4 ms·

I’ve done a fair bit of gamehacking myself. When PUBG came out on the Xbox, I built a tool to sniff and parse gameplay packets to determine the exact location

I’ve done a fair bit of gamehacking myself. When PUBG came out on the Xbox, I built a tool to sniff and parse gameplay packets to determine the exact location of loot and enemies. Radar cheats are much more common now, especially because if the developers do not use any type of encryption, it is rudimentary to setup a packet capture with a 2nd PC or laptop. On PCs where the communications are encrypted, I use a hardware device plugged into my motherboard to grab the encryption key directly from memory.

poushkar 5y ago
How does one go around a game guard that uses an encryption of network packets with a dynamic key?
slimsag 5y ago
Which hardware device, out of curiosity?
- bri3d 5y ago
  Supported boards for https://github.com/ufrisk/pcileech-fpga https://github.com/ufrisk/pcileech-fpga are pretty popular for this use case.
  - ianhawes 5y ago
    Bingo! Any of those will suffice but unfortunately given the current chip situation, they are extremely hard to come by.
    - hhh 5y ago
      What would these expose to the target? Would this kind of card be visible to the target’s OS? apologies for lack of knowledge, but this is an interesting area for research imo. Even outside of the context of game hacking.
      - bri3d 5y ago
        Yes, these cards are visible to the target's OS in their default configurations, as they appear in the PCIe configuration space at a minimum. While they can initiate DMA without the need for any OS-side drivers, an application with sufficient permissions can still locate them in the configuration tree. This is already part of the cat and mouse with game hackers, as they identify some of the standard PCIe VID/DIDs and at a second level, the PCIe configuration values for these cards. Beyond this, there are also a lot of ways using performance counters to see if memory is being accessed without the access being accounted for at the CPU level - https://github.com/ufrisk/pcileech/issues/107 https://github.com/ufrisk/pcileech/issues/107 has some documents around these approaches.
beebmam 5y ago
Since you're here, I have a few questions for you! Do you think cheating is a big problem in multiplayer games? What % of people playing a given game are using advanced techniques similar to those that you use? And, lastly, do you think anyone will ever be able to stop you? :)
- ianhawes 5y ago
  Yes, 100%. With the radar hacks I’ve built, I can see (with a high level of accuracy) which other players are aiming at me while not having a line of sight. When I first started hacking in Escape From Tarkov in 2020, I ran into another cheater once. We stared each other down from opposite sides of a hill until we both turned around and left. I was banned last year and stopped playing EFT for a bit. When I picked back up over the summer I was absolutely floored by how bad the game had become with cheaters. A friend that builds paid cheats had given me access to his platform, so I indulged. My first 3 matches had at least one other cheater in them. There’s a secret handshake now - you wiggle from across the map at the other person so that you can go your separate ways. Some don’t respect the wiggle and try to shoot you from distance. The players not using hacks get decimated. Witnessing this changed my perspective on cheating. I don’t consider it a technical challenge anymore, now it’s a necessity to play and level up in the game. As far as bans, it truly is a cat and mouse game. The team I am involved with write hacks full time now. There are full time support people. Full time QA folks. Ban waves are actually great for business because players become addicted to the hacks, and as soon as they’re banned they want back in. In the case of Tarkov, I’ve noticed that the company that makes the game will wait until known cheaters elapse the chargeback window on their payments, then ban them. They know the cheaters will come back with a new account.
  - cinntaile 5y ago
    > When I picked back up over the summer I was absolutely floored by how bad the game had become with cheaters. But... You're contributing to that since you're one of the cheaters? Is there some sort of cognitive dissonance at play here?
    - 5y ago
guiomie 5y ago
Do very intrusive anti cheat like the one Valorant work?
- ianhawes 5y ago
  The difference between Vanguard and, say, BattlEye or EAC is that it runs at all times. I don’t know enough about Valorant to say whether it’s effective. I will say that pre-loading your hacks prior to starting the game has been a common practice for some time. That way, unlike anti-virus, the games anti-cheat doesn’t see the bootstrapping process.
- BoorishBears 5y ago
  Cheaters are less common in Valorant but still exist. Of course Valorant is also a proportionally less popular games than the games I'd use for comparison, so even that might not have anything to do with their specific anti-cheat.
johnisgood 5y ago
> I use a hardware device plugged into my motherboard to grab the encryption key directly from memory. Can you give me more information on this or some pointers as to where to begin? Also: is there a way to protect against some of your techniques, assuming you are the developer of the game who wants to keep the cheaters out? I am asking because I am working on a game. I will have to start from the basics I think, as in, what information the clients can receive, what they can manipulate and so forth. I have not thought much about client-side prediction either. First off, I am going to require authentication (paid account), but the problem is that it requires an Internet connection, and as far as single player is concerned, anyone could "hack" the client[1]. Is there anything I can do or can you give me some advice as to how to go about it? I suppose authentication would be useful for multiplayer though. [1] They can just make it jump directly to the Main Menu screen and bypass authentication. I do not even know how I could protect against that, if at all possible. --- Come to think of it, I hardly remember how ioquake3 handles this stuff and makes sure the client has "pure" .pk3 files. I would think it would be easy to bypass that as well. I checked out the Wikipedia page of PunkBuster which says: > PunkBuster Servers can be configured to instruct clients to calculate partial MD5 hashes of files inside the game installation directory. The results are compared against a set configuration and differences logged, and optionally, the client removed from the server Now, would not the client eventually know the correct MD5 hash, thus modifying the client to send those hashes could bypass it, right? I imagine such things to be easily spoofable.
- jamiek88 5y ago
  Why do you care about single player cheating? I understand not wanting ruin online play for others but someone cheating on their own pc single player? Seems morally ok to me?
  - johnisgood 5y ago
    I do not care too much about it, just curious really. I am more concerned about multiplayer.
maltalex 5y ago
I never heard of such a hardware device. For those interested, it looks like the parent is talking about devices like Screamer M.2 [0] paired with software like pcileech [1]. Can probably be useful for forensics. [0]: https://shop.lambdaconcept.com/home/43-screamer-m2.html https://shop.lambdaconcept.com/home/43-screamer-m2.html [1]: https://github.com/ufrisk/pcileech https://github.com/ufrisk/pcileech

poushkar 5y ago

How does one go around a game guard that uses an encryption of network packets with a dynamic key?

slimsag 5y ago

Which hardware device, out of curiosity?

bri3d 5y ago
Supported boards for https://github.com/ufrisk/pcileech-fpga https://github.com/ufrisk/pcileech-fpga are pretty popular for this use case.
- ianhawes 5y ago
  Bingo! Any of those will suffice but unfortunately given the current chip situation, they are extremely hard to come by.
  - hhh 5y ago
    What would these expose to the target? Would this kind of card be visible to the target’s OS? apologies for lack of knowledge, but this is an interesting area for research imo. Even outside of the context of game hacking.
    - bri3d 5y ago
      Yes, these cards are visible to the target's OS in their default configurations, as they appear in the PCIe configuration space at a minimum. While they can initiate DMA without the need for any OS-side drivers, an application with sufficient permissions can still locate them in the configuration tree. This is already part of the cat and mouse with game hackers, as they identify some of the standard PCIe VID/DIDs and at a second level, the PCIe configuration values for these cards. Beyond this, there are also a lot of ways using performance counters to see if memory is being accessed without the access being accounted for at the CPU level - https://github.com/ufrisk/pcileech/issues/107 https://github.com/ufrisk/pcileech/issues/107 has some documents around these approaches.

beebmam 5y ago

Since you're here, I have a few questions for you! Do you think cheating is a big problem in multiplayer games? What % of people playing a given game are using advanced techniques similar to those that you use? And, lastly, do you think anyone will ever be able to stop you? :)

ianhawes 5y ago
Yes, 100%. With the radar hacks I’ve built, I can see (with a high level of accuracy) which other players are aiming at me while not having a line of sight. When I first started hacking in Escape From Tarkov in 2020, I ran into another cheater once. We stared each other down from opposite sides of a hill until we both turned around and left. I was banned last year and stopped playing EFT for a bit. When I picked back up over the summer I was absolutely floored by how bad the game had become with cheaters. A friend that builds paid cheats had given me access to his platform, so I indulged. My first 3 matches had at least one other cheater in them. There’s a secret handshake now - you wiggle from across the map at the other person so that you can go your separate ways. Some don’t respect the wiggle and try to shoot you from distance. The players not using hacks get decimated. Witnessing this changed my perspective on cheating. I don’t consider it a technical challenge anymore, now it’s a necessity to play and level up in the game. As far as bans, it truly is a cat and mouse game. The team I am involved with write hacks full time now. There are full time support people. Full time QA folks. Ban waves are actually great for business because players become addicted to the hacks, and as soon as they’re banned they want back in. In the case of Tarkov, I’ve noticed that the company that makes the game will wait until known cheaters elapse the chargeback window on their payments, then ban them. They know the cheaters will come back with a new account.
- cinntaile 5y ago
  > When I picked back up over the summer I was absolutely floored by how bad the game had become with cheaters. But... You're contributing to that since you're one of the cheaters? Is there some sort of cognitive dissonance at play here?
  - 5y ago

guiomie 5y ago

Do very intrusive anti cheat like the one Valorant work?

ianhawes 5y ago
The difference between Vanguard and, say, BattlEye or EAC is that it runs at all times. I don’t know enough about Valorant to say whether it’s effective. I will say that pre-loading your hacks prior to starting the game has been a common practice for some time. That way, unlike anti-virus, the games anti-cheat doesn’t see the bootstrapping process.
BoorishBears 5y ago
Cheaters are less common in Valorant but still exist. Of course Valorant is also a proportionally less popular games than the games I'd use for comparison, so even that might not have anything to do with their specific anti-cheat.

johnisgood 5y ago

> I use a hardware device plugged into my motherboard to grab the encryption key directly from memory. Can you give me more information on this or some pointers as to where to begin? Also: is there a way to protect against some of your techniques, assuming you are the developer of the game who wants to keep the cheaters out? I am asking because I am working on a game. I will have to start from the basics I think, as in, what information the clients can receive, what they can manipulate and so forth. I have not thought much about client-side prediction either. First off, I am going to require authentication (paid account), but the problem is that it requires an Internet connection, and as far as single player is concerned, anyone could "hack" the client[1]. Is there anything I can do or can you give me some advice as to how to go about it? I suppose authentication would be useful for multiplayer though. [1] They can just make it jump directly to the Main Menu screen and bypass authentication. I do not even know how I could protect against that, if at all possible. --- Come to think of it, I hardly remember how ioquake3 handles this stuff and makes sure the client has "pure" .pk3 files. I would think it would be easy to bypass that as well. I checked out the Wikipedia page of PunkBuster which says: > PunkBuster Servers can be configured to instruct clients to calculate partial MD5 hashes of files inside the game installation directory. The results are compared against a set configuration and differences logged, and optionally, the client removed from the server Now, would not the client eventually know the correct MD5 hash, thus modifying the client to send those hashes could bypass it, right? I imagine such things to be easily spoofable.

jamiek88 5y ago
Why do you care about single player cheating? I understand not wanting ruin online play for others but someone cheating on their own pc single player? Seems morally ok to me?
- johnisgood 5y ago
  I do not care too much about it, just curious really. I am more concerned about multiplayer.

maltalex 5y ago

I never heard of such a hardware device. For those interested, it looks like the parent is talking about devices like Screamer M.2 [0] paired with software like pcileech [1]. Can probably be useful for forensics. [0]: https://shop.lambdaconcept.com/home/43-screamer-m2.html https://shop.lambdaconcept.com/home/43-screamer-m2.html [1]: https://github.com/ufrisk/pcileech https://github.com/ufrisk/pcileech