3 ms·

> You can set a read watchpoint using debugging APIs (ptrace); What kind of read is sufficient to trigger this? If dota makes a read watchpoint with ptrace, my

> You can set a read watchpoint using debugging APIs (ptrace); What kind of read is sufficient to trigger this? If dota makes a read watchpoint with ptrace, my cheat process calls the linux equivalent of readprocessmemory on the dota process, then dota gets notified by the kernel? So every time a process directly interacts with the memory of another process, the kernel has to look through a list of which processes have called ptrace and run some kind of handler? As an aside it seems like this would be bad for performance of the whole OS If ptrace is a syscall and ptrace (according to wikipedia) allows one program to intercept and manipulate another program's syscalls, then couldn't I just launch my cheat first, have it ptrace dota, and intercept dota's ptrace call, so that the read watchpoint never gets set up in the first place?

xvinci 4y ago
The old saying goes (basically the same as with Malware vs Anti-Malware): Whoever loads first, wins. So you are right in theory, you could intercept any call that would allow you to detect malicious behaviour. That being said two things: 1.) Windows is a closed-source and really huge system. There are many places you will leave traces, and they change all the time. Getting it right is hard. 2.) At least for malware, windows offers official ways to get to go first with e.g. https://learn.microsoft.com/en-us/windows-hardware/drivers/install/early-launch-antimalware https://learn.microsoft.com/en-us/windows-hardware/drivers/i... - I do not know if this is used by any Anti Cheat though. The super exotic theory would be a rootkit, in those cases not even windows can help you. But as with security, as long as there is easy money to be made (because most anti-cheat systems are simply bad), those very expensive solutions will be limited to selected few professionals.
- voldacar 4y ago
  ELAM is interesting. Though I think if you ran the cheat using DMA from a pcie card or some similar means, I don't think any driver could stop you

xvinci 4y ago

The old saying goes (basically the same as with Malware vs Anti-Malware): Whoever loads first, wins. So you are right in theory, you could intercept any call that would allow you to detect malicious behaviour. That being said two things: 1.) Windows is a closed-source and really huge system. There are many places you will leave traces, and they change all the time. Getting it right is hard. 2.) At least for malware, windows offers official ways to get to go first with e.g. https://learn.microsoft.com/en-us/windows-hardware/drivers/install/early-launch-antimalware https://learn.microsoft.com/en-us/windows-hardware/drivers/i... - I do not know if this is used by any Anti Cheat though. The super exotic theory would be a rootkit, in those cases not even windows can help you. But as with security, as long as there is easy money to be made (because most anti-cheat systems are simply bad), those very expensive solutions will be limited to selected few professionals.

voldacar 4y ago
ELAM is interesting. Though I think if you ran the cheat using DMA from a pcie card or some similar means, I don't think any driver could stop you