Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

vespalec.com

Post reply on HN
Print view View original

41–50 of 52 posts

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#41

Post by Orphis »

direwolf20 wrote: post #37
charcircuit wrote: post #32

Earlier quoted context omitted.

For this theoretical feature Windows would do it automatically for apps that would opt in. For debugging you would either not have this feature or enabled, or you would build a custom build that included a debugger in the secure environment. If you needed to connect to production servers you could whitelist your account to be ignored by the anticheat since your server would know you are not playing with an official b…

If it's a simple flag in the executable file header, what stops a cheat program setting the same flag and getting into the sandbox? Or a cheat program combining itself with the game executable, and setting the flag so other processes can't interrogate whether it contains a cheat.

You don't "get into the sandbox", if a cheat program opted in, they would be launched into a separate instance that's distinct from the game.

And you would sign your files, which get verified by the integrity platform and allow you to authenticate with the servers securely.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#42

Post by whs »

bri3d wrote: post #6
supersing wrote: post #4

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should pro…

> you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If someone wants to sell something that comes with a driver, the driver needs a modicum of care applied to it. This is of course also on Microsoft for signing these things, although that ship sailed ages ago. Yes, I wouldn't expect every studio to need their own team - game studios can buy anti-cheat middleware, and t…

I think we ended up in this situation because of this outsourcing. Competitive games and MMO need comprehensive security solution, as cheating has a global lasting impact in matchmaking. Attackers may also have financial motivation to attack the anti cheat in these games.

Coop games might don't need as much security as competitive games, as some games do not have global state, or the global state is simply cosmetics. Since nowadays all the anticheat you can buy (except VAC) are kernel mode you'll have to accept the security risk just to have fun with your friends.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#43

Post by hsbauauvhabzb »

direwolf20 wrote: post #30
ronsor wrote: post #9

Earlier quoted context omitted.

The problem is that general purpose computing platforms are not supposed to be secured against the user. That's a WONTFIX.

User ownership of their devices has been fixed on every platform except PCs.

And most other device types have a specific purpose, with the exception of mobile phones which were built from the ground up with device control in mind, mobile devices only really support one operating system barring edge case exceptions.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#44

Post by hsbauauvhabzb »

RobotToaster wrote: post #31
supersing wrote: post #7

Earlier quoted context omitted.

It is not realistic to expect every game developer to invest a lot of money into security. It's like asking every apartment building to run its own fire department. The responsibility of securing a platform should not fall on application developers anyway.

Microsoft could easily secure windows by blocking all rootkits/"kernel anti cheat". At this point that's probably the best option. Games should never have kernel level access.

Games are a multi billion dollar industry that Microsoft has a stake in. A better option would be a ‘games mode’ and a ‘secure mode’.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#45

Post by uhuhuhuhuhuh »

15155 wrote: post #23
charcircuit wrote: post #14

Earlier quoted context omitted.

Exactly, which is why Microsoft should be writing the one writing the kernel code needed for ensuring integrity of games. Microsoft needs to develop ways to allow games to run in an isolated VM that is hardware protected from the main operating system and ensures strong hardware security so cheaters can not simply attach malicious devices to the PCI bus to DMA sensitive data.

> attach malicious devices to the PCI bus to DMA sensitive data How do you do this in modern system with TPMs and IOMMU enabled?

Flash custom firmware emulating some benign "donor card".

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#46

Post by direwolf20 »

hsbauauvhabzb wrote: post #43
direwolf20 wrote: post #30

Earlier quoted context omitted.

User ownership of their devices has been fixed on every platform except PCs.

And most other device types have a specific purpose, with the exception of mobile phones which were built from the ground up with device control in mind, mobile devices only really support one operating system barring edge case exceptions.

Because only one was written, but there's more than one because there's LineageOS — if you can bypass Secure Boot.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#47

Post by direwolf20 »

Orphis wrote: post #41
direwolf20 wrote: post #37

Earlier quoted context omitted.

If it's a simple flag in the executable file header, what stops a cheat program setting the same flag and getting into the sandbox? Or a cheat program combining itself with the game executable, and setting the flag so other processes can't interrogate whether it contains a cheat.

You don't "get into the sandbox", if a cheat program opted in, they would be launched into a separate instance that's distinct from the game. And you would sign your files, which get verified by the integrity platform and allow you to authenticate with the servers securely.

Sounds very similar to total platform lockdown

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#48

Post by hsbauauvhabzb »

direwolf20 wrote: post #46
hsbauauvhabzb wrote: post #43

Earlier quoted context omitted.

And most other device types have a specific purpose, with the exception of mobile phones which were built from the ground up with device control in mind, mobile devices only really support one operating system barring edge case exceptions.

Because only one was written, but there's more than one because there's LineageOS — if you can bypass Secure Boot.

That an edge case. Linage works on a subset of devices. Find me an amd64 computer that doesn’t support Linux.

I think you’d agree that it would be far easier to technically and socially lock mobile devices to signed deployments only, with jailbreaks becoming rarer and more valuable over time, than to do the same with desktop and laptop computers, due to their requirement to support many different functional requirements (PcIe, thunderbolt peripherals, distributed compute, etc).

I’m not saying I like this, but I think phones will become a single viable OS and locked down ecosystem in the next 5 years. Desktops will follow, but not at the same rate.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#49

Post by charcircuit »

direwolf20 wrote: post #47
Orphis wrote: post #41

Earlier quoted context omitted.

You don't "get into the sandbox", if a cheat program opted in, they would be launched into a separate instance that's distinct from the game. And you would sign your files, which get verified by the integrity platform and allow you to authenticate with the servers securely.

Sounds very similar to total platform lockdown

It is similar except it's only a total lockdown of the sandbox.

Re: I reversed Tower of Fantasy's anti-cheat driver: a BYOVD toolkit never loaded

#50

Post by direwolf20 »

15155 wrote: post #39
direwolf20 wrote: post #29

Earlier quoted context omitted.

You pretend to be a device with a driver not compatible with IOMMU

This is a good move, but why isn't the anti-cheat software just refusing to operate on systems with these devices attached?

Because banning players from playing your game leads to refunds and bad publicity
Post reply on HN