10 ms·

This is a great technical breakdown of some modern high level approaches to common cheats. I think this the most transparent approach (even though the author ad

by crsv 8y ago

This is a great technical breakdown of some modern high level approaches to common cheats. I think this the most transparent approach (even though the author admits leaving some detail out) to modern anti-cheat for massive multiplayer games. Good on riot for having an open dialogue about this. I don't think you'd ever see someone like Valve going a transparent route with something like this. (Not making a judgement on that decision, just an observation).

fhood 8y ago
Is this really open dialogue? Correct me if I'm wrong, but basically all of the methods that they mentioned are pretty standard stuff. They had a few interesting twists on these ideas, but in general, things like source code encryption and shuffling memory locations seem pretty basic.
- gameswithgo 8y ago
  if you are familiar enough with the subject matter everything will seem basic.
  - iforgotpassword 8y ago
    Well I have to agree with op. Encryption and obfuscation started with early copy protection systems, even packers like upx offered that iirc. Measurements against memory manipulation have also been around for a while, I encountered them the first time when I tried cheating money in rollercoaster tycoon in 99 or whenever that came out. Obfuscating the network protocol actually seems more of a novelty than those two things.
Trellmor 8y ago
Valves John McDonald recently gave a talk at Gdc how they use machine learning to combat cheaters in CS:GO. Quite interesting to watch. https://m.youtube.com/watch?v=ObhK8lUfIlc# https://m.youtube.com/watch?v=ObhK8lUfIlc#
fredophile 8y ago
Most anti-cheat methods stop working once the details are known. As someone else mentioned, there was a talk at GDC this year about one of their anti-cheat systems. The talk got into a lot of detail about how this particular system worked.
- deleted 8y ago
  [deleted]
Thaxll 8y ago
Because they all do the same so there is no need to share that. Riot is a recent studio, other studios have been doing that for years. As for transparent approach I'm not sure what you're referring to, players don't need to know that kind of things, there is no benefit sharing that to the public.
johnmg 8y ago
Fair context: I make cheats/utilities this exact game being talked about in this article, so perhaps my opinion on the subject is biased or even invalid. I partially disagree about the transparency of this article, while they do explain most of their approach to anti-cheat (and that is pretty cool for them to do), they seem to leave out any mention of anything that could be controversial. It suppose that it does make sense to not mention the implementation details of their anti-cheat, but I wish that they would be a little more transparent about how/when/what they snoop around and send to their servers. The current Mac game client for League Of Legends contains full debug symbols and it doesn't have Packman (the packer described in this article), which makes it quite easy to look through the symbols. Inside you can find all of the anti-cheat-related network packets, in specific: PKT_C2S_EnumDrivers PKT_C2S_EnumProcesses PKT_C2S_EnumDrives PKT_C2S_EnumHandles PKT_C2S_EnumRecentFiles PKT_C2S_EnumModules PKT_C2S_ProcessorData PKT_C2S_SystemState PKT_C2S_ModuleLoadNotification PKT_S2C_SendModule PKT_C2S_ModuleResponse Now, I personally expect anti-cheat to snoop around my system when I'm doing something shady like scanning its memory. However, if I was a normal user of the game, I would be a bit concerned to know that it might be sending my recently used file names, drive names, system driver names, currently running processes, processor information, system state, and even entire binary files that it automatically deems as "suspicious", to their servers.
- mehrdadn 8y ago
  Do you know if process information contains command-line information? Because that could totally contain someone's credentials...
  - kemitche 8y ago
    Which is precisely why it is an antipattern for any program to pass it accept credentials as command line arguments.
    - mehrdadn 8y ago
      I wasn't endorsing the practice.
- 8y ago
tptacek 8y ago
It's a good article but I'd hesitate to call this "modern"; this is circa-2006 AAA title security. Serious content protection is significantly more sophisticated than this. (I'm not an expert but I've done some anti-cheating pentests before, and have seen literally all these primitives deployed on old titles).

by crsv 8y ago

fhood 8y ago

Is this really open dialogue? Correct me if I'm wrong, but basically all of the methods that they mentioned are pretty standard stuff. They had a few interesting twists on these ideas, but in general, things like source code encryption and shuffling memory locations seem pretty basic.

gameswithgo 8y ago
if you are familiar enough with the subject matter everything will seem basic.
- iforgotpassword 8y ago
  Well I have to agree with op. Encryption and obfuscation started with early copy protection systems, even packers like upx offered that iirc. Measurements against memory manipulation have also been around for a while, I encountered them the first time when I tried cheating money in rollercoaster tycoon in 99 or whenever that came out. Obfuscating the network protocol actually seems more of a novelty than those two things.

Trellmor 8y ago

Valves John McDonald recently gave a talk at Gdc how they use machine learning to combat cheaters in CS:GO. Quite interesting to watch. https://m.youtube.com/watch?v=ObhK8lUfIlc# https://m.youtube.com/watch?v=ObhK8lUfIlc#

fredophile 8y ago

Most anti-cheat methods stop working once the details are known. As someone else mentioned, there was a talk at GDC this year about one of their anti-cheat systems. The talk got into a lot of detail about how this particular system worked.

deleted 8y ago
[deleted]

Thaxll 8y ago

Because they all do the same so there is no need to share that. Riot is a recent studio, other studios have been doing that for years. As for transparent approach I'm not sure what you're referring to, players don't need to know that kind of things, there is no benefit sharing that to the public.

johnmg 8y ago

Fair context: I make cheats/utilities this exact game being talked about in this article, so perhaps my opinion on the subject is biased or even invalid. I partially disagree about the transparency of this article, while they do explain most of their approach to anti-cheat (and that is pretty cool for them to do), they seem to leave out any mention of anything that could be controversial. It suppose that it does make sense to not mention the implementation details of their anti-cheat, but I wish that they would be a little more transparent about how/when/what they snoop around and send to their servers. The current Mac game client for League Of Legends contains full debug symbols and it doesn't have Packman (the packer described in this article), which makes it quite easy to look through the symbols. Inside you can find all of the anti-cheat-related network packets, in specific: PKT_C2S_EnumDrivers PKT_C2S_EnumProcesses PKT_C2S_EnumDrives PKT_C2S_EnumHandles PKT_C2S_EnumRecentFiles PKT_C2S_EnumModules PKT_C2S_ProcessorData PKT_C2S_SystemState PKT_C2S_ModuleLoadNotification PKT_S2C_SendModule PKT_C2S_ModuleResponse Now, I personally expect anti-cheat to snoop around my system when I'm doing something shady like scanning its memory. However, if I was a normal user of the game, I would be a bit concerned to know that it might be sending my recently used file names, drive names, system driver names, currently running processes, processor information, system state, and even entire binary files that it automatically deems as "suspicious", to their servers.

mehrdadn 8y ago
Do you know if process information contains command-line information? Because that could totally contain someone's credentials...
- kemitche 8y ago
  Which is precisely why it is an antipattern for any program to pass it accept credentials as command line arguments.
  - mehrdadn 8y ago
    I wasn't endorsing the practice.
8y ago

tptacek 8y ago

It's a good article but I'd hesitate to call this "modern"; this is circa-2006 AAA title security. Serious content protection is significantly more sophisticated than this. (I'm not an expert but I've done some anti-cheating pentests before, and have seen literally all these primitives deployed on old titles).