Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Call of Duty Adds Kernel Level Driver for Anti-Cheat

callofduty.com

Post reply on HN
Print view View original

221–230 of 332 posts

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#221

Post by throwing_away »

nmfisher wrote: post #212
cletus wrote: post #176

Earlier quoted context omitted.

This isn't a high-level gameplay problem. I'm not sure what you play but in (CoD) Warzone, for example, just based on Twitch streams at least, almost every lobby has one or more cheaters/hackers in it now. This is a bad enough problem that it actually threatens the integrity of the game and the continued support from more casual gamers such as yourself. As for your particular case (running a Windows VM with PCI-e GPU…

> As for your particular case (running a Windows VM with PCI-e GPU passthrough), that's... such a niche corner case that you're you just don't factor in. I'm not saying it's not niche (it definitely is), but I just wanted to chime in and say I'm another one who does this.

I don't see any practical way they can detect qemu that can't be patched.

Here's one patch that supposedly works with battleeye: https://github.com/WCharacter/RDTSC-KVM-Handler

The current situation is that they could probably use server-side heuristics to detect players behaving oddly, review the case, and ban according.

But also I wouldn't be surprised if there were already bots using machine learning to autoaim based on video signal out of the PC with aiming done as a "real" HID mouse.

If we can train a car to drive, we can certainly train a computer to find and click faces in cod.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#223

Post by KennyBlanken »

Arnavion wrote: post #136
RattleyCooper wrote: post #86

> In its initial rollout on Call of Duty: Warzone, the kernel-level driver will only operate when you play on PC. The driver is not always-on. The software turns on when you start Call of Duty: Warzone and shuts down when you close the game. Oh that's good. > Plus, the kernel-level driver only monitors and reports activity related to Call of Duty. Oh, so in other words it reports everything since any software that mi…

You don't really have to put so much effort into dissecting their verbiage. It's guaranteed that any kernel anti-cheat is going to be invasive and inspect everything on the system while looking for cheats.

No, it's absolutely not guaranteed. Especially in competitive shooters, performance is paramount. They have a strong motivation to only look where they need to. And anti-cheat isn't a money-maker, so they're not going to be spending lots of money storing user data they don't have to.

Cheat software has to do things like nose around in the game's memory space that no legitimate program is going to do. It also contains in its memory space keywords common to cheat programs.

That sort of search isn't really invasive because generally anti-cheat software when it triggers takes an screenshot, and if you're playing the game, there's nothing personal on the screen. Maybe a process is fingerprinted as a known cheat package. Say your kill to death ratio or hit/miss is unusually good. Or you get reported by a higher than normal number of people. Or a human moderator pushes a request, for whatever reason. Or they get a hit on the 'greps' I mentioned, etc.

The goal is to see if you've got a screen overlay that betrays wallhacking (ie "glasswalling") or a cheat system's UI. That's all they care about.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#224

Post by [deleted] »

foota wrote: post #196
cortesoft wrote: post #191

Earlier quoted context omitted.

Well this guy only wants to play with friends, so he doesn’t care if everyone else in the lobby are cheaters. He isn’t playing with anyone besides his friends. And why do you care if a lobby exists that you are never going to go to? Why does it bother you if cheaters want to use cheats against each other? As long as you don’t interact with them, I don’t understand why you would care.

You may not have played in a lobby with cheaters, but they ruin the game for anyone else there. Warzone matchmakes you with ~a hundred people, so you can't play with just your friends, so if you have an anti-cheat off lobby your game will be ruined.

[deleted]

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#225

Post by vpilcx »

cletus wrote: post #176
xerxes901 wrote: post #154

The whole "super intrusive anti-cheat" thing is really annoying to me as a non-competitive player, who just plays games like CoD, CS, etc occasionally with friends. And not just academically annoying, but practically too. I used to run Windows virtualised under Linux with a PCIe passthrough GPU. I remember having to re-install windows directly on my machine at a LAN party once because CS:GO couldn't be run in a VM an…

This isn't a high-level gameplay problem. I'm not sure what you play but in (CoD) Warzone, for example, just based on Twitch streams at least, almost every lobby has one or more cheaters/hackers in it now. This is a bad enough problem that it actually threatens the integrity of the game and the continued support from more casual gamers such as yourself. As for your particular case (running a Windows VM with PCI-e GPU…

For me, it's already ruined the game. There's a type of player that every time they take a bad beat, they'll be like, "Oh, we've got a cheater!" I am not like that. At all. It requires an enormous amount of evidence to accuse someone of cheating.

But with Warzone, it was happening so often, I no longer give anyone the benefit of the doubt. I used to run into more than one blatant cheater per day. And now all my bad beats, I assume half of them are cheating, even if it's not exactly clear. It's ruined the game for me. I genuinely don't even bother to play anymore unless I'm playing with one of my friends.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#226

Post by vpilcx »

munk-a wrote: post #107
maccard wrote: post #96

Earlier quoted context omitted.

Dealing with human reports is hard. People will report good players for cheating. People will report bad players for cheating. People will brigade reports. There's also a sense of scale; last I heard cod warzone had 100 million players. If even a _mild_ portion of those players actively use report systems, it's not feasible to manually evaluate them (and is also prone to bias and social factors)

You're saying it's not feasible to manually evaluate reports - but really what you're saying is that nobody wants to pay for it. Set up a very modest subscription model (like 2$/mo) to fund report checking for your game, possibly with a free tier that starts with low trust, and nuke people by credit card number.

Wouldn't that just kill a f2p userbased and just have cheaters go to gift cards?

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#227

Post by KennyBlanken »

DizzyDoo wrote: post #67
Thaxll wrote: post #56

Earlier quoted context omitted.

"They should invest instead in server-side models for detecting cheating" Which is already the case and can't work for all use cases. how the server knows that you see behind walls exactly? And ML / heuristic stuff is very limited as well. Detecting cheating, client or server side is very complicated and not even close to be a solved problem.

I once had an unusually good match in a popular FPS game, triggered some statistical tripwire, and received an automatic ban for 48 hours. "Just in case". Streamers and pro-players often have their accounts whitelisted from this system, because it would be laughable to happen publicly and show off just how 'security theater' it truly is.

Streamers and pros use cheats. Google "streamer caught cheating" and there's page after page of news items about people cheating even in tournaments, while streaming.

They're "whitelisted" because the game benefits from streamers who look like they're great at the game, and because competition for pro players is actually fairly stiff (in part because there aren't many pro players, because it's so hard to make money at it...but also because being competitive at a game usually means dedicating your training and play time to that game.)

Aim fatigue is a problem for pro players and it usually sets in around an hour or two...so when you see a streamer playing really well hour after hour, they're almost certainly employing some level of cheating. It might be really subtle, they might only 'flip it on' when they really have to. But it's there, and at 30-60fps and stream compression it can be really hard to spot even if you're a seasoned player in the game.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#228

Post by darkwizard42 »

KennyBlanken wrote: post #217
somerando7 wrote: post #201

Earlier quoted context omitted.

Server-side anticheat catches no cheaters...? What is even the point of developing it lol

Hint: game companies don't actually give a shit about cheaters, especially if they're giving them money. The only point at which a company cares about cheaters is when the community starts to really get riled up about them and revenue drops. COD Warzone has a full stats API and cheaters leap off the page. We're talking people with K/D ratios of, say, 10-20:1 or more. All they'd have to do is zap or flag those account…

Given that the solution provided here is actively trying to root out cheaters, I don't know how your initial "hint" statement even holds water.

The issue with any kind of wave of ban style action like you are suggesting is that the users can just create new accounts for free and continue to cheat. It greatly reduces the integrity of the overall matchmaking and game experience for everyone else.

If you think there is a better solution to ban repeat bots and cheats please provide it or at least offer a creative response to what COD is trying.

full disclosure, I don't like this solution, but having seen anti-cheat measures in a number of games, this seems to be the only one with real teeth for shooters

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#229

Post by darkwizard42 »

22c wrote: post #151
userbinator wrote: post #139

It's a cat-and-mouse game, where the mice basically have infinite time to spend on anti-anti-cheat... and dare I say it, countless young people probably got their head start in learning about computers, programming, reverse-engineering, etc. by playing this "meta-game". I know some people who were otherwise completely uninterested in the typical STEM courses at school, but highly skilled at the sort of low-level know…

I don't doubt any of that but what I don't understand is where these guys are getting all their accounts from. I feel as though if I were making a hack for a game, I'd get numerous accounts banned in the process (which means needing to buy more and more copies of the game). A youngster getting into reverse engineering surely does not have deep enough pockets to spend several hundreds of dollars on buying the game ove…

COD Warzone and a few others in the free to play category are just that... free to play and quite easy to create new accounts for

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#230

Post by kingcharles »

throwing_away wrote: post #221
nmfisher wrote: post #212

Earlier quoted context omitted.

> As for your particular case (running a Windows VM with PCI-e GPU passthrough), that's... such a niche corner case that you're you just don't factor in. I'm not saying it's not niche (it definitely is), but I just wanted to chime in and say I'm another one who does this.

I don't see any practical way they can detect qemu that can't be patched. Here's one patch that supposedly works with battleeye: https://github.com/WCharacter/RDTSC-KVM-Handler The current situation is that they could probably use server-side heuristics to detect players behaving oddly, review the case, and ban according. But also I wouldn't be surprised if there were already bots using machine learning to autoaim ba…

15 years or more ago when I was writing Star Wars Galaxies bots I spent most of the time making them do all sorts of dumb shit, making silly errors, clicking on the wrong buttons etc so they seemed human. The fact the bots were grinding 24x7 365 days a year without a pee break didn't seem to throw up any red flags luckily.
Post reply on HN