5 ms·
> This patch created a honeypot: a section of data inside the game client that would never be read during normal gameplay, but that could be read by these expl
by 4gotunameagain 4y ago
> This patch created a honeypot: a section of data inside the game client that would never be read during normal gameplay, but that could
be read by these exploits. Each of the accounts banned today read from this "secret" area in the client, giving us extremely high confidence that every ban was well-deserved.
Any speculation as to how this worked on a lower level ?
- blibble 4y agohardware breakpoint maybe?
- tobyhinloopen 4y agoI imagined the secret area contained fake details about the game, like adding an invisible fake street to a map. If the client refers to the fake street or any location within it, you can be certain the details about that fake street were obtained using cheats. This trick is used to catch cheaters on minecraft, by spawning in fake diamond blocks that would only be visible to specific cheats (xray). If a user suddenly were to dig to these blocks, you can be reasonably certain there's something fishy going on. Other way to think about it, is adding an invisible field to a contact form that is only hidden through CSS
- toxik 4y ago> Other way to think about it, is adding an invisible field to a contact form that is only hidden through CSS Watch out for autocomplete though.
- tough 4y agoAnd as a consumer, watch out for auto-completed css hidden credit card details
- albert_e 4y agooh wow. do current browsers not prevent this by only filling in credit card numbers when that particular field in focus?
- alickz 4y agoI believe current browsers ask for authentication before filling in credit card details. Whenever I focus on a CC field and autocomplete Chrome throws up a biometric auth before it will fill out the textfields
- jfengel 4y agoA nice callback to the "trap streets" used in actual paper maps to catch people violating copyright: https://en.wikipedia.org/wiki/Trap_street https://en.wikipedia.org/wiki/Trap_street
- cptcobalt 4y agoOr just call it what it is, a honeypot: https://en.wikipedia.org/wiki/Honeypot_(computing) https://en.wikipedia.org/wiki/Honeypot_(computing)
- ohgodplsno 4y agoTake the player info struct: struct player_info { std::string name; vector4 position; vector3 orientation; int level; ... } and dump in something like `report_when_accessed<std::list<player_info>> oops_here_are_all_the_other_players_and_their_position_i_am_only_for_debug_please_remove_me`. Your client will never, ever access this list: it's your honeypot. The moment you get any access on list[i], it gets noted down and reported (like sudo does, straight to the naughty list). Cheat makers will see this and, if it doesn't smell of a too obvious honeypot, cannot pass such a golden opportunity: literally free maphack, just locate where the player struct is in memory and read it all!
- throwaway40602 4y agohow do you expect to be able to tell when someone has read one of your pages outside of working set watches/guard pages?
- pedrovhb 4y agoIt doesn't necessarily have to be useful information. They mentioned they understood how the cheat application worked, so it's possible it was doing something like indiscriminately accessing certain memory regions; this would make it possible to detect without any changes to the cheating program.
- jstanley 4y agoBut why bother using `report_when_accessed<>` when you can simply use `automatically_ban_cheaters<>`?
- larschdk 4y agoYou could possibly query the OS for whether physical pages have been allocated or not. Physical pages would only be allocated on the first page fault, when the pages are read.
- jsnell 4y agoI'd do it by read-protecting the page, and install a fault handler that records the access and then unprotects the page (to avoid detection when the cheat causes the game to crash).
- throwaway40602 4y agothere was a convar in the game for 6+ years that let you see particles in the fog of war; 99% of cheats forced this convar on. source lets you request CVars from the client and the value, so they simply did that. to be clear, this was not a honeypot, but they claimed it to be
- kuroguro 4y agoDo the particles alone w/o any cheats give an advantage?
- throwaway40602 4y agoyes, you can tell where enemies are in fog of war
- kuroguro 4y agoHmm, well I wouldn't permaban people for using a known... built in setting, even if it gives an unfair advantage. _edit_ To whoever downvoted me later - I would consider it a bug if it was user settable without cheats. Similarly you could see trough smokes in CS for a long time by changing some video settings. You don't (usually) ban people for bugs.
- throwaway40602 4y agoit was restricted, you couldn't force it without cheats
- kuroguro 4y agoAh, yeah sounds plausible then. I somehow don't buy the guard page/hw breakpoint explanations. This also lines up with "[information] that wasn't visible during normal gameplay".
- jamesfinlayson 4y agoYeah if you ran with the software renderer in Counter-Strike I think the smoke grenade's smoke didn't work properly.
- TheAdamist 4y agoWindows lets you configure guard pages where you get notified on access, normally used to detect stack growth and such. Although that should be an easy and normal thing to avoid for av/cheats. https://learn.microsoft.com/en-us/windows/win32/memory/creating-guard-pages https://learn.microsoft.com/en-us/windows/win32/memory/creat...
- ed_mercer 4y agoI wonder if this can be circumvented by running Dota in a VM.
- poizan42 4y agoNot helping as long as the page fault is triggered and handled by the process. You could just not do a regular read of the page though. No need for a VM for that, just call VirtualQueryEx and check MEMORY_BASIC_INFORMATION.AllocationProtect for the PAGE_GUARD flag.
- userbinator 4y agoIt could be bypassed by running the cheat outside the VM. Of course, there's plenty of detection techniques for VMs too.
- HHad3 4y ago(Wrote anti-cheat software in the past.) There are multiple ways to detect this. Hardware breakpoints were already mentioned, but they only work per thread, so if one is sniffing on your memory from another process or the kernel then these won't help. The most stealthy and evil way I found was to allocate a page but never actually use it. Windows lazily allocates physical memory for fresh memory pages when they are first used. The detection is to periodically poll the page map from your process and check your canary pages via NtQueryVirtualMemory. If your unused page suddenly is backed by some physical memory then something happened to read from it! Bonus-points for putting such canary pages into places previously used for real game data. This method is not foolproof: Anti-virus programs can read memory of all programs (but don't, Overwatch e.g. does not like this and crashes randomly due to this exact protection method). A bug in the program could also read from the page accidentally (e.g. out-of-bounds array read). But it's a /very/ good indicator that something is wrong when other cheat detection mechanisms also trigger. Once you know how this works it's pretty easy to defeat unfortunately: Read the page map first, then avoid reading pages that have no backing physical memory, because those contain no useful data at best and are canary pages at worst.
- pixl97 4y agoHmm, this sounds like you should always run your cheat tools with the executable name/faked exe information of anti-virus application.
- HHad3 4y agoOldest trick in the book, good luck faking the PE signature to match the vendor's certificate ;-) (Jokes aside, the kernel does not provide any information about which application reads a canary page. It's best to just use this as necessary condition and take it with a good pinch of salt.)
- rogers18445 4y agoI used to work on an anti-cheat briefly, and migrated away form relying on Windows API to do this as the parent comment suggested, instead we used cache timing "attacks". Antivirus was a concern but easily solved by the fact that cheats access memory many times a second, antivirus does it rarely if ever.
- wrren 4y agoVAC probably sets up a hardware breakpoint conditioned to trigger when the start of that memory region is read. When triggered, a function registered via AddVectoredExceptionHandler will be called. It probably just sets some flag somewhere indicating that the memory region was accessed before resuming flow. You can guard entire pages of memory using a similar approach (https://dzone.com/articles/memory-access-breakpoint-large https://dzone.com/articles/memory-access-breakpoint-large).
- elzbardico 4y agoI don't think it needs something deeply clever involving hardware breakpoints, sniffing for virtual pages backed by real memory or something like that. And probably that's why it is described as a honeypot. It can just be something exposing a data structure that gives the player some unfair advantage and them watching the players that could only have achieved some very unlikely advantage in the game by exploiting this information. In a FPS for example, if a player consistently anticipates their adversaries sneaking behind a wall, well beyond what would be dictated by probability laws, there's a very high chance that he is cheating in a way that allows him to "see" their adversaries behind walls.
- pandog 4y agoImplementing what you describe sounds to me way more "clever" and less robust than the canary page approach described above. Specifically - I wouldn't fancy writing the "consistently anticipates their adversaries sneaking behind a wall" heuristic you describe but the earlier post describes the API that already exposes the "has read canary page" functionality.
- bmitc 4y agoHow does that work with latency? For example, if someone has extremely fast internet and a low ping, they are going to "see" around walls more often than opponents.
- tester756 4y ago15 years ago in Tibia there was concept of let's call it - changing network payloads. I know it only from stories, so forgive me mistakes. So basically action X at patch Y sends instruction Q1 and then action X at patch Y+1 sends instruction Q2 but cheating/botting software when ran straight after the update still sends old instruction Q1, which is now impossible to be generated by legit player and this way you can instantly mark player as botter. but I think it cannot be it since modern cheaters wouldnt be this stupid, right?
- dark-star 4y agoYou can mark a page as inaccessible (not present), and then, in the page fault handler, note somewhere that it was accessed and then allocate it/make it readable. you might not trigger the cheater-flag on a single access (because of, as mentioned, antivirus etc.) but if your page gets accessed over and over again, you can be quite certain that someone is reading it who probably shouldn't...
- Dwedit 4y agoYour injected code can just as easily read the protection status of a memory page.