Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

vespalec.com

Post reply on HN
Print view View original

31–40 of 52 posts

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#31

Post by RobotToaster »

supersing wrote: post #7
hsbauauvhabzb wrote: post #5

Earlier quoted context omitted.

If a surgeon does not have the expertise to perform a surgery, they probably shouldn’t cut into you. If the company lacks the competency to write secure driers, they should outsource the work or have it validated externally. These things could be solved by spending money. Stop excusing dangerous actions performed in the name of greed.

It is not realistic to expect every game developer to invest a lot of money into security. It's like asking every apartment building to run its own fire department. The responsibility of securing a platform should not fall on application developers anyway.

Microsoft could easily secure windows by blocking all rootkits/"kernel anti cheat". At this point that's probably the best option.

Games should never have kernel level access.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#32

Post by charcircuit »

direwolf20 wrote: post #28
charcircuit wrote: post #14

Earlier quoted context omitted.

Exactly, which is why Microsoft should be writing the one writing the kernel code needed for ensuring integrity of games. Microsoft needs to develop ways to allow games to run in an isolated VM that is hardware protected from the main operating system and ensures strong hardware security so cheaters can not simply attach malicious devices to the PCI bus to DMA sensitive data.

As an indie game developer, how do I get my game into this system and how do I debug it?

For this theoretical feature Windows would do it automatically for apps that would opt in.

For debugging you would either not have this feature or enabled, or you would build a custom build that included a debugger in the secure environment. If you needed to connect to production servers you could whitelist your account to be ignored by the anticheat since your server would know you are not playing with an official build.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#33

Post by realusername »

supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

This is a lost battle, you have cheaters on console which are more locked down than PC ever will be. You can't remove cheating with software.

Sorry game companies, the answer is paid moderation, I know it cost money and I know you don't like to pay but there's no way around it.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#34

Post by direwolf20 »

supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

What does built–in anticheat support looks like to you? A whitelist of apps you can run? Debuggers not being allowed?

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#35

Post by direwolf20 »

realusername wrote: post #33
supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

This is a lost battle, you have cheaters on console which are more locked down than PC ever will be. You can't remove cheating with software. Sorry game companies, the answer is paid moderation, I know it cost money and I know you don't like to pay but there's no way around it.

Or small–group servers. You cheat on the internet because you're a nobody. You don't cheat with your friends because your friends will disown you.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#36

Post by user34283 »

b1temy wrote: post #8
supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

> they should provide built-in anti-cheat support in the OS. As much as I dislike anti-cheat in general (why incorporate it instead of just having proper moderation and/or private servers? Do you need a sketchy third-party kernel level driver to police you to make sure you're "browsing the internet properly in a way that is compliant with company XYZ's policies", or even when running other software like a photo edito…

Would that not create the issue that you would only need to find one bypass for said official anti-cheat that then works for all games out there?

I heard with Denuvo reverse engineering work needs to be done for each individual target to unprotect it, but I'm not sure how this will be the case with a first party anti-cheat driver.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#37

Post by direwolf20 »

charcircuit wrote: post #32
direwolf20 wrote: post #28

Earlier quoted context omitted.

As an indie game developer, how do I get my game into this system and how do I debug it?

For this theoretical feature Windows would do it automatically for apps that would opt in. For debugging you would either not have this feature or enabled, or you would build a custom build that included a debugger in the secure environment. If you needed to connect to production servers you could whitelist your account to be ignored by the anticheat since your server would know you are not playing with an official b…

If it's a simple flag in the executable file header, what stops a cheat program setting the same flag and getting into the sandbox?

Or a cheat program combining itself with the game executable, and setting the flag so other processes can't interrogate whether it contains a cheat.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#38

Post by 15155 »

charcircuit wrote: post #24
15155 wrote: post #23

Earlier quoted context omitted.

> attach malicious devices to the PCI bus to DMA sensitive data How do you do this in modern system with TPMs and IOMMU enabled?

Sadly not all Windows machines are able to use kernel DMA protection, so for those machines nothing will stop you.

The obvious next step is to disallow those elderly machines once a critical mass of users have modern-enough equipment. We're almost there.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#39

Post by 15155 »

direwolf20 wrote: post #29
15155 wrote: post #23

Earlier quoted context omitted.

> attach malicious devices to the PCI bus to DMA sensitive data How do you do this in modern system with TPMs and IOMMU enabled?

You pretend to be a device with a driver not compatible with IOMMU

This is a good move, but why isn't the anti-cheat software just refusing to operate on systems with these devices attached?

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#40

Post by matheusmoreira »

I really don't like how the author minimizes the kernel anticheat situation. It's not "a lot of noise online".

It doesn't matter that user mode software is also vulnerable. We actually have mitigations against many of those user mode problems. Separate user accounts for example. Games can't exfiltrate your browser data if they can't read them.

Obviously kernel mode software can bypass all sorts of operating system controls. Bypassing those controls is the whole reason why they implement anticheat in kernel mode. If they can't bypass these controls, it means the operating system is more powerful than the anticheat, which means it can be defeated.

Yes, proprietary software is inherently untrustworthy and could be malware in disguise. Nobody disputes this, it's happened before and will happen again. It's a good idea to invest in a properly virtualized system where all those games are contained and kept completely separate from the real system. Yet another reason why we don't need idiotic anticheat software bitching about the fact it's been virtualized.

Post reply on HN