Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Call of Duty anti-cheat

ssno.cc

Post reply on HN
Print view View original

31–40 of 223 posts

Re: Reverse engineering Call of Duty anti-cheat

#31

Post by DSMan195276 »

jychang wrote: post #17
russdill wrote: post #6

Earlier quoted context omitted.

Unconditional jumps are very common and everything in x86 assembly is very very messy after optimizations. Many functions do not end in ret.

How do functions that not end in ret work?

In addition to what others said, I'd simply point out that all 'ret' does on x86 is pop an address off the top of the stack and jump to it. It's more of a "helper" than a special instruction and it's use is never required as long as you ensure the stack will be kept correct (such as with a tail-call situation).

Re: Reverse engineering Call of Duty anti-cheat

#32

Post by landr0id »

Cyph0n wrote: post #15
andrewmcwatters wrote: post #4

Signature scanning is indeed the hot shit. It's like the most addicting part of reverse engineering to me. Building signature lists, and then writing bindings to scripting languages to call those function pointers. It's also the foundation of how many third-party mod platforms work, because you need to build a meaningful API to modders that isn't exposed by the first-party.

No idea what signature scanning is, but found this resource for those curious: https://www.unknowncheats.me/forum/general-programming-and-r...

Signature scanning is just scanning for unique bytes from a compiled function that will remain consistent across builds. You search memory for those bytes and when you find them, you find the function you're interested in.

Here's an example from some shellcode loader I wrote: https://github.com/exploits-forsale/solstice/blob/c3fc9a55c6...

Re: Reverse engineering Call of Duty anti-cheat

#34

Post by aalimov_ »

sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

EFT also uses kernel level anti-cheat “Easy Anti-Cheat” (as invasive as what valorant uses (vanguard)). Don’t know why ETF implementation sucks.

I’ve been on CS since 1.3, and i think their system is pretty good. Sure you get cheaters sometimes, but it’s not that bad, maybe I’ve been pretty lucky.

Re: Reverse engineering Call of Duty anti-cheat

#35

Post by josephg »

shj2105 wrote: post #2

Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.

I learned a lot of this stuff ~15 years ago from reading a book called Reversing: Secrets of Reverse Engineering by Eldad Eilam. The book is old but amazing. It takes you through a whole bunch of techniques and practical exercises. State of the art tooling has changed a bit since then, but the x86 ISA & assembly more generally hasn't changed much at all.

One of my biggest takeaways was learning about "crackmes" - which are small challenge binaries designed to be reverse engineered in order to learn the craft. They're kinda like practice locks in the lockpicking community. The book comes with a bunch on a CD-ROM from memory - but there's plenty more online if you go looking. Actually doing exercises like this is the way to learn.

You don't start trying to reverse engineer COD. You build up to it.

Re: Reverse engineering Call of Duty anti-cheat

#36

Post by NekkoDroid »

sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

The game I probably have the most hours in is Overwatch. In that time I've encountered not enough cheaters (at least those that are noticable enough) to say that they are even remotely a problem. I don't know what they are doing, but they don't use a kernel-mode anti-cheat (to my knowledge).

Re: Reverse engineering Call of Duty anti-cheat

#37

Post by ngneer »

jychang wrote: post #17
russdill wrote: post #6

Earlier quoted context omitted.

Unconditional jumps are very common and everything in x86 assembly is very very messy after optimizations. Many functions do not end in ret.

How do functions that not end in ret work?

If compilation uses jmp2ret mitigation, a trailing ret instruction will be replaced by a jmp to a return thunk. It is up to the return thunk to do as it pleases with program state.

Re: Reverse engineering Call of Duty anti-cheat

#38

Post by sodality2 »

sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

If you are serious about CS and reach 10-15k elo, you could give Faceit/ESEA a chance - invasive, but essentially 100% cheat-free.

Re: Reverse engineering Call of Duty anti-cheat

#39

Post by bloudermilk »

sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

Cheating is such a bummer in CS, even in casual matches. Luckily it’s usually pretty obvious and you can either kick the cheater or find a better lobby. Having friends on there has made finding good lobbies in general much easier

Re: Reverse engineering Call of Duty anti-cheat

#40

Post by kachapopopow »

NekkoDroid wrote: post #36
sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

The game I probably have the most hours in is Overwatch. In that time I've encountered not enough cheaters (at least those that are noticable enough) to say that they are even remotely a problem. I don't know what they are doing, but they don't use a kernel-mode anti-cheat (to my knowledge).

You simply don't notice since overwatch cheats tend to be very advanced. They also have a really strict system around reports and players actually use it.
Post reply on HN