Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Game Hacking – Valve Anti-Cheat (VAC)

codeneverdies.github.io

Post reply on HN
Print view View original

51–60 of 167 posts

Re: Game Hacking – Valve Anti-Cheat (VAC)

#51

Post by CobrastanJorji »

rimunroe wrote: post #21

Back in 2000-2005 I was very active in a community centered around 20 or so modded Counter-Strike servers which I volunteered as an admin on. We were generally good about having at least one admin on each server at any given time to deal with cheaters. Occasionally someone wouldn’t be around though. There was a period of time lasting about a month or two where a player with a name like BELT SANDER or ANGLE GRINDER or…

I love this story. Feels like a modern take on one of those old "hidden master" stories where offending the quiet old man turns out to be a disastrous idea.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#52

Post by charcircuit »

keyringlight wrote: post #43
snickerdoodle12 wrote: post #10

Remote Code Execution like loading DLLs from a server and executing them sounds like malware.

I'm surprised there haven't been more events of mods and tools being used as trojans. For all the concern about anti-cheat/DRM, PC gamers seem very selective over what sources of code they're running on their computers they scrutinize. There's an awful lot of users with "just enough" levels of knowledge where I think a tempting enough release with the right timing for a hot game could get a lot of installs.

What do you mean? There have been ton of stealers and RAT mods for games (and even for normal mobile apps too). It's absolutely a problem and a ton people fall victim to them.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#53

Post by endemic »

SteveNuts wrote: post #30
garrettjoecox wrote: post #9

Years ago for educational purposes I decided to venture down understanding how easy/difficult it was to create a hack for Counterstrike. After just a few hours of watching YouTube tutorials and translating what I could grasp from C/C# into JavaScript (the only language I knew at the time), I had a working Node.js executable that edited memory offsets (using data from hazedumper[1]), letting me see enemies through wal…

I'll never understand what people actually get out of cheating in games. I'll admit I've tried it a few times just for giggles (way back in the Age of Empires II/MSN Gaming Zone days), but the novelty quickly wears off and then it's just not even fun anymore. There must be some very interesting psychology behind this.

> There must be some very interesting psychology behind this.

It feels good when you win! If you cheat, that just means you're smarter than the other player.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#54

Post by qualeed »

bob1029 wrote: post #45
qualeed wrote: post #12

Earlier quoted context omitted.

> If someone at Valve had taken 10 seconds to review my stats It seems super reasonable when it's a one-off thing for your own account. When you think about making it into policy and scaling it up to 1000s of interactions, it quickly becomes unreasonable. > Statistical techniques can dramatically reduce false positives For a period of time, anyways. Until the statistics get gamed by the cheaters (e.g. adjust accuracy…

> adjust accuracy of your auto-shoot from 100% to 85% or whatever Sure - looking at K/D, accuracy, etc., is an important factor in a statistical model. Statistics can also include: Map name, player transform on the map, keyboard and mouse events, GPU utilization, audio playback events, etc. These are all very high information time domain signals that can be correlated with the same from any other player. After a cert…

>Statistics can also include: Map name, player transform on the map, keyboard and mouse events, GPU utilization, audio playback events, etc. These are all very high information time domain signals that can be correlated with the same from any other player.

I don't think these are the type of stats the parent was referring to when they said "If someone at Valve had taken 10 seconds to review my stats".

But sure, those are all examples of statistics to start logging, analyzing, and cross-referencing. (I would argue most of the statistics you listed are of little to no use in identifying false-positives (or good cheaters), but I understand the point you're making with those examples.)

It would maybe reduce the false positive rate by some amount at an increased monetary (and complexity) cost to themselves. I think it would be well past the point of diminishing returns though. Setting up all the infrastructure, policy, processes just to reduce false-positive rates by a few percent, maybe?

I think I'll stand by "that's unreasonable" and "cheaters will game the statistics".

Re: Game Hacking – Valve Anti-Cheat (VAC)

#55

Post by Hikikomori »

eGQjxkKF6fif wrote: post #7

When VAC was originally introduced, CPUs only had 32bit architecture, not that 64bit hindered anything; but you could inject cheats in a near infinite amount of way, or have cheats read from memory directly, or have cheats do things especially through video drivers. Hell, glitching your nvidia drivers and setting things like Negative LOD Bias would allow you to see through textures in some cases (wall hacks) It's bee…

Csgo added it a few years ago as well. Works in fps games with simple maps.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#56

Post by ipsento606 »

SteveNuts wrote: post #30
garrettjoecox wrote: post #9

Years ago for educational purposes I decided to venture down understanding how easy/difficult it was to create a hack for Counterstrike. After just a few hours of watching YouTube tutorials and translating what I could grasp from C/C# into JavaScript (the only language I knew at the time), I had a working Node.js executable that edited memory offsets (using data from hazedumper[1]), letting me see enemies through wal…

I'll never understand what people actually get out of cheating in games. I'll admit I've tried it a few times just for giggles (way back in the Age of Empires II/MSN Gaming Zone days), but the novelty quickly wears off and then it's just not even fun anymore. There must be some very interesting psychology behind this.

even if everyone only tried it for a week, that still means there will always be a certain number of cheaters in games, because new players are always joining

Re: Game Hacking – Valve Anti-Cheat (VAC)

#57

Post by Sohcahtoa82 »

zeta0134 wrote: post #24
phoronixrly wrote: post #18

Earlier quoted context omitted.

The other day I mentioned that it's not OK for games to be proprietary software and/or use unethical software like DRM (which tbh anti-cheats are as well). I got accused that I wanted game developers to starve to death.

I'll chime in here as a game developer: my upcoming release will be an NES cartridge[0] and probably a Steam app. I'll be adding no DRM, because I generally trust that folks that weren't going to pay aren't going to be converted by its presence, and that honest folks want to support my work. Whether the storefronts I release on add their own is up to them, and frankly I don't care. Separately though, anti-cheat is an…

> Generally I favor "cheat detection should be serverside, don't trust the client" from a general security perspective, but... I can totally see a valid case in there, somewhere, for more rigorous clientside checks.

Yeah...

The simple fact is, it's simply not possible to have completely server-side cheat detection simply because you'll be relying purely on heuristics which could very well be wrong. It's just not going to be possible to tell the difference between a cheater and a really good player.

For any cheat detection to work, it has to be client-side.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#58

Post by david422 »

mschuster91 wrote: post #41
garrettjoecox wrote: post #9

Years ago for educational purposes I decided to venture down understanding how easy/difficult it was to create a hack for Counterstrike. After just a few hours of watching YouTube tutorials and translating what I could grasp from C/C# into JavaScript (the only language I knew at the time), I had a working Node.js executable that edited memory offsets (using data from hazedumper[1]), letting me see enemies through wal…

> I only toyed with it for a few weeks as I then grew disinterested but that definitely left a sour taste in my mouth for the "effectiveness" of VAC if a script kiddie like me at the time could throw together something custom in just a few hours, I'm sure it'd be much easier now with ChatGPT... The thing is, VAC doesn't immediately ban you. Or anyone else. It's looking for suspicious patterns across hundreds if not t…

Blizzard's battle.net used to do that. They'd ban in waves. I imagine immediate bans would make it much easier for cheat authors to figure out which cheats were detectable and which weren't.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#59

Post by altruios »

AndriyKunitsyn wrote: post #28
altruios wrote: post #20

Earlier quoted context omitted.

that's where you turn and say: well, the game developer executives however... In all seriousness, DRM/anti-cheats => rootkits/rats. Don't fall for it. Demand better.

Can't say for DRM, but there's much bigger demand to play a multiplayer action game without experiencing cheating than demand for a similar game that's not a rootkit. Cheaters are nasty. Devs make rootkit anti-cheats simply because there's no better alternative, not because they're evil.

We need to define nebulous terms like 'better'... to a company that's synonymous with what is 'cheapest' to their bottom line. To a player, that's a more effective anti-cheat.

To my understanding, the latter is much more effectively solved server-side, but is more costly for the company to run.

I'd rather play a game with server-side anti-cheat than player-side-anti-cheat.

Re: Game Hacking – Valve Anti-Cheat (VAC)

#60

Post by handoflixue »

qualeed wrote: post #12
bob1029 wrote: post #5

I am not a fan of the signature-based techniques used by VAC, et. al. I've lost a few steam accounts to accurate but unintended (i.e., not actually cheating) detection of debugging tools attached to totally unrelated processes on the same machine. Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what. Ethical hacking and malicious hacking are indistinguishable fro…

> If someone at Valve had taken 10 seconds to review my stats It seems super reasonable when it's a one-off thing for your own account. When you think about making it into policy and scaling it up to 1000s of interactions, it quickly becomes unreasonable. > Statistical techniques can dramatically reduce false positives For a period of time, anyways. Until the statistics get gamed by the cheaters (e.g. adjust accuracy…

You could just do a basic automated review of stats. If someone has a 50% win rate and a 20% accuracy, they're probably not cheating - what's even the point of cheating if you don't win more often than chance?
Post reply on HN