6 ms·
A beginner’s guide to game hacking techniques [pdf]
- MonaroVXR 5y agoDid game hacking on MapleStory, but wasn't interested in computers at all. The interests came 10 years later. Wasn't sophisticated at all, I just wanted automate things.
- markus_zhang 5y agoPC Tools, anyone?
- anonymousDan 5y agoAnyone know of similar games to practice game hacking but on Linux? Ideally they would also be open source.
- boneitis 5y agoPwn Adventure series comes to mind. The games were created for CTF events and are actually intended to be hacked. That is, you cannot complete the quests without resorting to hacking. Made by some of the creators of the Binary Ninja disassembler (at least, I know the third one is). LiveOverflow did a fairly comprehensive video series on it as well. Can't speak firsthand as a player beyond running around in the game world for an hour (nor did I rtfa); just enjoyed watching the video walkthrough. Might be worth watching the first video to see whether it'd be up your alley. He is just exploring around without yet doing any actual hacking.
- brobinson 5y agoThe site/PDF mentions using Cheat Engine... how do you even download an adware-/malware-free version of that nowadays besides setting up a recurring Patreon donation? I tried building it from scratch, but the compilation process fails when following the guide line by line. I've since switched to Squalr, which is not as good, but at least it doesn't try to trick me into installing adware/malware.
- ajsmitty 5y agoYou can get adware/malware -free versions from github: https://github.com/cheat-engine/cheat-engine https://github.com/cheat-engine/cheat-engine The installer on their website has been pushing bad-ware for a while now unfortunately.
- jimbob45 5y agoShove it in a container/VM, right? That way it doesn't really matter if it turns out to be an infected version.
- Rzor 5y agoWell, Guest-to-Host escape is a thing, so I wouldn't bet on that with that much confidence, but that's definitely the alternative.
- LogonType10 5y agoMalware developers with those skills are probably working with APTs and hunting bigger fish.
- baal80spam 5y ago> how do you even download an adware-/malware-free version of that nowadays What's wrong with the official version? I've used it for several years now. Am I missing something?
- brobinson 5y agoAre you using the installer that installs adware/malware, or are you subscribing to the author's Patreon to get the plain binaries? I wish the author would just let you buy a one-time license for it.
- mrguyorama 5y agoYou can "opt out" of all the badware in the installer as far as I can tell
- Evansbee 5y agoIs there some way to do this work of memory hacking from OUTSIDE the VM? I've always thought that it would be "safer" to do the work by just being able to scrub the hosts side of VirtualBox, then stuff events back in through the keyboard and mouse rather than getting on the inside of the VM and hooking/injecting inside the target executable.
- bri3d 5y agoSure, this is sometimes done using hardware with host memory access / DMA support, like PCIeScreamer type PCIe cards. This is also used for network level exploits when there's some kind of ephemeral or negotiated encryption key at play.
- jacobvm04 5y agoThere are libraries such as memflow[0] that let you have DMA to vm using KVM. Though be warned, it's a lot more complicated then injecting a dll or using cheat engine. [0] - https://memflow.github.io/#/home https://memflow.github.io/#/home
- gverrilla 5y agoVAC incoming
- smoldesu 5y agoFunnily enough, I remember leaving Cheat Engine running while playing Counter Strike a few times, I was surprised that I never got banned for that. Abusing client-side scripting with friends (in a community server, at that) did get me VAC'd though.
- slimsag 5y agoVery cool introductory article! Game hacking techniques have gotten even more advanced and cat-and-mouse than this in recent years, though. My brother is really into this stuff and I hear a lot from him. For example, nowadays anti cheats like Unreal's EAC (Easy Anti-Cheat) ban the use of certain drivers because people are relying on e.g. vulnerable Intel wifi chipset drivers in Windows in order to have a way to get into the kernel's memory space to modify game memory without the anti-cheat knowing[0] (after all, it's your wifi driver not your own arbitrary kernel module!) - so people are constantly finding vulnerable drivers that anti-cheats don't know about. Also heard rumors that the Windows kernel actually has undocumented anti-cheat hooks directly in it these days so that anti-cheat engines can plug into, as part of the Windows store initiative. Interesting stuff. [0] https://www.unknowncheats.me/forum/anti-cheat-bypass/343907-tutorial-kdmapper-manual-map-driver-using-vulnerable-driver-intel.html https://www.unknowncheats.me/forum/anti-cheat-bypass/343907-...
- ReactiveJelly 5y agoI wonder if the demand for DRM that actually works will eventually split Linux distros into ones that respect user freedom, and SteamOS, which will be able to run Steam. I thought I read discussion of their proposed anti-cheat kernel module already... can't have nice things with any shared resource...
- matheusmoreira 5y agoNo doubt. It's impossible to enforce copyright if users are free. Same thing applies to cheats. It's impossible to prevent cheating if users are free. Truth be told, cheating is nothing but an exercise in computing freedom: the user orders the computer to cheat and the computer obeys. Linux users of Steam and its games will eventually be forced to install proprietary kernel modules. They'll have to swallow that if they want to play the games they paid money for. Steam machines will probably be reduced to appliances just like game consoles eventually. The whole point is to enable the game companies to own the user's machines. They don't think users should have total freedom and the only way to enforce that is to take it away.
- smoldesu 5y agoDMA was my first introduction, with good old Cheat Engine. I have very fond memories of digging through my favorite games, changing values incrementally to try to find their place in memory.
- ianhawes 5y agoI’ve done a fair bit of gamehacking myself. When PUBG came out on the Xbox, I built a tool to sniff and parse gameplay packets to determine the exact location of loot and enemies. Radar cheats are much more common now, especially because if the developers do not use any type of encryption, it is rudimentary to setup a packet capture with a 2nd PC or laptop. On PCs where the communications are encrypted, I use a hardware device plugged into my motherboard to grab the encryption key directly from memory.
- poushkar 5y agoHow does one go around a game guard that uses an encryption of network packets with a dynamic key?
- slimsag 5y agoWhich hardware device, out of curiosity?
- bri3d 5y agoSupported boards for https://github.com/ufrisk/pcileech-fpga https://github.com/ufrisk/pcileech-fpga are pretty popular for this use case.
- ianhawes 5y agoBingo! Any of those will suffice but unfortunately given the current chip situation, they are extremely hard to come by.
- hhh 5y agoWhat would these expose to the target? Would this kind of card be visible to the target’s OS? apologies for lack of knowledge, but this is an interesting area for research imo. Even outside of the context of game hacking.
- 5y ago
- grendelt 5y agoWhere can I get PDFs like this printed and bound for convenient offline reading (like when on a plane)? I'm going to assume it can get stupid expensive for a one-off job.
- jedimastert 5y ago"Business centers" like kinko's, Staples, Office Depot would be my first bet. Also if you have a college near by they probably do that kinda thing all the time. A 511 page pager would probably be incredibly expensive though, yes. I just chucked it into Fedex's print service and it looks like it's gonna be $250
- geeio 5y agoI’ve used lulu.com for this in the past for small one-off print jobs (I think it was 5$ for something around 80 pages)
- aero-glide2 5y agoI just print it on black&white in a4 sheets. Costs $1 per 50 pages in my place.
- mdp2021 5y agoTo those who do not mind the different physical format (who do not strictly require paper pages), here is a reminder that 10'' and 13'' EPD tablets are available.
- _carbyau_ 5y agoMuch game hacking seems to be around competitive PvP. But I generally see even if you had no hacking, the social feel of a competitive PvP is often elitist and a turn off. The elites always seem to pick on the not so good, offering little true good hearted mentorship. This is not 100%, but a general thing, like 13yr olds having loose lips. For example: Person A, bottom of the rung, loses a lot. Without mentorship help or good cheer this is not fun, so the options are: 1. Git gud. They have now given the "bottom of the rung" baton to someone else. Issue not solved, just handed over. 2. Leave. Which also gives the "bottom of the rung" baton to someone else, decreases player pool etc. 3. Keep playing and losing. Not many choose this. With the high % of options being 1 or 2, eventually enough people pick 2. So most PvP is doomed to fail after the hype. And in the period of time it is running, the elite have fun winning over the losing. Continuously. Now add hackers. Seems like unless you are the elite, which by definition is a minority, the only winning move is not to play.
- ReactiveJelly 5y agoYeah, I get tired of competition easily if I have no chance of putting up a good fight. Sometimes I even play cooperative table tennis with friends.
- _carbyau_ 5y agoI wish to add that PvP can be fun, if both sides are playing for fun and good humour. Then, even losing can be fun. But all too often is not the case. I also wonder why games are so focused on PvP while watching a huge WoW playerbase pay subscription fees to Blizzard for years on end. Warframe has been having a good stab at public coop FPS. They even have some PvP in there. Not sure whether hacking/elitism is much of an issue though as I played coop with friends the whole time...
- Aperocky 5y agoThat's why you need a ladder and populate the bottom of the ladder with idiot bots.
- grayfaced 5y ago
- terrycody 5y ago511 pages PDF, what a treasure trove!
- fulafel 5y agoVirtualization detection could also be addressed by using tooling that resists detection. Are there publicly available tools in this area and does it work against rootkit style DRM? There seems to be a fair bit of pubished research under the term "sandbox evasion" at least, in the malware research field.
- lvturner 5y agoHorrible flashbacks. Pure war of attrition. I remember at one point replicating the work of a cheat author in a game I was responsible for and pushing out a bait 'patch' for the hack to confirm they were using the methods I thought they were. Unfortunately I had far less time to work on these issues than those creating the hacks.
- chilling 5y agoAnyone know why some code's sections are cross out? (eg. page 326)