Live data from Hacker News

Riot Games Approach to Anti-Cheat

engineering.riotgames.com

111–120 of 412 posts

Re: Riot Games Approach to Anti-Cheat

#111
post #95

Does it hinder Linux gamers who are using Wine? A lot of such anti-cheats can't figure out when Wine is used and ban Linux users. Some also ban custom D3D implementations like DXVK even if they are really correctly implementing the API.

Yes - it hit the news that LoL will no longer work on Wine or virtual machines because of these anti-cheat measures.

OK, then their anti-cheat implementation is bad.

Re: Riot Games Approach to Anti-Cheat

#112

IMO games should encourage ergonomic aids. Why allow the UI to be a limiting factor to how you want to play? For example people used to talk about APM in SC2 as a sort of measure of how good someone is. Why should that be? It's a strategy game. Imagine if you could express your ideas effectively into actual game actions?

It's real-time strategy. So part of it is how you react to things, as well.

Re: Riot Games Approach to Anti-Cheat

#113

The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the game that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine co…

[deleted]

Re: Riot Games Approach to Anti-Cheat

#114
post #103

Earlier quoted context omitted.

Agreed. Definitely not trying to say encryption is a poor strategy. But it does seem obfuscation is most of their anti-cheat techniques. But the larger point I was trying to make is that all these studios are very secret about anti-cheat but they all seem to be fighting the same battle. Makes me wonder if the industry would be better off with cross-studio collaboration and open-sourcing anti-cheat libraries (that won…

> open-sourcing anti-cheat libraries (that won't be defeated by knowing the details). This doesn't make any sense. Anti cheat rely on the fact that it's not known. There is no such a thing as open source in the anti cheat world. It's all very secret for a good reason.

I'd curious to know what strategies make secrecy a necessity. I come from a WebDev background and open-source libraries are almost always always secure and safer then your own (due to the sheer amount of developers and ingenuity working on one repo). Admittedly, game development is a different beast and has to deal with far more client-code so I'm admitting my ignorance here.

Re: Riot Games Approach to Anti-Cheat

#115

IMO games should encourage ergonomic aids. Why allow the UI to be a limiting factor to how you want to play? For example people used to talk about APM in SC2 as a sort of measure of how good someone is. Why should that be? It's a strategy game. Imagine if you could express your ideas effectively into actual game actions?

>IMO games should encourage ergonomic aids. Why allow the UI to be a limiting factor to how you want to play?

For the same reason that sporting organizations regulate the equipment allowed during play - the make sure the playing field is reasonably level.

>For example people used to talk about APM in SC2 as a sort of measure of how good someone is. Why should that be?

Because dexterity has historically been a basis for comparison in recreational competition.

>It's a strategy game.

It's a real-time strategy game, which is an important distinction. Chess is a strategy game, and by its design guarantees each player an equal number of moves. SC2 is a real-time strategy game which makes no such guarantees, and if you have the dexterity to execute your strategy faster than your opponent can respond to, you should be rewarded for that.

>Imagine if you could express your ideas effectively into actual game actions?

Imagine the cost of such an interface in today's society, especially compared to a regular USB keyboard and mouse. Now imagine you're a game designer. Do you want to build a system that explicitly favors those rich enough to purchase the best equipment, or do you want to spread your playerbase as widely as possible?

Perhaps in another few decades, we can start rewarding the people with the "best" brains, but as long as we exist in meatspace, people are going to want to test their meat-skills against each other.

Re: Riot Games Approach to Anti-Cheat

#117
post #3

This is a great technical breakdown of some modern high level approaches to common cheats. I think this the most transparent approach (even though the author admits leaving some detail out) to modern anti-cheat for massive multiplayer games. Good on riot for having an open dialogue about this. I don't think you'd ever see someone like Valve going a transparent route with something like this. (Not making a judgement o…

Fair context: I make cheats/utilities this exact game being talked about in this article, so perhaps my opinion on the subject is biased or even invalid.

I partially disagree about the transparency of this article, while they do explain most of their approach to anti-cheat (and that is pretty cool for them to do), they seem to leave out any mention of anything that could be controversial.

It suppose that it does make sense to not mention the implementation details of their anti-cheat, but I wish that they would be a little more transparent about how/when/what they snoop around and send to their servers. The current Mac game client for League Of Legends contains full debug symbols and it doesn't have Packman (the packer described in this article), which makes it quite easy to look through the symbols. Inside you can find all of the anti-cheat-related network packets, in specific:

PKT_C2S_EnumDrivers PKT_C2S_EnumProcesses PKT_C2S_EnumDrives PKT_C2S_EnumHandles PKT_C2S_EnumRecentFiles PKT_C2S_EnumModules PKT_C2S_ProcessorData PKT_C2S_SystemState PKT_C2S_ModuleLoadNotification PKT_S2C_SendModule PKT_C2S_ModuleResponse

Now, I personally expect anti-cheat to snoop around my system when I'm doing something shady like scanning its memory. However, if I was a normal user of the game, I would be a bit concerned to know that it might be sending my recently used file names, drive names, system driver names, currently running processes, processor information, system state, and even entire binary files that it automatically deems as "suspicious", to their servers.

Re: Riot Games Approach to Anti-Cheat

#118

The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the game that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine co…

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it. You may have some hope in network delivery of graphics only. If I am not running the game client code, and just streaming the game from one of your servers, you have a chance at keeping your client safe.

Re: Riot Games Approach to Anti-Cheat

#119

The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the game that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine co…

So as a cheater you intercept those snippets, lets them do their magic in a dedicated address space that has the same client code loaded?

Re: Riot Games Approach to Anti-Cheat

#120

The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the game that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine co…

You are going to kick players off for a missed packet? Network connections have packet loss and game protocols are usually udp.
Post reply on HN