Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Riot Games Approach to Anti-Cheat

engineering.riotgames.com

Post reply on HN
Print view View original

161–170 of 412 posts

Re: Riot Games Approach to Anti-Cheat

#161

Post by ryanlol »

ipython wrote: post #157
johnmg wrote: post #117

Earlier quoted context omitted.

Fair context: I make cheats/utilities this exact game being talked about in this article, so perhaps my opinion on the subject is biased or even invalid. I partially disagree about the transparency of this article, while they do explain most of their approach to anti-cheat (and that is pretty cool for them to do), they seem to leave out any mention of anything that could be controversial. It suppose that it does make…

Wouldn't that run afoul of GDPR?

The anticheat team at a videogame company might not know/care about this. This has definitely been the case with past European data privacy regulations.

Re: Riot Games Approach to Anti-Cheat

#162

Post by maerF0x0 »

vkou wrote: post #155
maerF0x0 wrote: post #133

Earlier quoted context omitted.

Many responses are saying the same thing, so I'm going to respond to you ... > It's not chess. I agree it's not chess, and chess often has a time component to it. The realtime nature of a game doesnt mean you should have to be able to "move" in realtime, IMO it would be superior if it tracked more closely to your ability to react, intellectually, in realtime. That is, real time thought more than realtime motion. Ergo…

With enough mechanical aides, the game balance breaks. For example, SC2 has a very cheap unit called the roach. When burrowed, it can't attack, but regenerates health incredibly quickly. It's trivial to write a cheat that will, whenever one of your roaches starts taking damage, causes it to burrow, and whenever it stops taking damage, unburrow. The unit is balanced around human control - no human can, with perfect ac…

I do not deny that the game mechanics would vastly change. The strategy would shift away from "How can I micro these roaches" vs "How can i effectively attack burrowing/unburrowing roaches" to "How can i ensure I get roaches" vs "How can I frustrate/prevent my opponent from getting them in the first place"... As an aside, ANY change to a game is going to disrupt the equilibrium in some manner and I assume would require human intervention to re-establish a "fun" gameplay.

Re: Riot Games Approach to Anti-Cheat

#163

Post by unnouinceput »

hathawsh wrote: post #128

What I wonder is how the encryption keys are stored. There are obvious ways to obfuscate keys, but at decryption time, the keys need to be exposed plainly in memory, don't they? So how do game makers like Riot prevent debuggers from discovering the keys and revealing them to everyone? Does every player have different keys?

A good solution will not only generate keys for each player, will even generate different keys for same player each time that player starts a new gaming session. Start game->generate keys for session->play game->throw keys away.

Re: Riot Games Approach to Anti-Cheat

#164

Post by swaggyBoatswain »

Is this approach similar to ones used in VAC (valve) or easyanticheat, or battleye?

Some of the above are notorious for consuming client resources. Easy anticheat is known for banning players in unrelated games that they cheated on. (E.g. cheat on pubg, get banned in a different game that you didn't cheat if both games use easyanticheat)

This is a great writeup but I'd love to see how 3rd party anticheat programs work

Re: Riot Games Approach to Anti-Cheat

#165

Post by lucb1e »

withinrafael wrote: post #153

So I'm not seeing anything particularly novel here. In fact, I think most AAA titles do most if not all of these things today. It really just boils down to understanding your title's threat model and mitigating the threats. I think the article missed an opportunity to talk about false positive rates, the workflow for users to get unbanned due to false positives (usually a very nasty process), performance, platform su…

> It really just boils down to understanding your title's threat model and mitigating the threats.

Well that can be said for every product ever...

I do agree though, I did expect a little more real content. Not the "how anti-cheat works" because then we can find ways around it more easily, but like you said: reliability, performance, etc.

Re: Riot Games Approach to Anti-Cheat

#166

Post by bitexploder »

infogulch wrote: post #150
bitexploder wrote: post #118

Earlier quoted context omitted.

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are…

> emulator to execute your machine code I think you missed a part. Namely that "It is allowed to read from anywhere". If it can't write anywhere but the sandbox, that just means it can't modify the game dynamically, just read its state. Which is plenty to verify whether the client has been hacked anywhere. You can read spans of .text to check whether code has been modified, you can read heap locations to check whethe…

I see. The problem is the server needs to know all of the values it expects. And if the server knows the values a cheat can figure them out too. For example, a cheat could hook OS functions and report on values in certain memory regions (e.g . the games loaded .text as some cached values). Same with reading heap locations, hook the memory read functions. Computing a hash doesn't have to be emulated, though, right? A cheat can just compute it with whatever data /should/ be there for the game state. This also means the questions the server can ask of the client are ones it can somehow model. So, this is imposing potentially restrictive requirements on any server software if it needs a non trivial mapping of the client's memory. I have chased down a lot of really bizzare and non-deterministic packers and cheat software like this and ultimately you can only make things so difficult due to Rice's theorem. To truly detect cheating you would practically have to run all the computations my computer is running, at which point you might as well just stream the game to me instead of letting me install it and run it on my computer. These sort of "check for a known good state" things can almost always defeated by appropriate function hooking. Ultimately, my computer is a hostile environment for your game and I have complete control of it. The traps a client running can only be so elaborate. I do agree things like this will take some time and increase the skill required to take them apart, but you would be surprised at how much harder some CTF competition reversing problems are compared to a scheme like this, I think.

Re: Riot Games Approach to Anti-Cheat

#167

Post by nathancahill »

pythonaut_16 wrote: post #17

I'd love to see a game where cheating and scripting is the primary means of gameplay. By default the game would present a very simple UI but players would be encouraged to write and share scripts enabling varying levels and types of functionality. As a game developer your job then would be to write interesting enough systems for players to exploit to come up with interesting gameplay. I can imagine a scenario where d…

Universal Paperclips: http://www.decisionproblem.com/paperclips/index2.html

You can play it in the browser console with the JS API.

Re: Riot Games Approach to Anti-Cheat

#168

Post by bitexploder »

drdaeman wrote: post #156
infogulch wrote: post #150

Earlier quoted context omitted.

> emulator to execute your machine code I think you missed a part. Namely that "It is allowed to read from anywhere". If it can't write anywhere but the sandbox, that just means it can't modify the game dynamically, just read its state. Which is plenty to verify whether the client has been hacked anywhere. You can read spans of .text to check whether code has been modified, you can read heap locations to check whethe…

A sandbox can be a virtual machine, for all practical purposes indistinguishable from any "normal" computers ordinary players use. Of course this will lead to the never ending Ouroboros of more sophisticated detectors and more sophisticated virtualization, ad infinitum. I've heard there are cheats that use hypervisors to stand above the operating systems and avoid kernel-level anti-cheats. I wouldn't be too surprised…

Hah. Are you me? That is what I always call the cat and mouse of cheat / anti cheat. (An Ouroboros) :-D

Re: Riot Games Approach to Anti-Cheat

#169

Post by invalidOrTaken »

echohack5 wrote: post #124
maerF0x0 wrote: post #101

IMO games should encourage ergonomic aids. Why allow the UI to be a limiting factor to how you want to play? For example people used to talk about APM in SC2 as a sort of measure of how good someone is. Why should that be? It's a strategy game. Imagine if you could express your ideas effectively into actual game actions?

(As a former high level StarCraft / SC2 player / caster). It's not chess. That's why. There is a real physical aspect to the game. Training your fingers to hit certain combinations quickly to execute build orders, and mix in micro is key. Pro players use hot packs to warm up their hands, or glasses to aid their eyes. The game developer takes a lot of care to ensure the UI / hotkeys / peripheral setups are optimized f…

Meh.

At the end of the day, "skill" is a meaningless term except in the context of a specific game. If Starcraft 3 came out tomorrow with no macro mechanics, no activated abilities, a pay-as-you-go economy rather than a pay-up-front one, then APM would be much less valuable and "skill" would mean something completely different.

Overwatch has this issue right now where players are complaining about Mercy, a character who is fairly simple to pick up and can provide a lot of value. What they ignore is that she was intended to be that way, and that the "skill" Mercy introduces is not lightning-fast reflexes or similar, but the strategic response to her presence.

I'm not campaigning for SC2 to be changed. But players' definition of "skill" generally shouldn't be trusted. Skill is what wins.

Re: Riot Games Approach to Anti-Cheat

#170

Post by invalidOrTaken »

maerF0x0 wrote: post #158
bllguo wrote: post #151

Earlier quoted context omitted.

I don't understand why you're so intent on doubling down here. There are other strategy games out there that focus on strategy more than micro mechanics. Why not play those instead? I don't think "I want to play Starcraft but without micro" is a compelling argument for changing Starcraft. I actually think it's pretty selfish to make these demands. It's a reasonable premise for finding or even creating a new game.

SC2 was simply an example. Clearly this is about the set of many RTS games more than just one game. And to be upfront, yes, "I want to play Starcraft but without micro" is a decent representation of my gaming desires. I may just go ahead and make such a game sometime and, I suppose, we'll see if anyone likes such a game dynamic. It would definitely introduce a very meta game where creating and tuning your "loadout" c…

You might enjoy Grey Goo, btw.
Post reply on HN