Live data from Hacker News

Reverse engineering Call of Duty anti-cheat

ssno.cc

201–210 of 223 posts

Re: Reverse engineering Call of Duty anti-cheat

#201
post #149

Earlier quoted context omitted.

> If you behave badly, be it cheating or otherwise, you should be banned from using the multiplayer service because your behavior impacts other people. What if you behaved great but some guy fresh out of code boot camp's algorithm bans you?

Bugs and mistakes happen, when that happens it's typically some misidentification of a process or driver so a group of players get banned. And in every one of those cases I've seen they've been unbanned. The call of duty case is probably the worst one I've read about, also an outlier.

> And in every one of those cases I've seen they've been unbanned

"I'm locked out of my account because of a buggy algorithm and there is no recourse" is a recurring thing here.

Re: Reverse engineering Call of Duty anti-cheat

#202

Earlier quoted context omitted.

> That's the gold standard in the industry though, you don't warn(suspected) cheaters to not give them opportunity to adjust their tactics. Is this supposed to do any good? The actual cheater is still getting a signal that they've been detected, because they get banned. Then they figure out how, make a new account and go back to cheating. Meanwhile the normal user is both confused and significantly more inconvenience…

>>The actual cheater is still getting a signal that they've been detected, because they get banned. So....yes. But there are mitigating tactics around this, I really recommend looking into it because it's a fascinating topic. As the simplest thing - you don't ban cheaters the moment they are detected to not give off how you detected them. That's why Activision bans people in waves and all at once, even though they kn…

>> Yes, which is why the aim is to have 0 legitimate players getting caught by this, obviously.

One thing this is missing is that forcing addicted players to buy again helps bring in the cash flow, so what a few legit people got wrapped up, enough buy back the equation for the shadier game companies (usually the big ones) will go ahead and never rescind a ban.

Re: Reverse engineering Call of Duty anti-cheat

#203

Earlier quoted context omitted.

> I feel like in pretty much every case here they still do not need arbitrary access. Several of those cases do indeed need arbitrary access. > The moment a driver needs to be used to say allow an IOMMU range for a given device, the target computer has been tainted and you lose much of the benefit of DMA in the first place. The premise there being that the device is doing something suspicious rather than the same thi…

Re everything above the below, you are naming esoteric reasons for allowing unfettered access to physical memory. That's fine, but what percent of players of X game are going to have such a setup in their computer? Not enough that detecting that and preventing you from accessing a server would be a problem. > And just to reiterate, it doesn't have to be anything exotic. The storage controller in a common machine is g…

> That's fine, but what percent of players of X game are going to have such a setup in their computer?

If the "put some CPU cores on the GPU" thing becomes popular, probably a lot.

> I'd like a source for that if you have one. I'd be very surprised if modern IOMMU implementations with paging need arbitrary access. The CPU / OS could presumably modify the IOMMU entries prior to the DMA swap. The OS is still the one initiating a DMA transaction.

Traditional paging implementations didn't use IOMMU at all -- a lot of machines don't even physically have one, and even the ones that have one, that doesn't mean the OS is using it for that. It might end up going through it if you have something like the storage controller is mapped as a device to a VM guest and then the host uses the IOMMU to map the storage controller's DMA to the memory pages corresponding to what the guest perceives as its physical memory, or things along those lines.

But remapping the pages for each access, even if theoretically possible, would be pretty expensive. Page table operations aren't cheap and have significant synchronization overhead, and to swap a page that way would require you to both map the page and then almost immediately do another operation to unmap it again. For each 4kB page, since they're unlikely to be contiguous. You can do the math on how many page table operations that would add if you were swapping in, say, 500MiB, which a modern SSD could otherwise do in tens of milliseconds. Notice in particular that this would make operating systems that do this get lower scores in benchmarks. And that this applies not just to swap as a result of being out of memory, but ordinary file accesses which are really a swap to the page cache.

You could also run into trouble if you tried to do that because the IOMMU may only support a finite number of mappings, or have performance issues if you create too many. Then you get a slow device with too many pending I/O operations and the whole system locks up.

And even if you paid the cost, what have you bought? The OS could still give a device access to any given memory page for legitimate reasons and you have no way to know if the reason was the legitimate one or the user arranged for those circumstances to exist so they could access the page.

Re: Reverse engineering Call of Duty anti-cheat

#204
post #177

Earlier quoted context omitted.

it wasn't a brag or anything, i just don't know by what means i would've been introduced to that stuff other than game cheats. 15-year-old-me definitely did not care about crackmes or malware reversing. i did start writing code in middle school, though. php, mostly :)

you sound like me, I was a little younger though ... aimbots, wallhacks, esp, textures, radar, it was all intriguing and I hated encountering cheaters in CS 1.4 and 1.5. I also began dabbling in writing bots around this time, as POD Bot was awesome! php had also been a thing of mine, I spent many months in DALnet and EFnet #php. Primarily around the time of v3 prior to v4's big launch...

Did you end up releasing your bots?

Re: Reverse engineering Call of Duty anti-cheat

#205

Earlier quoted context omitted.

He does respond to minor inquiries frequently, but do remember that his company supports a gigantic predatory underage gambling market.

I’ve tried searching and found the below, is that the sort of thing you mean? https://www.seattletimes.com/business/bellevue-game-maker-va...

Yes and not much has changed since then. pyth0's sibling comment links the relevant Coffeezilla video.

Re: Reverse engineering Call of Duty anti-cheat

#206
post #143
post #116

I experienced the trust factor (banning, w/o banning officially) issues on my Linux CS:GO account in 2021, dropping to yellow and then red. This made it difficult to find teammates, as I was constantly matched with cheaters. I discovered I wasn't alone, as many other Linux users with Radeon GPUs and 16GB+ VRAM were experiencing similar problems. We created a GitHub issue to track the problem and try to find a solutio…

> dropping to yellow and then red How do you know what your trustfactor is? Or were you just speculating because the quality of games was lower? As far as I understand TF is hidden specifically so it can't be gamed.

Someone mentioned how they were testing it in the linked Github issue: https://github.com/ValveSoftware/csgo-osx-linux/issues/2630#...

EDIT: formatting x 2

Re: Reverse engineering Call of Duty anti-cheat

#207

Earlier quoted context omitted.

>>The actual cheater is still getting a signal that they've been detected, because they get banned. So....yes. But there are mitigating tactics around this, I really recommend looking into it because it's a fascinating topic. As the simplest thing - you don't ban cheaters the moment they are detected to not give off how you detected them. That's why Activision bans people in waves and all at once, even though they kn…

there is no money back from the cheat makers, its paypal, visa et al which does that.

Well I don't know if it's universally true for every single cheat, but cheat makers do in fact offer refunds/compensation if your account gets banned. As ths simplest example:

https://battlelog.co/forums/topic/12037-sorry-frost-you-can-...

(Frost is one of the owners of the site that sells cheats - he offers refunds and compensation whenever anyone has issues with their cheats)

Re: Reverse engineering Call of Duty anti-cheat

#208

Earlier quoted context omitted.

>>The actual cheater is still getting a signal that they've been detected, because they get banned. So....yes. But there are mitigating tactics around this, I really recommend looking into it because it's a fascinating topic. As the simplest thing - you don't ban cheaters the moment they are detected to not give off how you detected them. That's why Activision bans people in waves and all at once, even though they kn…

>> Yes, which is why the aim is to have 0 legitimate players getting caught by this, obviously. One thing this is missing is that forcing addicted players to buy again helps bring in the cash flow, so what a few legit people got wrapped up, enough buy back the equation for the shadier game companies (usually the big ones) will go ahead and never rescind a ban.

Literally no one does this in the industry, even if it sounds like a great idea on paper. Every big publisher knows that cheaters always bring negative cashflow to your company because they put off other players from playing. A single cheater in a 20 player game can put half of them off playing again, tarnishing your reputation at the same time. There is no universe in which "we'll just make cheaters buy our game again" makes any financial or any other sense - the goal is to get them to stop playing, permanently, and be enough of a pain in the ass that they never buy your game again.

>> so what a few legit people got wrapped up, enough buy back the equation

I've never seen any data that would support this. It just doesn't happen - if you accidentally ban a legit player they just get really pissed off and there's about 0% chance they will give you money again. Which is why you try extremely hard to not do that.

Re: Reverse engineering Call of Duty anti-cheat

#209

Earlier quoted context omitted.

>> Yes, which is why the aim is to have 0 legitimate players getting caught by this, obviously. One thing this is missing is that forcing addicted players to buy again helps bring in the cash flow, so what a few legit people got wrapped up, enough buy back the equation for the shadier game companies (usually the big ones) will go ahead and never rescind a ban.

Literally no one does this in the industry, even if it sounds like a great idea on paper. Every big publisher knows that cheaters always bring negative cashflow to your company because they put off other players from playing. A single cheater in a 20 player game can put half of them off playing again, tarnishing your reputation at the same time. There is no universe in which "we'll just make cheaters buy our game aga…

I used to work at a game company fresh out of college, and this is simply untrue. The company made roughly 40% of sales from cheater whales (one can imagine how much the chest makers made), and there were guidelines on repeated bans where we recognized similarities to make sure we wouldn't ban them again too early.

I left the industry because of thah and the other things like loot boxes and matchmaking for profit and to push micro transactions. It's a terrible place.

Re: Reverse engineering Call of Duty anti-cheat

#210

Earlier quoted context omitted.

Literally no one does this in the industry, even if it sounds like a great idea on paper. Every big publisher knows that cheaters always bring negative cashflow to your company because they put off other players from playing. A single cheater in a 20 player game can put half of them off playing again, tarnishing your reputation at the same time. There is no universe in which "we'll just make cheaters buy our game aga…

I used to work at a game company fresh out of college, and this is simply untrue. The company made roughly 40% of sales from cheater whales (one can imagine how much the chest makers made), and there were guidelines on repeated bans where we recognized similarities to make sure we wouldn't ban them again too early. I left the industry because of thah and the other things like loot boxes and matchmaking for profit and…

I guess you worked somewhere where that was considered a good business strategy then. I worked at a large publisher for over 10 years on couple big competitive titles and the idea always was to get cheaters off our service asap and permanently, no matter their spend(in fact we couldn't see that and it never made any impact on our engineering decisions around the problem).

>>It's a terrible place.

Some companies sure.

And yes sorry I realize I said "no one does this" - let me correct myself to say that in my experience at a couple big publishers this isn't a strategy anyone pursues because it's not worth the losses to your legit playerbase and reputation. But there might be companies that do this, I concede.

Post reply on HN