5 ms·
(Wrote anti-cheat software in the past.) There are multiple ways to detect this. Hardware breakpoints were already mentioned, but they only work per thread, so
by HHad3 4y ago
(Wrote anti-cheat software in the past.)
There are multiple ways to detect this. Hardware breakpoints were already mentioned, but they only work per thread, so if one is sniffing on your memory from another process or the kernel then these won't help.
The most stealthy and evil way I found was to allocate a page but never actually use it.
Windows lazily allocates physical memory for fresh memory pages when they are first used.
The detection is to periodically poll the page map from your process and check your canary pages via NtQueryVirtualMemory. If your unused page suddenly is backed by some physical memory then something happened to read from it! Bonus-points for putting such canary pages into places previously used for real game data.
This method is not foolproof: Anti-virus programs can read memory of all programs (but don't, Overwatch e.g. does not like this and crashes randomly due to this exact protection method). A bug in the program could also read from the page accidentally (e.g. out-of-bounds array read). But it's a /very/ good indicator that something is wrong when other cheat detection mechanisms also trigger.
Once you know how this works it's pretty easy to defeat unfortunately: Read the page map first, then avoid reading pages that have no backing physical memory, because those contain no useful data at best and are canary pages at worst.
- pixl97 4y agoHmm, this sounds like you should always run your cheat tools with the executable name/faked exe information of anti-virus application.
- rogers18445 4y agoI used to work on an anti-cheat briefly, and migrated away form relying on Windows API to do this as the parent comment suggested, instead we used cache timing "attacks". Antivirus was a concern but easily solved by the fact that cheats access memory many times a second, antivirus does it rarely if ever.
- HHad3 4y agoAuthor of parent comment here: Interesting insight! I love (and somewhat miss) this industry because the game of cat and mice is never over.
- HHad3 4y agoOldest trick in the book, good luck faking the PE signature to match the vendor's certificate ;-) (Jokes aside, the kernel does not provide any information about which application reads a canary page. It's best to just use this as necessary condition and take it with a good pinch of salt.)
- sprite 4y agoLove this topic. I remember Everquest used to checksum areas of memory that were commonly modified from cheats. World of Warcraft used to (possibly still does, it has been forever since I looked at this) inject anti cheat code at runtime. Obfuscation and deobfuscation is also super interesting. I think overall reverse engineering and figuring out how things work is one of the most interesting things in computer science. https://github.com/obfuscator-llvm/obfuscator/tree/llvm-4.0/lib/Transforms/Obfuscation https://github.com/obfuscator-llvm/obfuscator/tree/llvm-4.0/... https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm-protected-program.html https://blog.quarkslab.com/deobfuscation-recovering-an-ollvm...
- mabbo 4y agoWorld of Warcraft did something that I've always found delightful: hidden stenographic watermarking on all screenshots. It took like a decade before anyone noticed, but all screenshots were very very very slightly modified to hide (in plain sight) a blob of data that gave the account name, date, time, server, etc. Just in case a screenshot ever got posted and they really needed to know who took it and when.
- d110af5ccf 4y ago> that I've always found delightful Leaking user data to me is a betrayal of trust, incredibly distasteful, and probably borders on illegal (it ought to be imo). Note that this is fundamentally different than watermarking streaming content or other material that the user is not legally permitted to copy. Watermarking the game binaries themselves, for example, would be entirely different and perfectly acceptable from my perspective.
- FateOfNations 4y agoWhile WoW didn't do this, one could avoid disclosing user data to third parties by encrypting the watermark payload.
- rany_ 4y ago
- rcoveson 4y agoKind of sad but funny to imagine like two or three nerds who got banned because they had messed with their kernel page fault readahead settings which just so happened to fault a sentinel page.
- steakscience 4y agoHow do they filter out false positives from antiviruses reading the files?