Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anti-cheat kernel driver

na.leagueoflegends.com

Post reply on HN
Print view View original

41–50 of 115 posts

Re: Anti-cheat kernel driver

#41

Post by blibble »

xenadu02 wrote: post #31
blibble wrote: post #23

Earlier quoted context omitted.

quite a few games prevent you running on a hypervisor (e.g. CSGO) this was one reason I stopped gaming under Windows inside KVM (the main reason being input lag/jitter) eventually all the cheats will move into the hypervisor and every competitive game will ban the use of virtualisation

Probably only because most hypervisors don't bother to hide themselves. There's no reason you couldn't prevent detection. Not to mention some people are creating FPGA boards that use DMA to read memory, something no one is setup to prevent (would require an IOMMU and an OS that bothered to configure it properly; also very difficult to differentiate legit cards from cheating cards and an area game developers have zero…

there's so many ways to detect a hypervisor, particurarly so if you want your VM to be of sufficiently high performance to play competitively

and then there's the statistical methods (measuring anything that causes a VMEXIT is a good candidate)

modern OSes already support the IOMMU (macOS enables it on by default apparently), however outside of that hardware support is patchy at best

ultimately if they're trying to guard the top of the ladder (say the top 0.05%), they could demand you use a certain set of hardware, and the hardcore would put up with it

Re: Anti-cheat kernel driver

#42

Post by bob1029 »

Ah yes. A kernel-level security feature provided by a software company wholly-owned by a Chinese conglomerate.

I do not think I will continue running their software on my machines.

Also, many other posters here have commented that kernel-level mitigations are futile in the face of hypervisor or hardware attacks. What's to stop me from altering system memory arbitrarily using a PCIe device I control externally? How would you even detect this from the perspective of the OS kernel? What if I compromise the private key in the game's network "security" layer and start reading & altering packets? Unless you 100% control the hardware (including mouse, keyboard and monitor, network, internet backbone, etc), you will always have this problem. The only way to have a cheat-proof gaming experience is to set up a LAN tournament and have all hardware provided to players (and even then, you should pour epoxy into the USB ports).

At some point you are going to have to start looking in other directions for solutions to this problem. I believe other games have started using statistical and machine learning systems to detect cheaters rather than trying to match arbitrary binary hashes on my machine (which is what I presume Riot is going to do here). I feel statistical soft-ban systems are a much more reasonable way to handle this problem than the 100% confirmed binary signature permaban systems that seem an obsessive fantasy for some in the industry. Statistical methods directly deal with the impact of the problem whereas perfect match only gets at one of an infinite number of possible causes.

Re: Anti-cheat kernel driver

#43

Post by DoofusOfDeath »

outworlder wrote: post #33
MuffinFlavored wrote: post #24

Earlier quoted context omitted.

Does this mean the app will need to run as root while the user is playing?

No but the cheat software will run in the kernel. Which is > than root. In all likelihood – unless these guys are uncharacteristically careful – it will stay there even when you are not playing and become an attack vector.

> In all likelihood – unless these guys are uncharacteristically careful – it will stay there even when you are not playing and become an attack vector.

Might it be an attack vector even while the game is playing?

Re: Anti-cheat kernel driver

#44

Post by int_19h »

xenadu02 wrote: post #29
akersten wrote: post #15

Earlier quoted context omitted.

Yep. The article even smugly tries to boast about how they're adults and understand these things : > We haven’t needed both arms yet, primarily because we have the advantage of steady paychecks and the lack of strict bedtimes at our immediate disposal. But as much as we might like the idea of an ever-escalating appsec war with teenagers, And yet they fail to realize that they're playing in to the very cat-and-mouse g…

That's correct. The ability to cheat relies on the fact that servers don't actually model the client's view of the world to any fidelity. The server sends you information about the world you can't see so it doesn't have to do the culling. It accepts clearly impossible input that is obviously not human because statistical analysis would require some data scientists who are quite difficult to hire at the bargain-baseme…

Servers usually try to do culling, if only to optimize network traffic. But they can't cull in real time, because the visual lag from round-trip to the server would be too much; and if the client doesn't wait for the server, then the player would see gaps in the world if they move around fast enough that server can't catch up. So they pessimistically provide more data than the client "should "know about.

Re: Anti-cheat kernel driver

#45

Post by kube-system »

MuffinFlavored wrote: post #26
mkj wrote: post #4

I guess next step is for cheat software to run in a hypervisor. Now what're you gonna do!

Imagine running a video game in a Docker container...

I've actually done it, for a purpose unrelated to this topic.

Although if you're trying to circumvent something in the kernel, using a Docker container isn't going to work. Docker containers share the host kernel.

Re: Anti-cheat kernel driver

#46

Post by int_19h »

m4rtink wrote: post #16
mkj wrote: post #4

I guess next step is for cheat software to run in a hypervisor. Now what're you gonna do!

Exactly - strict sandboxing and isolation is the only thing a sane user should apply to a game using such "anticheat" garbage. A game fidling with the OS kernel ? Like, seriously ??

For better or worse, anti-cheat and DRM kernel drivers have been a thing since WinXP (and would have been before then, if Win9x required that for full system access).

Re: Anti-cheat kernel driver

#47

Post by wyqydsyq »

jitl wrote: post #30
tomc1985 wrote: post #25

These horrible analogies make me want to stab the writer with a pen How about he just writes technically and lets reddit comments translate? I'm so sick of writers' concerns for illiterate proles (along with, in this case, a seeming need to maintain the energy and punch of a memetastic for-12-year-olds YouTuber) ruining perfectly good technical writing

I decided to downvote you for both a gate-keeping attitude (how dare a non-SWE else understand a bit of this stuff?) and for name calling, etc. Please consider learning some empathy.

> This person said something I don't like, guess I had better behave like a gatekeeper while hypocritically accusing them of being one

This is you right now

Re: Anti-cheat kernel driver

#48

Post by [deleted] »

bob1029 wrote: post #42

Ah yes. A kernel-level security feature provided by a software company wholly-owned by a Chinese conglomerate. I do not think I will continue running their software on my machines. Also, many other posters here have commented that kernel-level mitigations are futile in the face of hypervisor or hardware attacks. What's to stop me from altering system memory arbitrarily using a PCIe device I control externally? How wo…

[deleted]

Re: Anti-cheat kernel driver

#49

Post by wyqydsyq »

akersten wrote: post #15
mkj wrote: post #4

I guess next step is for cheat software to run in a hypervisor. Now what're you gonna do!

Yep. The article even smugly tries to boast about how they're adults and understand these things : > We haven’t needed both arms yet, primarily because we have the advantage of steady paychecks and the lack of strict bedtimes at our immediate disposal. But as much as we might like the idea of an ever-escalating appsec war with teenagers, And yet they fail to realize that they're playing in to the very cat-and-mouse g…

I can't wait for this situation to escalate to the point where Riot are trying to sell their own bespoke hardware, required to play their games

Re: Anti-cheat kernel driver

#50

Post by some-guy »

stealthascope wrote: post #40
some-guy wrote: post #17

Earlier quoted context omitted.

This is why I appreciate still being close high school LAN party friends close online--I can start a group chat and get a game going between each other, and maybe they can invite a friend of theirs to get the number of players up for a game. If you can manage to maintain these relationships then online gaming can be very rewarding without having to worry about the trainwreck you described. This doesn't work with all…

Did they ever release a version of 2k4 for linux? I can play the UT2003 native version for linux just fine (doesn't seem to play nice with amdgpu, but the intel driver seems to be fine).

I don’t think they ever did. I run mine in Steam using Proton without any configuration minus a widescreen fix, which has actually been a lot easier than trying to get it to work in Windows 10 (I use amdgpu)
Post reply on HN