5 ms·

AMD forgot to detour the VAC integrity checks too.

by no_time 3y ago

fxtentacle 3y ago
Most likely, they just forgot to wait for Valve to ship the update where they whitelist those specific modifications.
- sillysaurusx 3y ago
  Do valve whitelist those? I think the geforce changes operate by hooking into the actual rendering functions, not individual games —- or can they?
  - armada651 3y ago
    GPU vendors don't have to hook rendering functions since they're the ones providing the implementation of those rendering functions. If Nvidia requires extra hooks into the game they usually ask the developer to call certain functions in NVAPI, which is their vendor-specific driver interface.
  - no_time 3y ago
    There must be some kind of whitelist system. Discord for example doesn't have many options to draw it's ingame overlay. They either create a topmost transparent window (does not work in exclusive fullscreen) or hook glEnd() of the targer or however it's called these days.
    - armada651 3y ago
      Counter-Strike allows detouring of system calls by code signed DLLs if it's not running in trusted mode. Once it's running in trusted mode all hooking is blocked, so even the Discord overlay would not be allowed. Source: https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF95 https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF...
- deleted 3y ago
  [deleted]
- armada651 3y ago
  > Is there a whitelist of software that can be safely injected into CS:GO? > No. Unfortunately, even benign applications are often a vector for cheats that hijack them in order to cheat in CS:GO. So in Trusted mode, all foreign software is blocked. Source: https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF95#whitelist https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF...
  - AshamedCaptain 3y ago
    Almost 100% sure they keep a whitelist with all common GPU drivers. Note that by definition GPU drivers _require_ the ability to inject DLLs into the process, read/write to the process memory, and even create new threads on it... That's the reason Chrome and derivatives put GPU stuff on a separate process. But you try to do this type of sandboxing on a game and it will utterly destroy performance.
    - dogma1138 3y ago
      Can you provide some docs around it? It goes quite against everything public, when NV adds new features that are not part of D3D or other APIs they release binaries for developers to use to call NVAPI directly Ive never seen their driver injects anything into a running process.
      - AshamedCaptain 3y ago
        D3D is not IPC. It is mostly implemented in the process' address space. When you call a D3D function you are not magically dumping all your primitives into the kernel-side driver (which would be slow), you are calling into nvd3dum.dll which _may_ eventually call into the kernel. All of this happens in the same process and therefore the GPU driver can do whatever the hell it wants to it.
        mardifoufs 3y ago
        Yes but this derouted the engine.dll (or equivalent) code in userspace (not sure if that's the right term here). I agree that they probably whitelist or even just don't check the graphics or rendering related functions, since tons of mods allow you to do that without any widespread ban wave. But when it's hooking to the core engine code, I think that's a different story. Correct me if I'm wrong though.
rvnx 3y ago
The real issue here is that it was a detectable optimization, Nvidia may play similar tricks except it’s not an issue if the code is embedded deeper into the hardware stack. For example, Nvidia cards are great for cheaters because you can disable flashbangs and smoke grenades using the stock driver. If we push it that way, any improvement of FPS due to hardware could even be considered unfair, and to ensure fairness, everybody could theoretically be limited to 30 FPS and xxHz refresh rates.
- dogma1138 3y ago
  Reflex requires the game developers to use the Reflex interface via NVAPI, the AMD global anti lag feature was hijacking calls at runtime and modifying the memory of running processes. I don’t know how this design passed basic red teaming during the design phase not to mention QA.
- dbttdft 3y ago
  What actually happened is that the game code was modified in memory which VAC disallows because that's how many cheats are implemented. I'm not even sure what you're trying to say. Yes you can disable some effects in games through changing driver options and you can make your monitor render a red dot and add macros to your keyboard, those all are a distinct problem from the subject here. A framerate limitation for "fairness" wouldn't make sense because you'd basically be arguing that it's unfair that someone saw one single extra frame that some player zipped across the screen and they were able to track them whereas they wouldn't without that extra frame. But a game being networked naturally presents the same issue and it can't be solved (in an engine like source or unreal): player locations are sent to your client at a fixed sample rate. Whether you see a player zip across the screen will just be determined by a bunch of phases of cyclic phenomena: for instance your client renders every 33.33ms (for 30FPS) and the server says he's at position A, then the server says he's at position B which is in your view, but your game isn't rendering yet because it just finished rendering the previous frame. Then you get a packet saying he's at position C which is also off your screen and now finally the rendering happens, rendering another frame with the player off your screen. So you never saw him cross your screen. But another player sitting right behind you looking in the exact same direction will be on a different phase of his render loop: he may render right after receiving position B and so he will see the player zip across. This example ignores interpolation and stuff but it will still apply even then.
lostmsu 3y ago
Do you happen to know how to detour Steam games on startup? Just launched executable (with detours) gets Steam to restart itself (so now without).
- no_time 3y ago
  >Steam to restart itself (so now without). With all due respect, I'm struggling to parse this part of your comment. With that said, I'm pretty sure your target is calling this API method: https://partner.steamgames.com/doc/api/steam_api#SteamAPI_RestartAppIfNecessary https://partner.steamgames.com/doc/api/steam_api#SteamAPI_Re... If you don't care about being authenticated with a "legit" session for online play, just strip SteamStub and apply a Steam emu with the necessary config. Those will obviously not care about wherever they are being launched from. I recommend the CODEX one if your target is not too recent.

AMD forgot to detour the VAC integrity checks too.

fxtentacle 3y ago

Most likely, they just forgot to wait for Valve to ship the update where they whitelist those specific modifications.

sillysaurusx 3y ago
Do valve whitelist those? I think the geforce changes operate by hooking into the actual rendering functions, not individual games —- or can they?
- armada651 3y ago
  GPU vendors don't have to hook rendering functions since they're the ones providing the implementation of those rendering functions. If Nvidia requires extra hooks into the game they usually ask the developer to call certain functions in NVAPI, which is their vendor-specific driver interface.
- no_time 3y ago
  There must be some kind of whitelist system. Discord for example doesn't have many options to draw it's ingame overlay. They either create a topmost transparent window (does not work in exclusive fullscreen) or hook glEnd() of the targer or however it's called these days.
  - armada651 3y ago
    Counter-Strike allows detouring of system calls by code signed DLLs if it's not running in trusted mode. Once it's running in trusted mode all hooking is blocked, so even the Discord overlay would not be allowed. Source: https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF95 https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF...
deleted 3y ago
[deleted]
armada651 3y ago
> Is there a whitelist of software that can be safely injected into CS:GO? > No. Unfortunately, even benign applications are often a vector for cheats that hijack them in order to cheat in CS:GO. So in Trusted mode, all foreign software is blocked. Source: https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF95#whitelist https://help.steampowered.com/en/faqs/view/09A0-4879-4353-EF...
- AshamedCaptain 3y ago
  Almost 100% sure they keep a whitelist with all common GPU drivers. Note that by definition GPU drivers _require_ the ability to inject DLLs into the process, read/write to the process memory, and even create new threads on it... That's the reason Chrome and derivatives put GPU stuff on a separate process. But you try to do this type of sandboxing on a game and it will utterly destroy performance.
  - dogma1138 3y ago
    Can you provide some docs around it? It goes quite against everything public, when NV adds new features that are not part of D3D or other APIs they release binaries for developers to use to call NVAPI directly Ive never seen their driver injects anything into a running process.
    - AshamedCaptain 3y ago
      D3D is not IPC. It is mostly implemented in the process' address space. When you call a D3D function you are not magically dumping all your primitives into the kernel-side driver (which would be slow), you are calling into nvd3dum.dll which _may_ eventually call into the kernel. All of this happens in the same process and therefore the GPU driver can do whatever the hell it wants to it.
      - mardifoufs 3y ago
        Yes but this derouted the engine.dll (or equivalent) code in userspace (not sure if that's the right term here). I agree that they probably whitelist or even just don't check the graphics or rendering related functions, since tons of mods allow you to do that without any widespread ban wave. But when it's hooking to the core engine code, I think that's a different story. Correct me if I'm wrong though.

rvnx 3y ago

The real issue here is that it was a detectable optimization, Nvidia may play similar tricks except it’s not an issue if the code is embedded deeper into the hardware stack. For example, Nvidia cards are great for cheaters because you can disable flashbangs and smoke grenades using the stock driver. If we push it that way, any improvement of FPS due to hardware could even be considered unfair, and to ensure fairness, everybody could theoretically be limited to 30 FPS and xxHz refresh rates.

dogma1138 3y ago
Reflex requires the game developers to use the Reflex interface via NVAPI, the AMD global anti lag feature was hijacking calls at runtime and modifying the memory of running processes. I don’t know how this design passed basic red teaming during the design phase not to mention QA.
dbttdft 3y ago
What actually happened is that the game code was modified in memory which VAC disallows because that's how many cheats are implemented. I'm not even sure what you're trying to say. Yes you can disable some effects in games through changing driver options and you can make your monitor render a red dot and add macros to your keyboard, those all are a distinct problem from the subject here. A framerate limitation for "fairness" wouldn't make sense because you'd basically be arguing that it's unfair that someone saw one single extra frame that some player zipped across the screen and they were able to track them whereas they wouldn't without that extra frame. But a game being networked naturally presents the same issue and it can't be solved (in an engine like source or unreal): player locations are sent to your client at a fixed sample rate. Whether you see a player zip across the screen will just be determined by a bunch of phases of cyclic phenomena: for instance your client renders every 33.33ms (for 30FPS) and the server says he's at position A, then the server says he's at position B which is in your view, but your game isn't rendering yet because it just finished rendering the previous frame. Then you get a packet saying he's at position C which is also off your screen and now finally the rendering happens, rendering another frame with the player off your screen. So you never saw him cross your screen. But another player sitting right behind you looking in the exact same direction will be on a different phase of his render loop: he may render right after receiving position B and so he will see the player zip across. This example ignores interpolation and stuff but it will still apply even then.

lostmsu 3y ago

Do you happen to know how to detour Steam games on startup? Just launched executable (with detours) gets Steam to restart itself (so now without).

no_time 3y ago
>Steam to restart itself (so now without). With all due respect, I'm struggling to parse this part of your comment. With that said, I'm pretty sure your target is calling this API method: https://partner.steamgames.com/doc/api/steam_api#SteamAPI_RestartAppIfNecessary https://partner.steamgames.com/doc/api/steam_api#SteamAPI_Re... If you don't care about being authenticated with a "legit" session for online play, just strip SteamStub and apply a Steam emu with the necessary config. Those will obviously not care about wherever they are being launched from. I recommend the CODEX one if your target is not too recent.