7 ms·
Return-oriented programming-based CSGO, BF3, BF4 cheat
- hatsunearu 7y ago> So hopefully this cheat will be VAC / PB undetected for ever yeah... until they patch it
- emsy 7y agoAs for VAC, it can’t even detect spinbotters. Given its track record I‘m certain there won’t be any patch whatsoever.
- willis936 7y agoAre you sure VAC doesn’t detect spin botters? Valve has implemented neural net based cheat detection trained from overwatch cases (players watching demos of reported players and judging if they were cheating). It’s a rather nice solution and doesn’t involve kernel mode drivers from a third party I don’t trust to make secure kernel mode drivers (a la battle eye or punk buster). https://youtu.be/ObhK8lUfIlc https://youtu.be/ObhK8lUfIlc
- deleted 7y ago[deleted]
- 0_gravitas 7y agoYikes, I really don't want an effective random number generator deciding whether or not if I get to keep using the product I payed for. Refuting a cheat-accusation/action is pretty much impossible as is.
- rhinoceraptor 7y agoAFAIK, the ML piece only selects candidates to review for cheating. The overwatch volunteer(s) still need to watch your demo and judge if you're cheating.
- emsy 7y agoI still get to see them play full games when I do overwatch myself. This should be a round 1 kick, instead they waste everyone’s time and ruin their experience. Same goes for obvious wall- and aimhacks. I see non obvious cheaters every 2nd game or so (players following but not tracing you through walls or soft aimlocks for example). VAC doesn’t do any process analysis as far as I know and as such, it will only ever be able to ban players after the fact (if it does even that, because „legit“ hacks will almost always pass due to overwatches high consensus requirements)
- matzab 7y agoI think overwatch is just there for confirmation in most cases. That makes sense imho. FWIW I tend to only see cheaters on casual. The TrustFactor thing seems to work fairly well, because (judging by Overwatch) the cheaters seem to be among their likes. It must suck for new (non-prime) accounts, though.
- willis936 7y agoIt does. My brother started playing recently and the matches I’s play with him were abysmal. Toxic players, bad communication, no organization, and cheaters relatively often. I bought him the game and it is indeed night and day. I personally just saw my first hacker in a prime lobby in the 300 hours I’ve played since prime became a thing.
- Stevvo 7y agoI haven't seen a spinbotter for ~4 years, I have 500+ hours on CSGO, average 2 games a week. I think VAC is catching them. But it's also possible people don't rage-hack anymore, and prefer the self delusion of stealthy hacks.
- whymauri 7y agoIt's very expensive to rage hack, mostly due to account age and phone number requirements. Sure, you can buy an account or play for 20 hours to get in good standings, in matchmaking - but VAC will evaporate you in a single match.
- emsy 7y agoThey troll F2P and lower ranks very effectively.
- wingerlang 7y agoI recall they also put cheaters together with cheaters, or rather accounts of high quality (no cheating, bought many games, older accs, etc) together.
- olah_1 7y agoIs the idea that this would only be possible in object-oriented programming? And it wouldn't be possible in something like Haskell/Rust?
- saagarjha 7y agoSo this looks like a ROP "template" compiler using a set of gadgets found in the binaries: https://github.com/Speedi13/ROP-COMPILER/blob/master/RopCompiler/Gadgets.h https://github.com/Speedi13/ROP-COMPILER/blob/master/RopComp...? > So hopefully this cheat will be VAC / PB undetected for ever Well, until they remove most of the ROP gadgets or employ CFI?
- deleted 7y ago[deleted]
- dvt 7y ago> Well, until they remove most of the ROP gadgets... This is unfeasible. ROP gadgets essentially show up in "random" locations. Not to mention that they might also show up in code that Valve has no access to.
- saagarjha 7y agoWork has been done to reduce the number of useful gadgets in programs: https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf https://www.openbsd.org/papers/asiabsdcon2019-rop-paper.pdf
- joosters 7y agoPresumably if they built the game with address space layout randomisation then the ROP would be defeated?
- saagarjha 7y agoNot really; you'd just need to be able to leak an address.
- espionn 7y agoSurely they can just change the binary slightly with every patch and move the gadgets around in memory or just remove them outright.
- deleted 7y ago[deleted]
- saagarjha 7y agoFinding gadgets is not hard. Removing them entirely is difficult, but work is being done in this field to make this possible to some extent.
- berti 7y ago> So hopefully this cheat will be VAC / PB undetected for ever ;) That attitude really grinds my gears. I'd much prefer to see something like "here's how we think Valve could fix this permanently".
- Stevvo 7y agoI've got no problem with people writing hacks for games; with the shit that gets released these days I expect it would often be far more rewarding than playing the game itself. That said, authors should follow responsible disclosure, give the game company some time to respond before releasing.
- dvt 7y ago> That said, authors should follow responsible disclosure, give the game company some time to respond before releasing. Stack-smashing attacks have been around since at least 1988[1]. This cheat has less to do with the game itself and more to do with the computing architecture (i.e. stack-based). ROP is an active area of research and "code hardening" is a way to mitigate such an attack[2], but (from what I understand) usually comes with performance penalties. [1] https://lwn.net/Articles/732201/ https://lwn.net/Articles/732201/ [2] https://cs.brown.edu/~vpk/papers/ccr.sp18.pdf https://cs.brown.edu/~vpk/papers/ccr.sp18.pdf
- jakear 7y agoI don't see your point. Do you think the authors shouldn't give responsible disclosure because the underlying mechanism has been around for a while? The company would obviously fix the area where false data is allowed to be injected, not systematically harden their entire codebase against any possible ROP-based attack.
- kuroguro 7y agoThere are going to be hundreds or thousands more, possibly outside of their code. They are easy to introduce in your code, fairly easy to find and hard to fix. It's more of an idea or PoC on how to write cheats than a specific exploit. On another note it's not an exploit in the classic sense - if you own your game you're legally allowed to do what you want with it in most countries AFAIK. I'm not convinced responsible disclosure even applies here.
- rollulus 7y agoI’m completely out of the loop with respect to gaming and cheating nowadays, and I’m not the target audience of the readme, so pardon my ignorance: how is this used? Via exploits in the game? Injected locally by a more privileged process?
- p410n3 7y agoIn csgo specifically you can either inject a DLL (simplest way would be LoadLibraryA, but there are more methods) or just getting a handle and read / write memory. How this cheat does it I dont know. And I am too lazy to check :)
- loufe 7y agoIf you're interested in learning more about ROP, I highly recommend this fantastic writeup CTURT produced about hacking the PS4 (which, of course, used ROP). https://cturt.github.io/ps4.html https://cturt.github.io/ps4.html I
- ibaikov 7y agoHopefully VACnet, which is an ML anticheat used in CS:GO will catch it anyway