5 ms·

The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the

The game is 100% online. Could you have a piece of the networking protocol where the server sends little snippets of executable code over the network during the game that read some specific locations in memory, do some processing, and send the results back to the server in the next packet? You could do things like check the starting address and length of loaded dlls, or take the hash of some random span of machine code, or even random locations in the heap, all of which may or may not actually be verified on the other end. You can use any number of obsfucation tricks to hide their purpose (if they even have one) and you could even randomly generate them. And since the server expects the response in the next client packet it would be literally impossible for a cheater to manually deconstruct them, and even be difficult for automatic analysis tools to have enough time to do anything meaningful with it. You can reduce the security nightmare from the user's perspective by only allowing machine code that's on a tight whitelist. Allow it to read from anywhere, and only let it write to a dedicated little sandbox area with e.g. fixed addresses.

deleted 8y ago
[deleted]
bitexploder 8y ago
If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it. You may have some hope in network delivery of graphics only. If I am not running the game client code, and just streaming the game from one of your servers, you have a chance at keeping your client safe.
- jonjojr 8y ago
  "If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it." sure try to undo a block-chain and see what happens. The code will be encrypted with a unique key that will need to be registered on the server with your account. Change that code and it invalidates your entire build along with your account. case closed.
  - iancarroll 8y ago
    Blockchains are not a solution here. This comment doesn't make much sense; your proposed solution is missing a lot of details. If there was a simple solution to this problem there would not be insanely complicated packers that basically try to make their own instruction set.
  - tangent128 8y ago
    If the player controls the CPU the code is running on, there is fundamentally no way to enforce they are actually running the code provided.
  - throwaway2048 8y ago
    This is a very bad analogy, and you have misunderstood the problem to a huge degree.
  - bitexploder 8y ago
    I think you are missing my point. This concept in client computing security basically chains back to the halting problem. You can't /know/ what I am doing with my computer. You can build a very elaborate trap / obfuscation and it might be hard, really hard, to defeat it or circumvent it, but it is a certainty that I can. The block-chain has absolutely nothing to do with client code security because it has a network enforced mechanism. What the grandparent was suggesting was running some nugget of code in a little VM (or actually on my machine), computing a result, and then returning the result to the server to make a security decision. The problem is I control that machine performing that computation and your security decision as the server is based solely on the computation performed on my computer. A skilled reverse engineer will just hook your code in the right place, intercept that security check and have it return the right bytes back to your server, while still doing whatever client side cheats they wanted to do. https://en.wikipedia.org/wiki/Rice%27s_theorem https://en.wikipedia.org/wiki/Rice%27s_theorem <--- this is all about program behavior and did the user actually run the code you sent them. Block chain is about "did I possess certain data" (such as a private key to sign a transaction) and not about "did I run certain code".
    - mikekchar 8y ago
- infogulch 8y ago
  > emulator to execute your machine code I think you missed a part. Namely that "It is allowed to read from anywhere". If it can't write anywhere but the sandbox, that just means it can't modify the game dynamically, just read its state. Which is plenty to verify whether the client has been hacked anywhere. You can read spans of .text to check whether code has been modified, you can read heap locations to check whether the state of the game is valid, and you can take all of that and hash it with a random seed included in the packet to set a high bar on the speed of any emulator. Your emulator would have to dynamically check every access to make sure it doesn't touch anything that has been tampered with, and change the reads to read from un-modified sections, while allowing it to view everything else accurately. Seems like a high level of effort for the cheater, for a low investment from the developer.
  - drdaeman 8y ago
    A sandbox can be a virtual machine, for all practical purposes indistinguishable from any "normal" computers ordinary players use. Of course this will lead to the never ending Ouroboros of more sophisticated detectors and more sophisticated virtualization, ad infinitum. I've heard there are cheats that use hypervisors to stand above the operating systems and avoid kernel-level anti-cheats. I wouldn't be too surprised to learn about cheats that sit on a bus and use DMA to peek into anything they please (subject to the memory protections of IOMMU - again, this war doesn't seem to have an end) - they're probably impractical but not something that couldn't exist.
    - bitexploder 8y ago
      Hah. Are you me? That is what I always call the cat and mouse of cheat / anti cheat. (An Ouroboros) :-D
      - drdaeman 8y ago
        I've just read your comment above and then quoted you without the proper credit ;) Liked the naming.
dividuum 8y ago
So as a cheater you intercept those snippets, lets them do their magic in a dedicated address space that has the same client code loaded?
- infogulch 8y ago
  So you're saying the cheater would have to run a duplicate, unmodified, instance of the game in parallel with the hacked version that the cheater is actually using, while correctly teeing networking traffic and mouse/keyboard inputs, and dynamically inserting the snippet results from the legit copy over top of the results of the hacked copy. That seems like a huge increase in level of effort from cheaters for a relatively small measure from riot. Seems worth it to me.
heeen2 8y ago
You are going to kick players off for a missed packet? Network connections have packet loss and game protocols are usually udp.
- infogulch 8y ago
  Nope, just like any other game state that will eventually have to be synced to the server the results can be synced later. But you can't just run it any time because it reads the state of the game as soon as it arrives.
thefreeman 8y ago
What you describe is very similar to "Warden", Blizzard's anti-cheat system. I'm not sure how up to date this article is but it talks about how it works and approaches to working around it https://hackmag.com/uncategorized/deceiving-blizzard-warden/ https://hackmag.com/uncategorized/deceiving-blizzard-warden/
sigotirandolas 8y ago
It's pretty tricky to build a machine code validator to only be able to write and execute on certain areas... in x86, you have to take care of 'jumping in the middle of an instruction', that not only writes but also jumps are limited to your small area (because otherwise you will end up with something similar to ROP), etc.. I think Google Native Client did something like this, but it doesn't seem trivial. On the other hand, a way to bypass it could be that, when you detect one of those "executable code packets" has to be run, you undo all the injection/hooks in the game (so that you are really running a 100% unmodified process), and let the executable code packet run. After it finishes (you could detect this by a timer, page fault, etc. which can be handled by a different process in a different address space), you inject all the hooks again.

deleted 8y ago

[deleted]

bitexploder 8y ago

If you restrict the machine code it makes it that much easier for me to write an emulator to execute your machine code and return the result. It might even be trivial. It is a never ending Ouroboros. You build a more clever mouse trap, I will design a more clever mouse. If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it. You may have some hope in network delivery of graphics only. If I am not running the game client code, and just streaming the game from one of your servers, you have a chance at keeping your client safe.

jonjojr 8y ago
"If I have all your code and am running it on my computer it will be a matter of time before I can back out whatever obfuscation or technique you are doing and undo it." sure try to undo a block-chain and see what happens. The code will be encrypted with a unique key that will need to be registered on the server with your account. Change that code and it invalidates your entire build along with your account. case closed.
- iancarroll 8y ago
  Blockchains are not a solution here. This comment doesn't make much sense; your proposed solution is missing a lot of details. If there was a simple solution to this problem there would not be insanely complicated packers that basically try to make their own instruction set.
- tangent128 8y ago
  If the player controls the CPU the code is running on, there is fundamentally no way to enforce they are actually running the code provided.
- throwaway2048 8y ago
  This is a very bad analogy, and you have misunderstood the problem to a huge degree.
- bitexploder 8y ago
  I think you are missing my point. This concept in client computing security basically chains back to the halting problem. You can't /know/ what I am doing with my computer. You can build a very elaborate trap / obfuscation and it might be hard, really hard, to defeat it or circumvent it, but it is a certainty that I can. The block-chain has absolutely nothing to do with client code security because it has a network enforced mechanism. What the grandparent was suggesting was running some nugget of code in a little VM (or actually on my machine), computing a result, and then returning the result to the server to make a security decision. The problem is I control that machine performing that computation and your security decision as the server is based solely on the computation performed on my computer. A skilled reverse engineer will just hook your code in the right place, intercept that security check and have it return the right bytes back to your server, while still doing whatever client side cheats they wanted to do. https://en.wikipedia.org/wiki/Rice%27s_theorem https://en.wikipedia.org/wiki/Rice%27s_theorem <--- this is all about program behavior and did the user actually run the code you sent them. Block chain is about "did I possess certain data" (such as a private key to sign a transaction) and not about "did I run certain code".
  - mikekchar 8y ago
infogulch 8y ago
> emulator to execute your machine code I think you missed a part. Namely that "It is allowed to read from anywhere". If it can't write anywhere but the sandbox, that just means it can't modify the game dynamically, just read its state. Which is plenty to verify whether the client has been hacked anywhere. You can read spans of .text to check whether code has been modified, you can read heap locations to check whether the state of the game is valid, and you can take all of that and hash it with a random seed included in the packet to set a high bar on the speed of any emulator. Your emulator would have to dynamically check every access to make sure it doesn't touch anything that has been tampered with, and change the reads to read from un-modified sections, while allowing it to view everything else accurately. Seems like a high level of effort for the cheater, for a low investment from the developer.
- drdaeman 8y ago
  A sandbox can be a virtual machine, for all practical purposes indistinguishable from any "normal" computers ordinary players use. Of course this will lead to the never ending Ouroboros of more sophisticated detectors and more sophisticated virtualization, ad infinitum. I've heard there are cheats that use hypervisors to stand above the operating systems and avoid kernel-level anti-cheats. I wouldn't be too surprised to learn about cheats that sit on a bus and use DMA to peek into anything they please (subject to the memory protections of IOMMU - again, this war doesn't seem to have an end) - they're probably impractical but not something that couldn't exist.
  - bitexploder 8y ago
    Hah. Are you me? That is what I always call the cat and mouse of cheat / anti cheat. (An Ouroboros) :-D
    - drdaeman 8y ago
      I've just read your comment above and then quoted you without the proper credit ;) Liked the naming.

dividuum 8y ago

So as a cheater you intercept those snippets, lets them do their magic in a dedicated address space that has the same client code loaded?

infogulch 8y ago
So you're saying the cheater would have to run a duplicate, unmodified, instance of the game in parallel with the hacked version that the cheater is actually using, while correctly teeing networking traffic and mouse/keyboard inputs, and dynamically inserting the snippet results from the legit copy over top of the results of the hacked copy. That seems like a huge increase in level of effort from cheaters for a relatively small measure from riot. Seems worth it to me.

heeen2 8y ago

You are going to kick players off for a missed packet? Network connections have packet loss and game protocols are usually udp.

infogulch 8y ago
Nope, just like any other game state that will eventually have to be synced to the server the results can be synced later. But you can't just run it any time because it reads the state of the game as soon as it arrives.

thefreeman 8y ago

What you describe is very similar to "Warden", Blizzard's anti-cheat system. I'm not sure how up to date this article is but it talks about how it works and approaches to working around it https://hackmag.com/uncategorized/deceiving-blizzard-warden/ https://hackmag.com/uncategorized/deceiving-blizzard-warden/

sigotirandolas 8y ago

It's pretty tricky to build a machine code validator to only be able to write and execute on certain areas... in x86, you have to take care of 'jumping in the middle of an instruction', that not only writes but also jumps are limited to your small area (because otherwise you will end up with something similar to ROP), etc.. I think Google Native Client did something like this, but it doesn't seem trivial. On the other hand, a way to bypass it could be that, when you detect one of those "executable code packets" has to be run, you undo all the injection/hooks in the game (so that you are really running a 100% unmodified process), and let the executable code packet run. After it finishes (you could detect this by a timer, page fault, etc. which can be handled by a different process in a different address space), you inject all the hooks again.