Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Riot Games Approach to Anti-Cheat

engineering.riotgames.com

Post reply on HN
Print view View original

141–150 of 412 posts

Re: Riot Games Approach to Anti-Cheat

#141

Post by iancarroll »

jonjojr wrote: post #135
bitexploder wrote: post #118

Earlier quoted context omitted.

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are…

"If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it." sure try to undo a block-chain and see what happens. The code will be encrypted with a unique key that will need to be registered on the server with your account. Change that code and it invalidates your entire build along with your account. case clo…

Blockchains are not a solution here. This comment doesn't make much sense; your proposed solution is missing a lot of details.

If there was a simple solution to this problem there would not be insanely complicated packers that basically try to make their own instruction set.

Re: Riot Games Approach to Anti-Cheat

#142

Post by tangent128 »

jonjojr wrote: post #135
bitexploder wrote: post #118

Earlier quoted context omitted.

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are…

"If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it." sure try to undo a block-chain and see what happens. The code will be encrypted with a unique key that will need to be registered on the server with your account. Change that code and it invalidates your entire build along with your account. case clo…

If the player controls the CPU the code is running on, there is fundamentally no way to enforce they are actually running the code provided.

Re: Riot Games Approach to Anti-Cheat

#143

Post by s73v3r_ »

jonjojr wrote: post #99

Use blockchain. It is a very simplified comment, but behind that you can expand the topic to include many advantage a blockchain can provide during multiplayer games. EDIT: yes it is a very unpopular topic, but deep down many of you who are developers, know that blockchain can solve many of these issues with cheater.dll

How exactly would blockchain do anything that a regular database couldn't do in this instance?

Re: Riot Games Approach to Anti-Cheat

#145

Post by mehrdadn »

johnmg wrote: post #117
crsv wrote: post #3

This is a great technical breakdown of some modern high level approaches to common cheats. I think this the most transparent approach (even though the author admits leaving some detail out) to modern anti-cheat for massive multiplayer games. Good on riot for having an open dialogue about this. I don't think you'd ever see someone like Valve going a transparent route with something like this. (Not making a judgement o…

Fair context: I make cheats/utilities this exact game being talked about in this article, so perhaps my opinion on the subject is biased or even invalid. I partially disagree about the transparency of this article, while they do explain most of their approach to anti-cheat (and that is pretty cool for them to do), they seem to leave out any mention of anything that could be controversial. It suppose that it does make…

Do you know if process information contains command-line information? Because that could totally contain someone's credentials...

Re: Riot Games Approach to Anti-Cheat

#146

Post by throwaway2048 »

jonjojr wrote: post #135
bitexploder wrote: post #118

Earlier quoted context omitted.

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are…

"If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it." sure try to undo a block-chain and see what happens. The code will be encrypted with a unique key that will need to be registered on the server with your account. Change that code and it invalidates your entire build along with your account. case clo…

This is a very bad analogy, and you have misunderstood the problem to a huge degree.

Re: Riot Games Approach to Anti-Cheat

#147

Post by s73v3r_ »

jonjojr wrote: post #139
s73v3r_ wrote: post #132

Earlier quoted context omitted.

Being a blockchain would give exactly zero advantages over a traditional database.

yes it will. Because in a block chain, you can't change anything unless everyone agrees to it. If you change that code, and place it back in the block-chain no other block will agree to your change and reject you.

As the game developer, I do not care if anyone else agrees to it. I am the ultimate authority. Thus, I don't need any kind of blockchain.

Re: Riot Games Approach to Anti-Cheat

#148

Post by drdaeman »

pythonaut_16 wrote: post #17

I'd love to see a game where cheating and scripting is the primary means of gameplay. By default the game would present a very simple UI but players would be encouraged to write and share scripts enabling varying levels and types of functionality. As a game developer your job then would be to write interesting enough systems for players to exploit to come up with interesting gameplay. I can imagine a scenario where d…

Something like this, but I wouldn't want to deter non-engineers from playing or feeling inferior to engineers. I still want to believe that fairness can be enforced and different skills and strategies can be competitive, not restricted.

It is unfortunate a negative perception for cheats is so universal some countries are insane enough to make it into their laws. Call me names but I perceive computer game[1] cheating as something that surely has a positive part. A lot of games are all about exploiting their mechanics (also called "developing a strategy" or "looking for weaknesses") to... err... win (or not lose). Cheats are the engineering solution to this, sometimes dull and non-imaginative, sometimes beautifully cunning hacks.

That is, unless we're talking about cheating griefers which I feel must be considered as a separate kind of people. Trying to gain advantage is natural for any player, depriving others of their fun is not[2]. If cheating makes grief (besides envy!) to other players I believe it means that it's the game mechanics that are flawed for allowing this. At least it's treated as a bug in all other kinds of software engineering.

Of course I recognize network lag is the enemy and computational complexity is another, so at least for anything fast-paced developers just have to offload calculations onto endpoints, sure. But still...

Oh, and I think this should be certainly possible for games where players don't compete. It's not impossible to believe a game where you can cheat yourself into gaining all the treasures of the world but that wouldn't mean anything and cheater would just deprive themselves of the fun. At the very least, the trend to try to shove anti-cheats into single-player games disgust me.

_____

[1] I'm not sure about other areas of cheating. Although I think I wouldn't mind seeing Cheaters' Olympic Games, allowing humans with any aids, robots and basically anything that is physically able to participate. That would be fun and probably awe-inspiring to see.

[2] Can we talk about cheaters' moral codex, haha? Do unto yourself only as you would have others do unto themselves too and stuff.

Re: Riot Games Approach to Anti-Cheat

#149

Post by bitexploder »

jonjojr wrote: post #135
bitexploder wrote: post #118

Earlier quoted context omitted.

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are…

"If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it." sure try to undo a block-chain and see what happens. The code will be encrypted with a unique key that will need to be registered on the server with your account. Change that code and it invalidates your entire build along with your account. case clo…

I think you are missing my point. This concept in client computing security basically chains back to the halting problem. You can't /know/ what I am doing with my computer. You can build a very elaborate trap / obfuscation and it might be hard, really hard, to defeat it or circumvent it, but it is a certainty that I can. The block-chain has absolutely nothing to do with client code security because it has a network enforced mechanism. What the grandparent was suggesting was running some nugget of code in a little VM (or actually on my machine), computing a result, and then returning the result to the server to make a security decision. The problem is I control that machine performing that computation and your security decision as the server is based solely on the computation performed on my computer. A skilled reverse engineer will just hook your code in the right place, intercept that security check and have it return the right bytes back to your server, while still doing whatever client side cheats they wanted to do.

https://en.wikipedia.org/wiki/Rice%27s_theorem <--- this is all about program behavior and did the user actually run the code you sent them. Block chain is about "did I possess certain data" (such as a private key to sign a transaction) and not about "did I run certain code".

Re: Riot Games Approach to Anti-Cheat

#150

Post by infogulch »

bitexploder wrote: post #118
infogulch wrote: post #109

The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the game that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine co…

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are…

> emulator to execute your machine code

I think you missed a part. Namely that "It is allowed to read from anywhere". If it can't write anywhere but the sandbox, that just means it can't modify the game dynamically, just read its state. Which is plenty to verify whether the client has been hacked anywhere. You can read spans of .text to check whether code has been modified, you can read heap locations to check whether the state of the game is valid, and you can take all of that and hash it with a random seed included in the packet to set a high bar on the speed of any emulator. Your emulator would have to dynamically check every access to make sure it doesn't touch anything that has been tampered with, and change the reads to read from un-modified sections, while allowing it to view everything else accurately. Seems like a high level of effort for the cheater, for a low investment from the developer.

Post reply on HN