8 ms·

The inherent issue with anti cheats as compared to anti-virus software is user intention. A user who installs a anti virus program wants that program to do its

by ds 6y ago

The inherent issue with anti cheats as compared to anti-virus software is user intention. A user who installs a anti virus program wants that program to do its job and find bad actors. The virus on the other hand is completely unwanted by both the user and the software- Its existence is threatened by all fronts. However, a anti-cheat lives in a extremely adversarial environment. The cheater (and the cheat) wants the cheat on its computer. As such, the user will be willing to do extra steps to assist the cheat. This makes the anti-cheat software in this case, the 'un-wanted' virus, so it has to exist in the most hostile of environments and somehow detect programs which have higher privileges than itself. That said, Cheating is something that will not go away. Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. It involved a second computer, which man-in-the-middled all network data to the client computer. This second computer then would display a 'radar' of where enemies were. As the anti cheat would have no possible way of knowing the existence of this second computer, there was not much they could do. If you wanted to get more aggressive with the system above, you could have that second computer modify outbound requests as well. So if you shoot your gun and it would have hit the ground, it will now instead shoot a enemy in the head- as such even something like a aimbot is entirely possible with this setup. However, there is indeed a anti cheat which can detect all known cheats and its basically what Valve did/does for CS:GO - Allow users to report suspected cheaters and then have the community analyze the reports. This catches all blatant cheats, but unfortunately will never get rid of radar/esp cheaters, only aimbots and the like. Honestly, it sounds to me like there is a business model in the above. Years ago we had companies like evenbalance/punkbuster, easy anticheat, etc.. which provided software based anti-cheat systems. As you would expect, most would by bypassed and a daily cat and mouse game would ensue. The solution imo is to create a SaaS where you essentially provide a reporting + monitoring tool. Users of your game can report suspected cheaters (which includes the demo file / vod / replay / whatever) and your trained wet-ware staff would review all reports and take action where necessary. No invasive software necessary. Actually, no software on the end users computer at all would be necessary- It is all done on another users PC. In fact, if someone is interested in doing the above, hit me up. Sounds like a easy win.

lol768 6y ago
> Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. > It involved a second computer, which man-in-the-middled all network data to the client computer. Out of interest, was there no transport level encryption to deal with here? Or did you need to do something special to capture keys on the client?
- ds 6y ago
  That heavy lifting wasnt done by myself so I unfortunately dont have a answer for you. This was around a decade ago however, so I would not be surprised if the traffic was unencrypted.
  - XMPPwocky 6y ago
    Source did not encrypt network traffic until DeepBlueSea released NetShark for CS:GO. Now it uses ICE, a 64-bit block cipher from the DES era. The key is obtained from the Steam servers over the normal Steam encrypted channel.
- ruialmeida 6y ago
  In order for your game to render other players you have to know their position, so the game server has to send them to all players. As an example, for CSGO in the past, the server always sent all player positions from anywhere, so it was possible to create cheats to draw players anywhere in the map. They changed the way it's done, coordinates are only sent when other players are nearly visible, although distant, or close by. This limited the way that wallhacks work, it's not possible to see where players are from far away :) What needs to be done is reverse engineer the communication protocol. If encryption is made, some kind of key to decrypt has to be somewhere in your game client. Then you can convert 3D coordinates to 2D and even draw a radar on your smartphone if you make an app.
  - gpderetta 6y ago
    >In order for your game to render other players you have to know their position, so the game server has to send them to all players I know nothing about game engines, but I have always wondered why is that the case. The server could compute visibility and only send the opponent position if there is a chance the player might see it. Computing visibility server side is not cheap, but it would still be significantly cheaper than fully rendering a scene, right?

by ds 6y ago

lol768 6y ago

> Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. > It involved a second computer, which man-in-the-middled all network data to the client computer. Out of interest, was there no transport level encryption to deal with here? Or did you need to do something special to capture keys on the client?

ds 6y ago
That heavy lifting wasnt done by myself so I unfortunately dont have a answer for you. This was around a decade ago however, so I would not be surprised if the traffic was unencrypted.
- XMPPwocky 6y ago
  Source did not encrypt network traffic until DeepBlueSea released NetShark for CS:GO. Now it uses ICE, a 64-bit block cipher from the DES era. The key is obtained from the Steam servers over the normal Steam encrypted channel.
ruialmeida 6y ago
In order for your game to render other players you have to know their position, so the game server has to send them to all players. As an example, for CSGO in the past, the server always sent all player positions from anywhere, so it was possible to create cheats to draw players anywhere in the map. They changed the way it's done, coordinates are only sent when other players are nearly visible, although distant, or close by. This limited the way that wallhacks work, it's not possible to see where players are from far away :) What needs to be done is reverse engineer the communication protocol. If encryption is made, some kind of key to decrypt has to be somewhere in your game client. Then you can convert 3D coordinates to 2D and even draw a radar on your smartphone if you make an app.
- gpderetta 6y ago
  >In order for your game to render other players you have to know their position, so the game server has to send them to all players I know nothing about game engines, but I have always wondered why is that the case. The server could compute visibility and only send the opponent position if there is a chance the player might see it. Computing visibility server side is not cheap, but it would still be significantly cheaper than fully rendering a scene, right?