Live data from Hacker News

Reverse engineering Call of Duty anti-cheat

ssno.cc

91–100 of 223 posts

Re: Reverse engineering Call of Duty anti-cheat

#91

As long as you can read and write to memory, you will never stop online cheating in FPS games.

This is true, but what is "reading and writing to memory" here? The article outlines dozens of ways of doing that with various hooks etc. And how they try to avoid that.

If I put a hardware connection to the memory (basically WIRES to my memory bus) then yes, it's very hard to detect. But that's also very hard and expensive to do...

Re: Reverse engineering Call of Duty anti-cheat

#92

Earlier quoted context omitted.

>>Despite the fact that cheating is damn near impossible on consoles Unfortunately, aim assist devices for consoles are very widespread now and a big problem for competitive gaming. . >>I had never even had a warning or complaint for any behavior whatsoever That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Sorry you got caught by…

> That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Is this supposed to do any good? The actual cheater is still getting a signal that they've been detected, because they get banned. Then they figure out how, make a new account and go back to cheating. Meanwhile the normal user is both confused and significantly more inconvenience…

>>The actual cheater is still getting a signal that they've been detected, because they get banned.

So....yes. But there are mitigating tactics around this, I really recommend looking into it because it's a fascinating topic. As the simplest thing - you don't ban cheaters the moment they are detected to not give off how you detected them. That's why Activision bans people in waves and all at once, even though they know some people are cheating and still active. Unfortunately a lot of people are paying for cheats nowadays, and the cheat makers usually have some kind of refund policy where if you get detected you get your money back - games companies want to inconvenience those buyers as much as possible, so you can't claim your refund straight away because hey, the game worked for a good while even while you were cheating, must have been something else :P

>>Meanwhile the normal user is both confused and significantly more inconvenienced

Yes, which is why the aim is to have 0 legitimate players getting caught by this, obviously.

Re: Reverse engineering Call of Duty anti-cheat

#93

Earlier quoted context omitted.

>>Despite the fact that cheating is damn near impossible on consoles Unfortunately, aim assist devices for consoles are very widespread now and a big problem for competitive gaming. . >>I had never even had a warning or complaint for any behavior whatsoever That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Sorry you got caught by…

> That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Is this supposed to do any good? The actual cheater is still getting a signal that they've been detected, because they get banned. Then they figure out how, make a new account and go back to cheating. Meanwhile the normal user is both confused and significantly more inconvenience…

The intent is usually to gather data then ban in waves. If a new tool comes out and you ban a couple of players the tool authors might figure out why and update it. Let it sit a while and you can get hundreds/thousands of players who get a message to rethink their choice to cheat.

An additional benefit is that this can include multiple cheat programs and versions in one ban wave, so it may be harder to narrow down exactly what the flaw was. That's the why for no warnings (or explanations) - false positives and recourse if mistakenly flagged is another matter entirely.

Re: Reverse engineering Call of Duty anti-cheat

#94

Needs to be a law against the taking away of product functionality after the sale, even if it's contractual/EULA. A ban should never take the game away from the owner, and in cases where it does then they need to be refunded (treble damages on top of license, lawyer, and court fees if it takes a judgment to induce the refund). Getting banned on Steam, say, in the sense that all of one's purchases are invalidated shou…

I don't mind cheaters getting their asses kicked. Let them lose real money. If you accidentally get banned, that's a different story though.

And it's just a game that's not playable anymore, not the whole Steam account, isn't it?

Re: Reverse engineering Call of Duty anti-cheat

#96

Needs to be a law against the taking away of product functionality after the sale, even if it's contractual/EULA. A ban should never take the game away from the owner, and in cases where it does then they need to be refunded (treble damages on top of license, lawyer, and court fees if it takes a judgment to induce the refund). Getting banned on Steam, say, in the sense that all of one's purchases are invalidated shou…

If you cheat or ruin game for other players, you deserve to lose the access.

Other players paid too.

Re: Reverse engineering Call of Duty anti-cheat

#97
post #86

I'm very curious about the jump obfuscation. Maybe somebody who's done more reverse-engineering can answer this for me: a) Are unconditional jumps common enough that they couldn't be filtered out with some set of pre-conditions? b) It seems like finding the end of a function would be easy, because there's a return. Is there some way to analyze the stack so that you know where a function is returning to, then look for…

Few common issues. 1. Some jumps will be fake. 2. Some jumps will be inside an instruction. Decompilers can't handle two instructions are same location. (Like jmp 0x1234), you skip the jmp op, and assume 0x1234 is a valid instruction. 3. Stack will be fucked up in a branch, but is intentional to cause an exception. So you can either nop an instruction like lea RAX, [rsp + 0x99999999999] to fix decompilation, but then…

Why you cannot make same script for IDA. Anyway I don't like them, Hexrays are POS. Just curious.

Re: Reverse engineering Call of Duty anti-cheat

#98
post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

fwiw, cheating in CS(GO) taught me x86 RE and low-level programming way younger than is usual. sophomore year of high school. I still recommend writing an HvH cheat to anyone that wants to get into proggin' -- you get a taste of both static and dynamic RE, memory-level programming, UI development, bare dxsdk (usually), a skid-saturated environment, sysadmin (if you try to set yourself up an uber1337 cheat page), and…

still, it ruined game for other players.

though personally I can't be that mad if you wrote cheats yourself, I will be a bit angry but impressed too ;)

Re: Reverse engineering Call of Duty anti-cheat

#99
Not really relevant, but this triggered a memory of being around 14 years old and getting scammed on Runescape which drove an evil character arch from me to somehow find out how to DDOS players in the duel arena and make absolute bank. I still feel a little guilty about my actions to this day. At the same time, I'm surprised that at 14 I was able to find and pay for a denial of service provider and figure out players IP addresses to intentionally disconnect them

Re: Reverse engineering Call of Duty anti-cheat

#100

Earlier quoted context omitted.

Would you not have to use a jump instead of call for it to be a tail call at all- ie otherwise a new frame is created on each call

the call is still in tail position whether or not it reuses the stack frame. there are also more involved ways to do tail call optimization than a direct single-jump compilation when you leave ret behind entirely, such as in forth-style threaded interpreters

I guess were talking about optimising tail recursion. Would there be any reason to refer to a tail call other than that optimisation?

I’ll do some reading on the latter part of your post, thank you!

Post reply on HN