherwise, it seems like a lot of effort just to increase one's standing on a leader board.
There are different kinds of cheaters.
Some like the rush of doing something "naughty".
Some want quick results.
Some want prestige.
Some want to explore and exploit the system itself rather than the game.
Some want to gold farm.
Some want to be like gods.
Some want to automate the tedious parts.
Some want to take down big mobs that can't be taken down any other way.
I once wrote about 400k of Blech code for Macroquest to automate the most tedious parts of EQ grinding, and to automate support party members (running on separate accounts) when I couldn't find a group (before the mercenary system), powerlevel new accounts, or needed more precision to one-group multibox raid targets (for example, Overlord Mata Muram). In many ways it brought the game to a whole new level of challenges due to the difficulty of my targets, and the strategies I needed to employ.
It was actually quite cool, consisting of modules for healing, buffing, offtanking, main tanking, positioning, dd, dots, aggro management, clickies, AA abilities, timers... the works. I had a configuration language that assembled the necessary modules to produce the behavior I needed for a particular task.
All of the dev work involved, at my professional rate, would have come out to 5 or 6 figures, so there's that :P
Re: How anti-cheats catch cheaters using memory heuristics
#29What I don't understand is why the cheats can't just prevent the shellcode from running, or preempting the exception handler from being called by installing their own. Is spoofing the return of NtQueryVirtualMemory not possible, either?
If the shellcode doesn't run, then it can't respond to the server's challenge-response query. And the server knows the user is cheating.
It doesn’t really even have to be a real challenge-response since the server controls the shellcode. Just have the shellcode unconditionally submit something (maybe a value that requires a minimum amount of computation or WinAPI sanity checks). If you don’t run that bit of code, down comes the ban hammer.