Reverse engineering Call of Duty anti-cheat
1–10 of 223 posts
Re: Reverse engineering Call of Duty anti-cheat
#2Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.
Re: Reverse engineering Call of Duty anti-cheat
#3Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.
Dang, I'm old. I was going to say hang out in Gamedeception, but apparently it's been gone for years!
greetz to readers of Unknowncheats, cs.rin.ru, etc.
Re: Reverse engineering Call of Duty anti-cheat
#4Signature scanning is indeed the hot shit.
It's like the most addicting part of reverse engineering to me. Building signature lists, and then writing bindings to scripting languages to call those function pointers.
It's also the foundation of how many third-party mod platforms work, because you need to build a meaningful API to modders that isn't exposed by the first-party.
Re: Reverse engineering Call of Duty anti-cheat
#5I'm very curious about the jump obfuscation. Maybe somebody who's done more reverse-engineering can answer this for me:
a) Are unconditional jumps common enough that they couldn't be filtered out with some set of pre-conditions?
b) It seems like finding the end of a function would be easy, because there's a return. Is there some way to analyze the stack so that you know where a function is returning to, then look for a call immediately preceding the return address?
Re: Reverse engineering Call of Duty anti-cheat
#6I'm very curious about the jump obfuscation. Maybe somebody who's done more reverse-engineering can answer this for me: a) Are unconditional jumps common enough that they couldn't be filtered out with some set of pre-conditions? b) It seems like finding the end of a function would be easy, because there's a return. Is there some way to analyze the stack so that you know where a function is returning to, then look for…
Unconditional jumps are very common and everything in x86 assembly is very very messy after optimizations. Many functions do not end in ret.
Re: Reverse engineering Call of Duty anti-cheat
#7I'm very curious about the jump obfuscation. Maybe somebody who's done more reverse-engineering can answer this for me: a) Are unconditional jumps common enough that they couldn't be filtered out with some set of pre-conditions? b) It seems like finding the end of a function would be easy, because there's a return. Is there some way to analyze the stack so that you know where a function is returning to, then look for…
Yeah, should be easy enough to filter these particular jumps out. It's an obfuscation designed to annoy people using common off-the-shelf tools (especially IDA pro)
Most obfuscations are only trying to annoy people just enough that they move on to other projects.
Re: Reverse engineering Call of Duty anti-cheat
#8Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.
I got started with Lena151's tutorials back in the day.
https://github.com/kosmokato/Lena151
Re: Reverse engineering Call of Duty anti-cheat
#9Where did you learn how to do this? I would love to learn more about understanding half of what this article said but I don’t know how to start.
Dang, I'm old. I was going to say hang out in Gamedeception, but apparently it's been gone for years! greetz to readers of Unknowncheats, cs.rin.ru, etc.
I used to frequent cs.rin.ru for all things non-steam back when I operated non-steam CSS servers.
UnknownCheats is also absolutely amazing for cheat development. Back when I was writing undetected kernel cheats for my own experimentation purposes, I learned so much there.
Re: Reverse engineering Call of Duty anti-cheat
#10I have been doing a bit of reverse engineering on a popular Horde/Alliance based MMO game and it follows almost the exact same steps (including the FNV32 export hashes). It almost seems very similar as I have seen it employ very similar tricks. I wonder if it's packed using the same protection?