Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

vespalec.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#11

Post by stackghost »

b1temy wrote: post #8
supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

> they should provide built-in anti-cheat support in the OS. As much as I dislike anti-cheat in general (why incorporate it instead of just having proper moderation and/or private servers? Do you need a sketchy third-party kernel level driver to police you to make sure you're "browsing the internet properly in a way that is compliant with company XYZ's policies", or even when running other software like a photo edito…

>why incorporate it instead of just having proper moderation and/or private servers?

Because game studios these days are all about global matchmaking. Private servers aren't really a thing any more except in more niche games. Instead you (optionally with a party) queue for matchmaking. Every game has to have a ranked ladder these days, it seems.

I miss the days of Tribes 2 or CS1.6 when games had server browsers

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#12

Post by b1temy »

stackghost wrote: post #11
b1temy wrote: post #8

Earlier quoted context omitted.

> they should provide built-in anti-cheat support in the OS. As much as I dislike anti-cheat in general (why incorporate it instead of just having proper moderation and/or private servers? Do you need a sketchy third-party kernel level driver to police you to make sure you're "browsing the internet properly in a way that is compliant with company XYZ's policies", or even when running other software like a photo edito…

>why incorporate it instead of just having proper moderation and/or private servers? Because game studios these days are all about global matchmaking. Private servers aren't really a thing any more except in more niche games. Instead you (optionally with a party) queue for matchmaking. Every game has to have a ranked ladder these days, it seems. I miss the days of Tribes 2 or CS1.6 when games had server browsers

> Because game studios these days are all about global matchmaking

Why not have moderation then? When participating in an online forum, you are essentially "matchmaking" to a topic or corner of the internet with similar interests. Have some moderators (be it members of the community, or staff) ban players on obvious hacking/cheating or rule-breaking behaviour, and allow members to report any instances of this (I believe this is already a thing in modern video games, I have seen videos of "influencers" getting enraged when losing and reporting players for "stream sniping").

Sure, this might cause the usual issues of creating an echo chamber where mods and admins might unfairly ban members of the community. But you could always just join a different server in that case.

I believe Minecraft has a system similar to what I described; you enter the URL of a server to join, each hosted on its own independent instance (not necessarily hosted by Mojang, the studio behind Minecraft) each with their own unique sets of rules and culture, and being banned in one server does not ban you from every other server. Incidentally, Minecraft also does not have kernel level anticheat, and still very successfully manages to be one of the most popular games around (By some accounts, the top-selling game of all time).

> I miss the days of Tribes 2 or CS1.6 when games had server browsers

I do too.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#13

Post by galkk »

Some of games are releasing versions without copy protection and/or anti cheats when they are reaching end of their useful life for developers.

I don’t know about that particular game, but it could be the case that the devs intentionally ripped off the driver from it.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#14

Post by charcircuit »

hsbauauvhabzb wrote: post #5
supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

If a surgeon does not have the expertise to perform a surgery, they probably shouldn’t cut into you. If the company lacks the competency to write secure driers, they should outsource the work or have it validated externally. These things could be solved by spending money. Stop excusing dangerous actions performed in the name of greed.

Exactly, which is why Microsoft should be writing the one writing the kernel code needed for ensuring integrity of games. Microsoft needs to develop ways to allow games to run in an isolated VM that is hardware protected from the main operating system and ensures strong hardware security so cheaters can not simply attach malicious devices to the PCI bus to DMA sensitive data.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#15

Post by charcircuit »

b1temy wrote: post #12
stackghost wrote: post #11

Earlier quoted context omitted.

>why incorporate it instead of just having proper moderation and/or private servers? Because game studios these days are all about global matchmaking. Private servers aren't really a thing any more except in more niche games. Instead you (optionally with a party) queue for matchmaking. Every game has to have a ranked ladder these days, it seems. I miss the days of Tribes 2 or CS1.6 when games had server browsers

> Because game studios these days are all about global matchmaking Why not have moderation then? When participating in an online forum, you are essentially "matchmaking" to a topic or corner of the internet with similar interests. Have some moderators (be it members of the community, or staff) ban players on obvious hacking/cheating or rule-breaking behaviour, and allow members to report any instances of this (I beli…

>I believe Minecraft has a system similar to what I described

Except every big server has to run an anticheat. Some servers required clients with client side anticheats even. Some servers required you to screen share with a moderator and they would go through the files on your computer to look for cheats. Exploiting people for free labor to moderate servers was never enough to stop the issues cheating had. Even with these volunteers anticheat was essential for see what players were flagging checks to know who to watch over.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#16

Post by b1temy »

charcircuit wrote: post #15
b1temy wrote: post #12

Earlier quoted context omitted.

> Because game studios these days are all about global matchmaking Why not have moderation then? When participating in an online forum, you are essentially "matchmaking" to a topic or corner of the internet with similar interests. Have some moderators (be it members of the community, or staff) ban players on obvious hacking/cheating or rule-breaking behaviour, and allow members to report any instances of this (I beli…

>I believe Minecraft has a system similar to what I described Except every big server has to run an anticheat. Some servers required clients with client side anticheats even. Some servers required you to screen share with a moderator and they would go through the files on your computer to look for cheats. Exploiting people for free labor to moderate servers was never enough to stop the issues cheating had. Even with…

> Except every big server has to run an anticheat. Some servers required clients with client side anticheats even.

I am fine with anticheat on the server-side to help volunteers/moderators find issues, since it does not force the user to install any sketchy kernel-level software. As for the servers that require client-side anticheats, I was unaware there are Minecraft servers that do this (though I do not doubt you, and believe you when you say they exist), and can't speak to it.

> Some servers required you to screen share with a moderator and they would go through the files on your computer to look for cheats.

I was not aware this is a practice that some servers do. It is beyond ridiculous to ask to screen share just to verify no cheats were involved imo, and is a major invasion of privacy. The only scenario I can see this being okay, is in a physically hosted event, where players are playing on devices provided by the event organisers, so there would be no expectation of privacy in any case, in the same way you do not have an expectation of privacy on a work device.

In both cases, you could always find a different server that does not run anticheat, or even start your own server (if you were willing to do that). This isn't something that can even be done in other modern games that employ anticheat drivers and only allow connecting to their single official server.

Re: exploiting people for free labor to moderate servers

Nobody is forcing them to do it, I imagine they do it because they enjoy it and want to give back to the community, the same way someone would contribute to open source or moderate a forum in their spare time. In any case, is it always "free labor"? I have heard of paid-transactions and/or donations, sponsors, or servers being hosted by streamers who have other sources of income to pay for moderators. Though admittedly, I am not familiar with Minecraft in particular and if this is actually the case in most servers.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#17

Post by hsbauauvhabzb »

supersing wrote: post #7
hsbauauvhabzb wrote: post #5

Earlier quoted context omitted.

If a surgeon does not have the expertise to perform a surgery, they probably shouldn’t cut into you. If the company lacks the competency to write secure driers, they should outsource the work or have it validated externally. These things could be solved by spending money. Stop excusing dangerous actions performed in the name of greed.

It is not realistic to expect every game developer to invest a lot of money into security. It's like asking every apartment building to run its own fire department. The responsibility of securing a platform should not fall on application developers anyway.

It’s not the nurses job to perform surgery either, that’s why they don’t.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#18

Post by ThatPlayer »

b1temy wrote: post #8
supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

> they should provide built-in anti-cheat support in the OS. As much as I dislike anti-cheat in general (why incorporate it instead of just having proper moderation and/or private servers? Do you need a sketchy third-party kernel level driver to police you to make sure you're "browsing the internet properly in a way that is compliant with company XYZ's policies", or even when running other software like a photo edito…

> why incorporate it instead of just having proper moderation and/or private servers?

No one wants to become a moderator, they do it out of necessity. So it's pretty much the other way around: a lot of anticheats were, and are, originally developed by community members for private servers (because you're not deploying a 3rd party anti-cheat onto first party servers). BattleEye was originally for Battlefield games. Punkbuster for Team Fortress. EasyAntiCheat for Counter Strike. I even remember Starcraft Brood War 3rd party server ICCUP with a custom 'anti-hack' client requirement.

You still see this today with Counter Strike 2 private servers Face-IT: they have additional anti-cheat not less. Same with GTA V modded private server, FiveM have anti-cheat they call adhesive.

And then game developer saw that players are doing that, so they integrate the anti-cheat so that players do not have to go downloading/installing the anti-cheat separately. Quake 3 Arena added Punkbuster in an update for example.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#19

Post by pjmlp »

supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

They do, on XBox OS, which while based on Windows, it isn't exactly the same.

As for plain Windows, lets see how Crowdstrike changes will reflect on anti-cheats.

https://www.theverge.com/news/692637/microsoft-windows-kerne...

People could also behave, and then no anti-cheats would be needed anywhere, but that is utopia.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#20

Post by pjmlp »

supersing wrote: post #7
hsbauauvhabzb wrote: post #5

Earlier quoted context omitted.

If a surgeon does not have the expertise to perform a surgery, they probably shouldn’t cut into you. If the company lacks the competency to write secure driers, they should outsource the work or have it validated externally. These things could be solved by spending money. Stop excusing dangerous actions performed in the name of greed.

It is not realistic to expect every game developer to invest a lot of money into security. It's like asking every apartment building to run its own fire department. The responsibility of securing a platform should not fall on application developers anyway.

Yes it is, and liability across the industry is already late.

By the way, in some countries apartment buildings need several licenses, including one from fire department, before been allowed to have people living on them.

Post reply on HN