Earlier quoted context omitted.
EFT also uses kernel level anti-cheat “Easy Anti-Cheat” (as invasive as what valorant uses (vanguard)). Don’t know why ETF implementation sucks. I’ve been on CS since 1.3, and i think their system is pretty good. Sure you get cheaters sometimes, but it’s not that bad, maybe I’ve been pretty lucky.
Remember having to install "Cheating-Death" to get on some CS 1.x servers? Always wondered what it even did to your computer.
Reverse engineering Call of Duty anti-cheat
171–180 of 223 posts
Re: Reverse engineering Call of Duty anti-cheat
#172Earlier quoted context omitted.
IOMMU defeats DMA attacks. There is no reason for a GPU or network driver, or anything to have arbitrary physical memory access. If a GPU needs space for a draw-calls, allocate it in the kernel and explicitly give permission to the GPU to access it.
IOMMU gives the PCIe device access to whatever range of memory it's assigned. That doesn't prevent it from being assigned memory within the address space of the process, which can even be the common case because it's what allows for zero-copy I/O. Both network cards and GPUs do that. An even better example might be virtual memory. Some memory page gets swapped out or back in, so the storage controller is going to do…
Does a GPU need access to memory of a Usermode application for some reason, okay, the GPU driver should orchestrate that.
> We haven't even gotten into exotic hardware that wants to do some kind of shared memory clustering between machines, or cache cards (something like Optane) which are PCIe cards that can be used as system memory via DMA, or dedicated security processors intended to scan memory for malware etc.
Again, opt-in. The driver should specify explicit ranges when initializing the device.
Re: Reverse engineering Call of Duty anti-cheat
#173Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.
Its a hard first step, but I highly suggest you take the time to analyze a small binary, starting with understanding the registers for the architecture, understanding the different function calls, and then looking at the elf file and analyzing every section and how static linked libraries work, and how dynamic linking works with PLT/GOT. GPT models are REALLY good at helping you understand this, and you can also use Ghidra for decompilation. Do everything on Linux btw, as the tools are very easy to use and much less Cumbersome than windows.
Once you understand all of that, tracing assembly is pretty easy - its either register move operations, math operations, compare operations, jumps, and function call and returns (which basically are just shortcuts for handling the stack frames), with a few special instructions here and there which are usually just some optimizations that you can look it up ad hoc. Once you get handy at ghidra, you can look at decompiled C code and start replacing variable names to make the code readable, and then you generally get a good idea of project flow.
Re: Reverse engineering Call of Duty anti-cheat
#174I experienced the trust factor (banning, w/o banning officially) issues on my Linux CS:GO account in 2021, dropping to yellow and then red. This made it difficult to find teammates, as I was constantly matched with cheaters. I discovered I wasn't alone, as many other Linux users with Radeon GPUs and 16GB+ VRAM were experiencing similar problems. We created a GitHub issue to track the problem and try to find a solutio…
Wait, how is punishing Linux users ensure Linux users have better experience?
Interesting though.
Re: Reverse engineering Call of Duty anti-cheat
#175A 2-year legal battle with Activision to overturn a false permanent ban. Activision showed up with zero evidence of cheating and lost: https://antiblizzard.win/2025/01/18/my-two-year-fight-agains...
The exact same thing happened to me with League of Legends. I was inexplicably banned for cheating, despite never having done any such thing (and despite regularly playing on three accounts (this is fully permitted), the other two of which were not banned!) Their support people repeatedly said "we reviewed your case and the ban is correct", etc. all the while giving zero information about what I did so I could correc…
To be fair though, real life property is only slightly less ephemeral.
Re: Reverse engineering Call of Duty anti-cheat
#176Earlier quoted context omitted.
>>Despite the fact that cheating is damn near impossible on consoles Unfortunately, aim assist devices for consoles are very widespread now and a big problem for competitive gaming. . >>I had never even had a warning or complaint for any behavior whatsoever That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Sorry you got caught by…
> That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Is this supposed to do any good? The actual cheater is still getting a signal that they've been detected, because they get banned. Then they figure out how, make a new account and go back to cheating. Meanwhile the normal user is both confused and significantly more inconvenience…
Using Activision as the example, when they do a mass ban after you've been cheating for 4 months straight how exactly are you going to figure out how it happened?
Isn't the whole point of the ban that it's not as simple as just "make a new account?" Isn't it tied to the PS+ / XBox Gold membership, or even the physical hardware?
Re: Reverse engineering Call of Duty anti-cheat
#177Earlier quoted context omitted.
Most hackers in the space start out at the freshman year or middle school age, my dude. Was the case 20 years ago.
it wasn't a brag or anything, i just don't know by what means i would've been introduced to that stuff other than game cheats. 15-year-old-me definitely did not care about crackmes or malware reversing. i did start writing code in middle school, though. php, mostly :)
php had also been a thing of mine, I spent many months in DALnet and EFnet #php. Primarily around the time of v3 prior to v4's big launch...
Re: Reverse engineering Call of Duty anti-cheat
#178Earlier quoted context omitted.
> This ban also ruined other games for me. If I ever did well in a game, someone would look at my profile to see how many hours I have and instantly see the red marker that shows “I am a cheater”. I wonder if that label can be considered to be libel. Probably harder in the US, but from what I understand in UK (or just England?) the defendant must prove that it's true.
On the UK though, computer data is proof. If the computer says you cheated, it’s proven. This is about to change though, since the national postal services got a whole bunch of people convicted of fraud based on a system they knew buggy.
Re: Reverse engineering Call of Duty anti-cheat
#179Earlier quoted context omitted.
How do functions that not end in ret work?
In addition to what others said, I'd simply point out that all 'ret' does on x86 is pop an address off the top of the stack and jump to it. It's more of a "helper" than a special instruction and it's use is never required as long as you ensure the stack will be kept correct (such as with a tail-call situation).
Re: Reverse engineering Call of Duty anti-cheat
#180I experienced the trust factor (banning, w/o banning officially) issues on my Linux CS:GO account in 2021, dropping to yellow and then red. This made it difficult to find teammates, as I was constantly matched with cheaters. I discovered I wasn't alone, as many other Linux users with Radeon GPUs and 16GB+ VRAM were experiencing similar problems. We created a GitHub issue to track the problem and try to find a solutio…
>I suspect this was because Valve was preparing to launch the Steam Deck, and gaben wanted to ensure that Linux users had better experience with the device (just a guess). Wait, how is punishing Linux users ensure Linux users have better experience? Interesting though.