37 ms·

Disguised “AMD PCI Driver” enables executable-specific hacks

147 points by aunali1 5y ago

saagarjha 5y ago
Seems like the hashes are being cracked and refer to games, mostly.
- CodeArtisan 5y ago
  Reminds me about a story from years ago where someone fixed bugs in a video game only by renaming the executable to doom3.exe
  - rrobukef 5y ago
    Renaming the Call of Duty United Offence executable (coduomp.exe) to mohaa.exe (Medal of Honor) makes the game work: https://steamcommunity.com/app/2620/discussions/0/358416640393917568/ https://steamcommunity.com/app/2620/discussions/0/3584166403...
j4yav 5y ago
I bet they are cheating on benchmarks.
- DominikD 5y ago
  Maybe. But it's more likely they're replacing shaders with game- or engine-specific workarounds for hardware bugs. Used to do exactly that in my first GPU driver job. The goal wasn't to cheat, but to fix issues in popular games that for one reason or another wouldn't be patched for your GPU on its release.
  - Arech 5y ago
    Anyway, they made insanely stupid implementation now. With unforgivable security flaws. :(
  - captainmuon 5y ago
    I wonder why they don't just call the game developers on the phone and say "here is AMD, you must fix your shaders, here is the code". Certainly I would jump if I got contacted by AMD or NVIDIA. Now someone is going to say, if a game breaks people are going to blame AMD, so it is their problem. But AMD would just have to play hardball once, pick a smallish publisher and say "XY refuses to fix their broken code, we even did the work for them, we don't reccommend buying their games".
    - danielheath 5y ago
      People buy AMD to play games; they don’t buy games in order to use their AMD card. AMD have one job in this situation and they are doing it.
      - uxp100 5y ago
        Right, the above suggestion might work with coordination, where AMD and NVIDIA both bullied a publisher. But if people want to play a game and NVIDIA makes it work great, despite software bugs, and AMD writes a blog post, I think it's pretty reasonable to say "maybe next time I'll buy NVIDIA." Also I don't think developers would be quite so receptive. It works on every card that exists in the market today, that's kinda your problem if your unreleased chip breaks this is a fairly good argument.
    - hatsunearu 5y ago
      From what I hear a lot of game engines have horrendous bugs that is terrible for performance (like people straight up using DirectX incorrectly, not being aware of the quadrillion performance hacks that AMD/Nvidia are keenly aware of)--so what AMD and Nvidia does is they "fix" the game engine by making it more performant. Potentially it might be better for them to contact the game dev for a collaboration or just to tell them to fix their shit, but it might a) be more annoying than to just silently patch their code b) might benefit their competitor.
      - dleslie 5y ago
        Ha, having been on the game dev side of this, it's _also_ often c) the teams of lawyers between the developers and the outside world won't allow collaboration. The situation is _much_ better nowadays, but in the oughts and early tens it was basically a given that the game source code was considered too valuable to risk sharing.
  - j4yav 5y ago
    Having been in the space, is there a reason you’d normally hide that in something made to look like a PCI driver?
    - dathinab 5y ago
      because the program might have been a pci driver which also does executable detection in the past, or ecause it still does some pci driver related stuff, or because on windows there are some people which delete everything where deleting it doesn't seem to directly show some visible functional degradation... ( I'm not kidding, even if it sounds like that).
- makomk 5y ago
  Apparently for a while AMD's graphics drivers were improving their performance on some games by replacing shaders that used table lookups to approximate trigonometric functions with actual trig instructions, presumably improving accuracy, because that happened to be faster on their hardware.
- pwdisswordfish8 5y ago
  So this is merely Volkswagen level bad, and not Sony rootkit level bad? That’s comforting!
iforgotpassword 5y ago
I remember these tricks being discovered as early as ~2000, and it's been a scandal every time it was found NVidia or ATI did it. Not much has changed over the past 20 years.
- josefx 5y ago
  They had to work around bugs in games and even Windows had hard coded fixes for things like use after free errors in SimCity2000. The scandal was when they were caught using that to reduce render quality in benchmarks to get better results.
TazeTSchnitzel 5y ago
Anyone who's read Raymond Chen's blog, or ever encountered MKCOMPAT.EXE (https://en.wikipedia.org/wiki/Make_Compatible https://en.wikipedia.org/wiki/Make_Compatible), will know that Windows is full of application-specific hacks to maintain compatibility. I suspect every complex system component has something similar for the same reasons. I doubt it's for any nefarious purpose.
- j4yav 5y ago
  Why obfuscate it inside of a decoy driver?
- fennecfoxen 5y ago
  It doesn't need to be nefarious to be bad for you. It can merely supply security vulnerabilities.
flohofwoe 5y ago
At least for graphics drivers it's common that the driver applies tons of game-specific workarounds and optimizations, I guess this is also the main reason why there are monthly driver updates (fixes for new games), and why graphics drivers have become so massively big. Assuming that the same game-specific tweaking happens for CPU performance and compatibility doesn't seem like a far stretch.
- raverbashing 5y ago
  Yes, and I agree this kind of thing "is ok" But this isn't: > it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers.
  - slimsag 5y ago
    And being disguised as PCI driver doesn't help.. If it was called "AMD Game Optimizer" software, it'd be OK I think.
- rasz 5y ago
  previous ATI attempt at "game-specific workarounds and optimizations" before applying: https://techreport.com/r.x/radeon-q3/dm6-quaff-nocolormip-shot0008.jpg https://techreport.com/r.x/radeon-q3/dm6-quaff-nocolormip-sh... applied: https://techreport.com/r.x/radeon-q3/dm6-quake-nocolormip-shot0008.jpg https://techreport.com/r.x/radeon-q3/dm6-quake-nocolormip-sh...
- Narishma 5y ago
  > I guess this is also the main reason why there are monthly driver updates (fixes for new games), and why graphics drivers have become so massively big. I don't think so, otherwise it would be limited to graphics drivers. Since other kinds of Windows "gamer"-type drivers (keyboards, mice, motherboards, etc...) have also bloated over time, I think it's more about including useless things in them, as well as the use of inefficient frameworks like Electron.
  - 5y ago
whoopdedo 5y ago
Not going to speak to whether it's coincidence or intentional, but PCI could also mean "Program Compatibility Interface" or something like that.
- pseudalopex 5y ago
  It shows up as a PCI device. And anyone writing a driver would know the standard meaning.
rasz 5y ago
How ATI’s drivers ‘optimize’ Quake III https://techreport.com/review/3089/how-atis-drivers-optimize-quake-iii/ https://techreport.com/review/3089/how-atis-drivers-optimize... >Kyle Bennett at the HardOCP found that replacing every instance of “quake” with “quack” in the Quake III executable changed the Radeon 8500’s performance in the game substantially.
- MatmaRex 5y ago
  (2001)
- vimax 5y ago
  Good article. Makes me think of Volkswagen.
anaisbetts 5y ago
I don't know why they need to disguise this driver, but every single GPU vendor does this, there's a reason nVidia heavily advertises "$LATEST_BIG_GAME Driver Support" every time a new AAA game comes out, it's all AppCompat flags, all the way down.
shaggie76 5y ago
The game I work on is in the list and early on we saw a bunch of inexplicable crashes from Zen hardware (looking through the dumps we would see $rip had gotten itself into impossible places or we'd get exceptions at addresses that were not involved in the crashing thread). As these crash faded from our bug leaderboard we assumed it was people upgrading their BIOS to get microcode fixes; I guess these runtime checks were a desperate attempt to avoid crashes in the interim? Windows Update is pretty bossy but it never demands that you update your BIOS. How our game got on that list is baffling to me, though -- I don't know how AMD would have gotten the crash reports in the first place.

147 points by aunali1 5y ago

saagarjha 5y ago

Seems like the hashes are being cracked and refer to games, mostly.

CodeArtisan 5y ago
Reminds me about a story from years ago where someone fixed bugs in a video game only by renaming the executable to doom3.exe
- rrobukef 5y ago
  Renaming the Call of Duty United Offence executable (coduomp.exe) to mohaa.exe (Medal of Honor) makes the game work: https://steamcommunity.com/app/2620/discussions/0/358416640393917568/ https://steamcommunity.com/app/2620/discussions/0/3584166403...

j4yav 5y ago

I bet they are cheating on benchmarks.

DominikD 5y ago
Maybe. But it's more likely they're replacing shaders with game- or engine-specific workarounds for hardware bugs. Used to do exactly that in my first GPU driver job. The goal wasn't to cheat, but to fix issues in popular games that for one reason or another wouldn't be patched for your GPU on its release.
- Arech 5y ago
  Anyway, they made insanely stupid implementation now. With unforgivable security flaws. :(
- captainmuon 5y ago
  I wonder why they don't just call the game developers on the phone and say "here is AMD, you must fix your shaders, here is the code". Certainly I would jump if I got contacted by AMD or NVIDIA. Now someone is going to say, if a game breaks people are going to blame AMD, so it is their problem. But AMD would just have to play hardball once, pick a smallish publisher and say "XY refuses to fix their broken code, we even did the work for them, we don't reccommend buying their games".
  - danielheath 5y ago
    People buy AMD to play games; they don’t buy games in order to use their AMD card. AMD have one job in this situation and they are doing it.
    - uxp100 5y ago
      Right, the above suggestion might work with coordination, where AMD and NVIDIA both bullied a publisher. But if people want to play a game and NVIDIA makes it work great, despite software bugs, and AMD writes a blog post, I think it's pretty reasonable to say "maybe next time I'll buy NVIDIA." Also I don't think developers would be quite so receptive. It works on every card that exists in the market today, that's kinda your problem if your unreleased chip breaks this is a fairly good argument.
  - hatsunearu 5y ago
    From what I hear a lot of game engines have horrendous bugs that is terrible for performance (like people straight up using DirectX incorrectly, not being aware of the quadrillion performance hacks that AMD/Nvidia are keenly aware of)--so what AMD and Nvidia does is they "fix" the game engine by making it more performant. Potentially it might be better for them to contact the game dev for a collaboration or just to tell them to fix their shit, but it might a) be more annoying than to just silently patch their code b) might benefit their competitor.
    - dleslie 5y ago
      Ha, having been on the game dev side of this, it's _also_ often c) the teams of lawyers between the developers and the outside world won't allow collaboration. The situation is _much_ better nowadays, but in the oughts and early tens it was basically a given that the game source code was considered too valuable to risk sharing.
- j4yav 5y ago
  Having been in the space, is there a reason you’d normally hide that in something made to look like a PCI driver?
  - dathinab 5y ago
    because the program might have been a pci driver which also does executable detection in the past, or ecause it still does some pci driver related stuff, or because on windows there are some people which delete everything where deleting it doesn't seem to directly show some visible functional degradation... ( I'm not kidding, even if it sounds like that).
makomk 5y ago
Apparently for a while AMD's graphics drivers were improving their performance on some games by replacing shaders that used table lookups to approximate trigonometric functions with actual trig instructions, presumably improving accuracy, because that happened to be faster on their hardware.
pwdisswordfish8 5y ago
So this is merely Volkswagen level bad, and not Sony rootkit level bad? That’s comforting!

iforgotpassword 5y ago

I remember these tricks being discovered as early as ~2000, and it's been a scandal every time it was found NVidia or ATI did it. Not much has changed over the past 20 years.

josefx 5y ago
They had to work around bugs in games and even Windows had hard coded fixes for things like use after free errors in SimCity2000. The scandal was when they were caught using that to reduce render quality in benchmarks to get better results.

TazeTSchnitzel 5y ago

Anyone who's read Raymond Chen's blog, or ever encountered MKCOMPAT.EXE (https://en.wikipedia.org/wiki/Make_Compatible https://en.wikipedia.org/wiki/Make_Compatible), will know that Windows is full of application-specific hacks to maintain compatibility. I suspect every complex system component has something similar for the same reasons. I doubt it's for any nefarious purpose.

j4yav 5y ago
Why obfuscate it inside of a decoy driver?
fennecfoxen 5y ago
It doesn't need to be nefarious to be bad for you. It can merely supply security vulnerabilities.

flohofwoe 5y ago

At least for graphics drivers it's common that the driver applies tons of game-specific workarounds and optimizations, I guess this is also the main reason why there are monthly driver updates (fixes for new games), and why graphics drivers have become so massively big. Assuming that the same game-specific tweaking happens for CPU performance and compatibility doesn't seem like a far stretch.

raverbashing 5y ago
Yes, and I agree this kind of thing "is ok" But this isn't: > it has a security descriptor allowing Everyone + Low IL R/W Access, and an IOCTL interface with absolutely no Probes/SEH, which yes, dereferences wild pointers.
- slimsag 5y ago
  And being disguised as PCI driver doesn't help.. If it was called "AMD Game Optimizer" software, it'd be OK I think.
rasz 5y ago
previous ATI attempt at "game-specific workarounds and optimizations" before applying: https://techreport.com/r.x/radeon-q3/dm6-quaff-nocolormip-shot0008.jpg https://techreport.com/r.x/radeon-q3/dm6-quaff-nocolormip-sh... applied: https://techreport.com/r.x/radeon-q3/dm6-quake-nocolormip-shot0008.jpg https://techreport.com/r.x/radeon-q3/dm6-quake-nocolormip-sh...
Narishma 5y ago
> I guess this is also the main reason why there are monthly driver updates (fixes for new games), and why graphics drivers have become so massively big. I don't think so, otherwise it would be limited to graphics drivers. Since other kinds of Windows "gamer"-type drivers (keyboards, mice, motherboards, etc...) have also bloated over time, I think it's more about including useless things in them, as well as the use of inefficient frameworks like Electron.
- 5y ago

whoopdedo 5y ago

Not going to speak to whether it's coincidence or intentional, but PCI could also mean "Program Compatibility Interface" or something like that.

pseudalopex 5y ago
It shows up as a PCI device. And anyone writing a driver would know the standard meaning.

rasz 5y ago

How ATI’s drivers ‘optimize’ Quake III https://techreport.com/review/3089/how-atis-drivers-optimize-quake-iii/ https://techreport.com/review/3089/how-atis-drivers-optimize... >Kyle Bennett at the HardOCP found that replacing every instance of “quake” with “quack” in the Quake III executable changed the Radeon 8500’s performance in the game substantially.

MatmaRex 5y ago
(2001)
vimax 5y ago
Good article. Makes me think of Volkswagen.

anaisbetts 5y ago

I don't know why they need to disguise this driver, but every single GPU vendor does this, there's a reason nVidia heavily advertises "$LATEST_BIG_GAME Driver Support" every time a new AAA game comes out, it's all AppCompat flags, all the way down.

shaggie76 5y ago

The game I work on is in the list and early on we saw a bunch of inexplicable crashes from Zen hardware (looking through the dumps we would see $rip had gotten itself into impossible places or we'd get exceptions at addresses that were not involved in the crashing thread). As these crash faded from our bug leaderboard we assumed it was people upgrading their BIOS to get microcode fixes; I guess these runtime checks were a desperate attempt to avoid crashes in the interim? Windows Update is pretty bossy but it never demands that you update your BIOS. How our game got on that list is baffling to me, though -- I don't know how AMD would have gotten the crash reports in the first place.