Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Call of Duty anti-cheat

ssno.cc

Post reply on HN
Print view View original

51–60 of 223 posts

Re: Reverse engineering Call of Duty anti-cheat

#51

Post by Cyph0n »

landr0id wrote: post #32
Cyph0n wrote: post #15

Earlier quoted context omitted.

No idea what signature scanning is, but found this resource for those curious: https://www.unknowncheats.me/forum/general-programming-and-r...

Signature scanning is just scanning for unique bytes from a compiled function that will remain consistent across builds. You search memory for those bytes and when you find them, you find the function you're interested in. Here's an example from some shellcode loader I wrote: https://github.com/exploits-forsale/solstice/blob/c3fc9a55c6...

Thanks for explaining. How do you identify such byte patterns that are likely stable across builds? Is it experimental - i.e., look at a few versions of the binary and check if it has changed?

Re: Reverse engineering Call of Duty anti-cheat

#52

Post by jamesfinlayson »

andrewmcwatters wrote: post #3
shj2105 wrote: post #2

Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.

Dang, I'm old. I was going to say hang out in Gamedeception, but apparently it's been gone for years! greetz to readers of Unknowncheats, cs.rin.ru, etc.

Gosh, haven't been to cs.rin.ru for years.

UnknownCheats was (still is?) good for getting information on undocumented APIs when game modding (for a good while the Half-Life SDK was incomplete).

Re: Reverse engineering Call of Duty anti-cheat

#53

Post by jamesfinlayson »

andrewmcwatters wrote: post #4

Signature scanning is indeed the hot shit. It's like the most addicting part of reverse engineering to me. Building signature lists, and then writing bindings to scripting languages to call those function pointers. It's also the foundation of how many third-party mod platforms work, because you need to build a meaningful API to modders that isn't exposed by the first-party.

> It's also the foundation of how many third-party mod platforms work

Sure is - I believe a few Source engine plugins do this when required (though mostly I think they use offsets into vtable pointers).

Re: Reverse engineering Call of Duty anti-cheat

#54

Post by dcrazy »

DSMan195276 wrote: post #31
jychang wrote: post #17

Earlier quoted context omitted.

How do functions that not end in ret work?

In addition to what others said, I'd simply point out that all 'ret' does on x86 is pop an address off the top of the stack and jump to it. It's more of a "helper" than a special instruction and it's use is never required as long as you ensure the stack will be kept correct (such as with a tail-call situation).

`ret` also updates the branch predictor’s shadow stack. Failing to balance `call` and `ret` can seriously impact performance.

Re: Reverse engineering Call of Duty anti-cheat

#55

Post by andrewmcwatters »

kurisufag wrote: post #42
sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

fwiw, cheating in CS(GO) taught me x86 RE and low-level programming way younger than is usual. sophomore year of high school. I still recommend writing an HvH cheat to anyone that wants to get into proggin' -- you get a taste of both static and dynamic RE, memory-level programming, UI development, bare dxsdk (usually), a skid-saturated environment, sysadmin (if you try to set yourself up an uber1337 cheat page), and…

Most hackers in the space start out at the freshman year or middle school age, my dude. Was the case 20 years ago.

Re: Reverse engineering Call of Duty anti-cheat

#56

Post by Crestwave »

aalimov_ wrote: post #34
sas41 wrote: post #21

Cheating in multiplayer games has become such a huge problem, it has destroyed trust across every major FPS. I am a long time CS player, but I did briefly play one of the new CoD games, before they went crazy with Nicki Minaj skins and bong-guns. A person was so convinced I was cheating, they started doing OSINT on me while still in a match, and they found my old UnKnOwNcHeAtS account as some kind of proof that I am…

EFT also uses kernel level anti-cheat “Easy Anti-Cheat” (as invasive as what valorant uses (vanguard)). Don’t know why ETF implementation sucks. I’ve been on CS since 1.3, and i think their system is pretty good. Sure you get cheaters sometimes, but it’s not that bad, maybe I’ve been pretty lucky.

One difference between EAC and Vanguard is that the latter needs to be loaded on boot, so you need to reboot every time you want to play if you don't want to have it running all the time (which is a common use-case since it has a history of interfering with legitimate programs).

Re: Reverse engineering Call of Duty anti-cheat

#58

Post by xeonmc »

andrewmcwatters wrote: post #55
kurisufag wrote: post #42

Earlier quoted context omitted.

fwiw, cheating in CS(GO) taught me x86 RE and low-level programming way younger than is usual. sophomore year of high school. I still recommend writing an HvH cheat to anyone that wants to get into proggin' -- you get a taste of both static and dynamic RE, memory-level programming, UI development, bare dxsdk (usually), a skid-saturated environment, sysadmin (if you try to set yourself up an uber1337 cheat page), and…

Most hackers in the space start out at the freshman year or middle school age, my dude. Was the case 20 years ago.

Usually by the time you are in working age people have outgrown the e-ego waving contest to be incentivized to cheat in an inconsequential video game*

*with some exceptions.

Re: Reverse engineering Call of Duty anti-cheat

#59

Post by b3lvedere »

mdswanson wrote: post #57

A 2-year legal battle with Activision to overturn a false permanent ban. Activision showed up with zero evidence of cheating and lost: https://antiblizzard.win/2025/01/18/my-two-year-fight-agains...

Holy ….. what a fight you had to do. So glad i hardly play any mulitiplayer shooter games. I’d hate to have my insane Steam library stripped away from me.

Re: Reverse engineering Call of Duty anti-cheat

#60

Post by kurisufag »

andrewmcwatters wrote: post #55
kurisufag wrote: post #42

Earlier quoted context omitted.

fwiw, cheating in CS(GO) taught me x86 RE and low-level programming way younger than is usual. sophomore year of high school. I still recommend writing an HvH cheat to anyone that wants to get into proggin' -- you get a taste of both static and dynamic RE, memory-level programming, UI development, bare dxsdk (usually), a skid-saturated environment, sysadmin (if you try to set yourself up an uber1337 cheat page), and…

Most hackers in the space start out at the freshman year or middle school age, my dude. Was the case 20 years ago.

it wasn't a brag or anything, i just don't know by what means i would've been introduced to that stuff other than game cheats. 15-year-old-me definitely did not care about crackmes or malware reversing.

i did start writing code in middle school, though. php, mostly :)

Post reply on HN