Live data from Hacker News

Reverse engineering Call of Duty anti-cheat

ssno.cc

171–180 of 223 posts

Re: Reverse engineering Call of Duty anti-cheat

#171
post #74

Earlier quoted context omitted.

EFT also uses kernel level anti-cheat “Easy Anti-Cheat” (as invasive as what valorant uses (vanguard)). Don’t know why ETF implementation sucks. I’ve been on CS since 1.3, and i think their system is pretty good. Sure you get cheaters sometimes, but it’s not that bad, maybe I’ve been pretty lucky.

Remember having to install "Cheating-Death" to get on some CS 1.x servers? Always wondered what it even did to your computer.

Yes! Good times, probably.

Re: Reverse engineering Call of Duty anti-cheat

#172

Earlier quoted context omitted.

IOMMU defeats DMA attacks. There is no reason for a GPU or network driver, or anything to have arbitrary physical memory access. If a GPU needs space for a draw-calls, allocate it in the kernel and explicitly give permission to the GPU to access it.

IOMMU gives the PCIe device access to whatever range of memory it's assigned. That doesn't prevent it from being assigned memory within the address space of the process, which can even be the common case because it's what allows for zero-copy I/O. Both network cards and GPUs do that. An even better example might be virtual memory. Some memory page gets swapped out or back in, so the storage controller is going to do…

I feel like in pretty much every case here they still do not need arbitrary access. The point of DMA cheating is to make zero modification of the target computer. The moment a driver needs to be used to say allow an IOMMU range for a given device, the target computer has been tainted and you lose much of the benefit of DMA in the first place.

Does a GPU need access to memory of a Usermode application for some reason, okay, the GPU driver should orchestrate that.

> We haven't even gotten into exotic hardware that wants to do some kind of shared memory clustering between machines, or cache cards (something like Optane) which are PCIe cards that can be used as system memory via DMA, or dedicated security processors intended to scan memory for malware etc.

Again, opt-in. The driver should specify explicit ranges when initializing the device.

Re: Reverse engineering Call of Duty anti-cheat

#173
post #2

Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.

You need to be just comfortable in assembly.

Its a hard first step, but I highly suggest you take the time to analyze a small binary, starting with understanding the registers for the architecture, understanding the different function calls, and then looking at the elf file and analyzing every section and how static linked libraries work, and how dynamic linking works with PLT/GOT. GPT models are REALLY good at helping you understand this, and you can also use Ghidra for decompilation. Do everything on Linux btw, as the tools are very easy to use and much less Cumbersome than windows.

Once you understand all of that, tracing assembly is pretty easy - its either register move operations, math operations, compare operations, jumps, and function call and returns (which basically are just shortcuts for handling the stack frames), with a few special instructions here and there which are usually just some optimizations that you can look it up ad hoc. Once you get handy at ghidra, you can look at decompiled C code and start replacing variable names to make the code readable, and then you generally get a good idea of project flow.

Re: Reverse engineering Call of Duty anti-cheat

#174
post #116

I experienced the trust factor (banning, w/o banning officially) issues on my Linux CS:GO account in 2021, dropping to yellow and then red. This made it difficult to find teammates, as I was constantly matched with cheaters. I discovered I wasn't alone, as many other Linux users with Radeon GPUs and 16GB+ VRAM were experiencing similar problems. We created a GitHub issue to track the problem and try to find a solutio…

>I suspect this was because Valve was preparing to launch the Steam Deck, and gaben wanted to ensure that Linux users had better experience with the device (just a guess).

Wait, how is punishing Linux users ensure Linux users have better experience?

Interesting though.

Re: Reverse engineering Call of Duty anti-cheat

#175

A 2-year legal battle with Activision to overturn a false permanent ban. Activision showed up with zero evidence of cheating and lost: https://antiblizzard.win/2025/01/18/my-two-year-fight-agains...

The exact same thing happened to me with League of Legends. I was inexplicably banned for cheating, despite never having done any such thing (and despite regularly playing on three accounts (this is fully permitted), the other two of which were not banned!) Their support people repeatedly said "we reviewed your case and the ban is correct", etc. all the while giving zero information about what I did so I could correc…

I feel that. I'm not against playing video games, but I'm uneasy about getting too attached to virtual property, considering it's controlled by a gaming company who has no obligation to you and no inclination to keep games alive beyond their shelf life.

To be fair though, real life property is only slightly less ephemeral.

Re: Reverse engineering Call of Duty anti-cheat

#176

Earlier quoted context omitted.

>>Despite the fact that cheating is damn near impossible on consoles Unfortunately, aim assist devices for consoles are very widespread now and a big problem for competitive gaming. . >>I had never even had a warning or complaint for any behavior whatsoever That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Sorry you got caught by…

> That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Is this supposed to do any good? The actual cheater is still getting a signal that they've been detected, because they get banned. Then they figure out how, make a new account and go back to cheating. Meanwhile the normal user is both confused and significantly more inconvenience…

I mean "then they figure out how" and "make a new account" are each doing quite a bit of the heavy lifting here.

Using Activision as the example, when they do a mass ban after you've been cheating for 4 months straight how exactly are you going to figure out how it happened?

Isn't the whole point of the ban that it's not as simple as just "make a new account?" Isn't it tied to the PS+ / XBox Gold membership, or even the physical hardware?

Re: Reverse engineering Call of Duty anti-cheat

#177

Earlier quoted context omitted.

Most hackers in the space start out at the freshman year or middle school age, my dude. Was the case 20 years ago.

it wasn't a brag or anything, i just don't know by what means i would've been introduced to that stuff other than game cheats. 15-year-old-me definitely did not care about crackmes or malware reversing. i did start writing code in middle school, though. php, mostly :)

you sound like me, I was a little younger though ... aimbots, wallhacks, esp, textures, radar, it was all intriguing and I hated encountering cheaters in CS 1.4 and 1.5. I also began dabbling in writing bots around this time, as POD Bot was awesome!

php had also been a thing of mine, I spent many months in DALnet and EFnet #php. Primarily around the time of v3 prior to v4's big launch...

Re: Reverse engineering Call of Duty anti-cheat

#178
post #165
post #64

Earlier quoted context omitted.

> This ban also ruined other games for me. If I ever did well in a game, someone would look at my profile to see how many hours I have and instantly see the red marker that shows “I am a cheater”. I wonder if that label can be considered to be libel. Probably harder in the US, but from what I understand in UK (or just England?) the defendant must prove that it's true.

On the UK though, computer data is proof. If the computer says you cheated, it’s proven. This is about to change though, since the national postal services got a whole bunch of people convicted of fraud based on a system they knew buggy.

For context, (I assume) this is referencing the Horizon IT Scandal in which faulty accounting software used by post offices in the UK indicated there were financial discrepencies suggesting embezzlement, and over 900 innocent people were convicted of crimes that never happened.

https://en.wikipedia.org/wiki/British_Post_Office_scandal

Re: Reverse engineering Call of Duty anti-cheat

#179
post #17

Earlier quoted context omitted.

How do functions that not end in ret work?

In addition to what others said, I'd simply point out that all 'ret' does on x86 is pop an address off the top of the stack and jump to it. It's more of a "helper" than a special instruction and it's use is never required as long as you ensure the stack will be kept correct (such as with a tail-call situation).

RET does more these days. If Intel CET is enabled then it also updates the hardware shadow stack, and the program will crash if RET is bypassed unless the SSP is adjusted. IIRC Windows x64 also has pertinent requirements on how the function epilog restores registers and returns since it will trace portions of the instruction stream during stack unwinding.

Re: Reverse engineering Call of Duty anti-cheat

#180
post #116

I experienced the trust factor (banning, w/o banning officially) issues on my Linux CS:GO account in 2021, dropping to yellow and then red. This made it difficult to find teammates, as I was constantly matched with cheaters. I discovered I wasn't alone, as many other Linux users with Radeon GPUs and 16GB+ VRAM were experiencing similar problems. We created a GitHub issue to track the problem and try to find a solutio…

>I suspect this was because Valve was preparing to launch the Steam Deck, and gaben wanted to ensure that Linux users had better experience with the device (just a guess). Wait, how is punishing Linux users ensure Linux users have better experience? Interesting though.

Probably meant that fixing it quickly was for the steam deck users. It might not have received attention otherwise.
Post reply on HN