Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Call of Duty anti-cheat

ssno.cc

Post reply on HN
Print view View original

21–30 of 223 posts

Re: Reverse engineering Call of Duty anti-cheat

#21

Post by sas41 »

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS.

I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns.

A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am cheating (that account was 12 years old by that point).

I abhor cheating, and I have a lot of interest in computer science, so of course I wanted to see how all of it works and did my research during my youth, taking care to never compromise the competitive integrity of the games I played, but if you look around, there is not a single game that I can recommend to people anymore.

Games like Escape From Tarkov are so busted, cheaters are stealing the barrels off people's guns and crashing their game/PC on command.

My beloved counter-strike's premier competitive game mode has a global leaderboard that acts as a cheat advertisement section within the game.

Games like Valorant are a cut above the rest on account of their massively invasive anti-cheat, but are nowhere near as clean as most fans claim, I mean, you could write a cheat for the game using nothing but AHK and reading the color of a pixel.

There is a whole industry of private matchmaking for counter-strike, built solely on the back of their anti-cheat and promises of pro-level play to the top players.

EDIT: I found the screenshot, it was MPGH not UnknownCheats, but yeah, they also had a game ban on their account.

Re: Reverse engineering Call of Duty anti-cheat

#22

Post by jcranmer »

jychang wrote: post #17
russdill wrote: post #6

Earlier quoted context omitted.

Unconditional jumps are very common and everything in x86 assembly is very very messy after optimizations. Many functions do not end in ret.

How do functions that not end in ret work?

There are things like compiling a tail call as JMP func_addr.

Re: Reverse engineering Call of Duty anti-cheat

#23

Post by [deleted] »

Cyph0n wrote: post #15
andrewmcwatters wrote: post #4

Signature scanning is indeed the hot shit. It's like the most addicting part of reverse engineering to me. Building signature lists, and then writing bindings to scripting languages to call those function pointers. It's also the foundation of how many third-party mod platforms work, because you need to build a meaningful API to modders that isn't exposed by the first-party.

No idea what signature scanning is, but found this resource for those curious: https://www.unknowncheats.me/forum/general-programming-and-r...

[deleted]

Re: Reverse engineering Call of Duty anti-cheat

#24

Post by ackbar03 »

phire wrote: post #7
adiabatichottub wrote: post #5

I'm very curious about the jump obfuscation. Maybe somebody who's done more reverse-engineering can answer this for me: a) Are unconditional jumps common enough that they couldn't be filtered out with some set of pre-conditions? b) It seems like finding the end of a function would be easy, because there's a return. Is there some way to analyze the stack so that you know where a function is returning to, then look for…

Yeah, should be easy enough to filter these particular jumps out. It's an obfuscation designed to annoy people using common off-the-shelf tools (especially IDA pro) Most obfuscations are only trying to annoy people just enough that they move on to other projects.

What are off the shelf tools/methods people use now? Ida was pretty standard goto when I was into RE

Re: Reverse engineering Call of Duty anti-cheat

#25

Post by mahmoudimus »

ackbar03 wrote: post #24
phire wrote: post #7

Earlier quoted context omitted.

Yeah, should be easy enough to filter these particular jumps out. It's an obfuscation designed to annoy people using common off-the-shelf tools (especially IDA pro) Most obfuscations are only trying to annoy people just enough that they move on to other projects.

What are off the shelf tools/methods people use now? Ida was pretty standard goto when I was into RE

Not much has changed, except there are more entrants. Binary Ninja, Ghidra, radare (last two being open source). For debugging, there's x64dbg. Some use windbg and gdb (for non windows os), but it still is mostly IDA as king though the others are catching up.

I evaluated entering the space by building something with AI native however, the business case just didn't make sense

Re: Reverse engineering Call of Duty anti-cheat

#26

Post by enjoylife »

sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

We’re seeing a clear divide where both competitive gamers and hackers are retreating into their own ecosystems, away from public matchmaking. Public matchmaking has simply become too optimized/lucrative to sustain trust or meaningful competition. Private matchmaking and closed communities are thriving, raising the average skill ceiling in competitive. Similarly, hacking communities are evolving with easier forms of payment and distribution. The monetary aspects are huge. But most importantly, both cultures push each away. Your persona of someone who plays with integrity and crosses the competitive and hacker mentality is pretty much gone.

Re: Reverse engineering Call of Duty anti-cheat

#27

Post by c0balt »

Cyph0n wrote: post #15
andrewmcwatters wrote: post #4

Signature scanning is indeed the hot shit. It's like the most addicting part of reverse engineering to me. Building signature lists, and then writing bindings to scripting languages to call those function pointers. It's also the foundation of how many third-party mod platforms work, because you need to build a meaningful API to modders that isn't exposed by the first-party.

No idea what signature scanning is, but found this resource for those curious: https://www.unknowncheats.me/forum/general-programming-and-r...

From my limited experience, it refers to the act of reverse engendering the function (signatures) contained the code of a binary.

A binary, like the underlying code, has commonly used code split into functions that may get called in multiple places. These calls can be analyzed either through static analyzers or by a human, who may analyze context of the callsite to guess what each Arg is supposed to do/be.

For modding, e. G. in a single player game, one might want to find out where the engine adjusts the health points of a player or updates progress.

Re: Reverse engineering Call of Duty anti-cheat

#28

Post by frogsRnice »

jcranmer wrote: post #22
jychang wrote: post #17

Earlier quoted context omitted.

How do functions that not end in ret work?

There are things like compiling a tail call as JMP func_addr.

Would you not have to use a jump instead of call for it to be a tail call at all- ie otherwise a new frame is created on each call

Re: Reverse engineering Call of Duty anti-cheat

#30

Post by Dalewyn »

sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

I disagree that cheating "has become" a huge problem, it was always a huge problem.

I can't remember a single multiplayer game that didn't have cheaters of some form or another. None. Zilch. Zero. It's kind of why I never grew beyond playing MMORPGs, and even that passion ultimately died out.

Post reply on HN