6 ms·

Except they didn't make a cheat at all? They applied smart engineering and reduced lag for players.

briffle 3y ago
yes, by manipulating running code from another process. I'm actually quite amazed no AV software immediately stopped it.
- johntb86 3y ago
  Parts of the graphics driver is loaded into the application process (as a DLL), so it's not quite that suspicious. But once they start modifying the application code itself, that's when the problem happens.
  - mananaysiempre 3y ago
    Nit: AFAIU there is no literal modification of machine code going on—instead the import address table (IAT, the Windows counterpart of Linux’s GOT) is patched (the Windows tradition calls this “detoured”, from the quite popular Microsoft hack[1] that does it). [1] https://github.com/microsoft/Detours https://github.com/microsoft/Detours
- adamrezich 3y ago
  aren't graphics drivers generally given free reign to do pretty much whatever?
  - paulmd 3y ago
    drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. reflex and antilag basically work by flipping the vsync model around. instead of "render a frame -> wait for the monitor to be ready to draw", it's "wait -> render". And by dynamically adjusting the wait time, you can have the frame ready at the last possible moment before the monitor is ready. This means game state is $WAIT_TIME milliseconds fresher, and you've reduced latency by that amount. well, that means you have to have some method to control when the game starts doing the game loop. So you have to be inside the engine somehow - either you have a WAIT_FOR_REFLEX() in the code, or you grab control of the frame queue and don't return control until you're ready, and you just block until the right moment. AMD injected that part.
    - kiririn 3y ago
      They should already have enough control to implement what you describe without changing the game at all, unless the game is doing something to introduce latency outside the drivers control such as threaded rendering I’m very interested to know what they did beyond standard low latency frame scheduling, and why it required hooking into games to the point of triggering anti cheat
    - adamrezich 3y ago
      > drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. isn't this pretty much exactly what graphics drivers have been for years now though? game-specific behavior, day-one driver updates, and all that. the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer.
      - filterfiber 3y ago
        > the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer. Nvidia did it "properly" and worked with valve to develop it in-engine. I could definitely be wrong but I think many of the game-specific optimizations have to to with how they handle the draw-calls, not modifying the actual games themselves.
    - epups 3y ago
      I'm not sure I understand - is AMD merely refreshing frames in a faster way than usual (something that players with better equipment already are doing), or are they also interfering with the game process in some way (ie actively adjusting your aim or performing other commands)?
      - LeifCarrotson 3y ago
        They're doing the former harmless thing, but in the same way that people who are trying to do the latter malicious thing might do it. The ban system detects the method, not the effect and certainly not the motive.
- AnthonyMouse 3y ago
  Manipulating code running from another process is a completely normal thing for privileged processes to do.
  - filterfiber 3y ago
    No it's definitely not. Reading yes (antivirus). Writing no, that's rare and generally purposeful. I have no idea what processes you have that do that unless they're specialty tools like reshade, autohotkey, etc. Programs do hook the screen for the overlay but that's outside of the game's logic.
    - AnthonyMouse 3y ago
      There are plenty of perfectly ordinary reasons to do this, e.g. you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. Some enterprise BS does this so it can scan TLS traffic. It has long been common to do this sort of thing specifically to games and generally to precompiled binaries without published source code, to mod them in ways that aren't related to cheating. It can make sense for interpreted languages to sandbox the interpreted code into its own process, which the interpreter process might then be writing to. It's not at all unusual.
      - filterfiber 3y ago
        > you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. You would have to be manually looking for it then? Also if you do this to the main engine.dll you WILL be banned. Most of the things you're mentioning you wouldn't hook the main engine.dll, you'd be hooking the system api's, directx, etc. I'm not sure many people commenting here play competitive games, it's a ruthless cat-mouse war with cheaters. Anticheat is NOT friendly to modding any of the game code. Yes some anti-cheats will ban you for use autohotkey.
- Buttons840 3y ago
  Don't graphics pipelines compile shaders though? Are you going to ask me to run an optimizing compiler on your shader and then complain I altered it? Or do you want me to run the raw text on the hardware somehow?
  - filterfiber 3y ago
    > graphics pipelines compile shaders though? From my understanding the newer api's have built in methods to negotiate these optimizations. And the gpu driver is free to do whatever it likes after the api calls. So the game tells the driver what to render, which they can reorder/optimize/modify/cache/compile as they like. What they can't do is hijack the game, and modify it's internal logic.
paulmd 3y ago
Yes, but, the way their antilag works is identical to a cheat - it's actually hooking/detouring the game's own functions, which any anticheat will see as an obvious hack. NVIDIA's Reflex actually requires that it be integrated into the game code by developers (which they then provide) rather than trying to inject itself dynamically, but AMD wanted to have "works in every game!" as a selling point. Which would also be fine if they had talked to any of the developers and gotten their "cheat" whitelisted, but they didn't do that. Which is the bizarre part. OK, you have a cool thing you can inject into the game code... but you can't inject anything without bringing developers/anticheat in on the release. And literally everyone from the most basic modder upwards knows this. Gotta be real, real careful about what you inject into games with anticheat, or you'll eat a ban. Even stuff like reshade is a no-no - it's perfectly harmless, but the anticheat doesn't know that. This is basically "reflex as reshade" and has all the same problems around anticheat.
- whalesalad 3y ago
  > but AMD wanted to have "works in every game!" as a selling point. you make it sound like this is a bad thing?
  - paulmd 3y ago
    marketing around half-baked features that get you VAC banned is not really ideal, no. kinda gives the impression that the marketing was given more focus than the product. it's also a very rookie mistake, like, you have to think it's either someone brand new they hired in, or someone more experienced really dropped the ball on devrel/etc. This is a situation where they absolutely should have known that they should talk to the gamedevs in advance.
    - whalesalad 3y ago
      At some point you gotta do the thing and ruffle feathers and get/force buy in. I don't see anything inherently wrong with this approach. Shoot first, ask questions later. It's a successful strategy most of the time. Wrangling all game developers is arguably an impossible task. Building a one size fits all solution is not. Just because it flagged by some anticheat doesn't mean it's failed.
baq 3y ago
Graphics drivers do this all the time. Shipping architecture-optimized shader replacements is basically required nowadays.
- filterfiber 3y ago
  To my understanding the graphics drivers modify the rendering pipeline after the draw calls are made, they don't actually hijack code within the game and modify it's logic. Developers of games add api calls to their game engines for things like antilag/nvidia reflex, that if enabled will notify the driver and allow them to do their thing before returning back to an unmodified game. You do not modify the internal game state - that's a straight red line. There's lots of places you _can_ generally hijack, such as the final rendering calls which is how most overlays work. I don't think whitelisting drivers is common either for the same reason cs2 doesn't allow userland applications to be whitelisted - you can potentially hijack that application instead and then your cheats will be whitelisted.
  - kabdib 3y ago
    Modifying the game code is a red line, too. I don't think that VAC allows this at all, and for good reason.
- grishka 3y ago
  > Shipping architecture-optimized shader replacements is basically required nowadays. That's strange to me. Why care at all about what individual games do? A GPU driver includes a shader compiler anyway, why can't it do a good enough job at optimizing the shader for the particular GPU architecture? It's kinda the same reason almost no one writes assembly any more, because modern compilers are so good at generating optimized machine code.
  - baq 3y ago
    Because a studio has a deal with nvidia but then AMD or Intel also want the triple-A game to perform well on their hardware, for example.
filterfiber 3y ago
From the game's perspective this was a cheat. The anti-cheats job is to make sure nobody tresspasses with the game logic. They modified where methods returned to so they could run their own code before returning to the game. VAC cannot determine if this was a bhop-wallhack or an anti-lag feature. It just sees that someone modified the game. This is like walking up to someone's building and spray painting a mural without permission. No matter how innocent or well intentioned it is - internal modification is a red line.
- rat9988 3y ago
  Being caught by an anti cheat doesn't make you a cheat. This a false positive.
  - filterfiber 3y ago
    So yes it is a false positive, but it's not the type VAC is concerned about. What AMD did was like crossing the DMZ. It doesn't matter who you are or what your intentions are. It's not possible for normal applications to do this unless they're specifically trying to. You cannot cross the DMZ without special permission, and even then it's more likely valve adds it directly to the engine instead. There's more "accidental" type of detections which would be false positives too - but this is a clear line in the sand AMD crossed. --- There is no anti-cheat that will let you do this. You contact valve and work with them to add support in engine. What AMD did was insane.

yes, by manipulating running code from another process. I'm actually quite amazed no AV software immediately stopped it.

johntb86 3y ago
Parts of the graphics driver is loaded into the application process (as a DLL), so it's not quite that suspicious. But once they start modifying the application code itself, that's when the problem happens.
- mananaysiempre 3y ago
  Nit: AFAIU there is no literal modification of machine code going on—instead the import address table (IAT, the Windows counterpart of Linux’s GOT) is patched (the Windows tradition calls this “detoured”, from the quite popular Microsoft hack[1] that does it). [1] https://github.com/microsoft/Detours https://github.com/microsoft/Detours
adamrezich 3y ago
aren't graphics drivers generally given free reign to do pretty much whatever?
- paulmd 3y ago
  drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. reflex and antilag basically work by flipping the vsync model around. instead of "render a frame -> wait for the monitor to be ready to draw", it's "wait -> render". And by dynamically adjusting the wait time, you can have the frame ready at the last possible moment before the monitor is ready. This means game state is $WAIT_TIME milliseconds fresher, and you've reduced latency by that amount. well, that means you have to have some method to control when the game starts doing the game loop. So you have to be inside the engine somehow - either you have a WAIT_FOR_REFLEX() in the code, or you grab control of the frame queue and don't return control until you're ready, and you just block until the right moment. AMD injected that part.
  - kiririn 3y ago
    They should already have enough control to implement what you describe without changing the game at all, unless the game is doing something to introduce latency outside the drivers control such as threaded rendering I’m very interested to know what they did beyond standard low latency frame scheduling, and why it required hooking into games to the point of triggering anti cheat
  - adamrezich 3y ago
    > drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. isn't this pretty much exactly what graphics drivers have been for years now though? game-specific behavior, day-one driver updates, and all that. the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer.
    - filterfiber 3y ago
      > the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer. Nvidia did it "properly" and worked with valve to develop it in-engine. I could definitely be wrong but I think many of the game-specific optimizations have to to with how they handle the draw-calls, not modifying the actual games themselves.
  - epups 3y ago
    I'm not sure I understand - is AMD merely refreshing frames in a faster way than usual (something that players with better equipment already are doing), or are they also interfering with the game process in some way (ie actively adjusting your aim or performing other commands)?
    - LeifCarrotson 3y ago
      They're doing the former harmless thing, but in the same way that people who are trying to do the latter malicious thing might do it. The ban system detects the method, not the effect and certainly not the motive.
AnthonyMouse 3y ago
Manipulating code running from another process is a completely normal thing for privileged processes to do.
- filterfiber 3y ago
  No it's definitely not. Reading yes (antivirus). Writing no, that's rare and generally purposeful. I have no idea what processes you have that do that unless they're specialty tools like reshade, autohotkey, etc. Programs do hook the screen for the overlay but that's outside of the game's logic.
  - AnthonyMouse 3y ago
    There are plenty of perfectly ordinary reasons to do this, e.g. you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. Some enterprise BS does this so it can scan TLS traffic. It has long been common to do this sort of thing specifically to games and generally to precompiled binaries without published source code, to mod them in ways that aren't related to cheating. It can make sense for interpreted languages to sandbox the interpreted code into its own process, which the interpreter process might then be writing to. It's not at all unusual.
    - filterfiber 3y ago
      > you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. You would have to be manually looking for it then? Also if you do this to the main engine.dll you WILL be banned. Most of the things you're mentioning you wouldn't hook the main engine.dll, you'd be hooking the system api's, directx, etc. I'm not sure many people commenting here play competitive games, it's a ruthless cat-mouse war with cheaters. Anticheat is NOT friendly to modding any of the game code. Yes some anti-cheats will ban you for use autohotkey.
Buttons840 3y ago
Don't graphics pipelines compile shaders though? Are you going to ask me to run an optimizing compiler on your shader and then complain I altered it? Or do you want me to run the raw text on the hardware somehow?
- filterfiber 3y ago
  > graphics pipelines compile shaders though? From my understanding the newer api's have built in methods to negotiate these optimizations. And the gpu driver is free to do whatever it likes after the api calls. So the game tells the driver what to render, which they can reorder/optimize/modify/cache/compile as they like. What they can't do is hijack the game, and modify it's internal logic.

paulmd 3y ago

Yes, but, the way their antilag works is identical to a cheat - it's actually hooking/detouring the game's own functions, which any anticheat will see as an obvious hack. NVIDIA's Reflex actually requires that it be integrated into the game code by developers (which they then provide) rather than trying to inject itself dynamically, but AMD wanted to have "works in every game!" as a selling point. Which would also be fine if they had talked to any of the developers and gotten their "cheat" whitelisted, but they didn't do that. Which is the bizarre part. OK, you have a cool thing you can inject into the game code... but you can't inject anything without bringing developers/anticheat in on the release. And literally everyone from the most basic modder upwards knows this. Gotta be real, real careful about what you inject into games with anticheat, or you'll eat a ban. Even stuff like reshade is a no-no - it's perfectly harmless, but the anticheat doesn't know that. This is basically "reflex as reshade" and has all the same problems around anticheat.

whalesalad 3y ago
> but AMD wanted to have "works in every game!" as a selling point. you make it sound like this is a bad thing?
- paulmd 3y ago
  marketing around half-baked features that get you VAC banned is not really ideal, no. kinda gives the impression that the marketing was given more focus than the product. it's also a very rookie mistake, like, you have to think it's either someone brand new they hired in, or someone more experienced really dropped the ball on devrel/etc. This is a situation where they absolutely should have known that they should talk to the gamedevs in advance.
  - whalesalad 3y ago
    At some point you gotta do the thing and ruffle feathers and get/force buy in. I don't see anything inherently wrong with this approach. Shoot first, ask questions later. It's a successful strategy most of the time. Wrangling all game developers is arguably an impossible task. Building a one size fits all solution is not. Just because it flagged by some anticheat doesn't mean it's failed.

baq 3y ago

Graphics drivers do this all the time. Shipping architecture-optimized shader replacements is basically required nowadays.

filterfiber 3y ago
To my understanding the graphics drivers modify the rendering pipeline after the draw calls are made, they don't actually hijack code within the game and modify it's logic. Developers of games add api calls to their game engines for things like antilag/nvidia reflex, that if enabled will notify the driver and allow them to do their thing before returning back to an unmodified game. You do not modify the internal game state - that's a straight red line. There's lots of places you _can_ generally hijack, such as the final rendering calls which is how most overlays work. I don't think whitelisting drivers is common either for the same reason cs2 doesn't allow userland applications to be whitelisted - you can potentially hijack that application instead and then your cheats will be whitelisted.
- kabdib 3y ago
  Modifying the game code is a red line, too. I don't think that VAC allows this at all, and for good reason.
grishka 3y ago
> Shipping architecture-optimized shader replacements is basically required nowadays. That's strange to me. Why care at all about what individual games do? A GPU driver includes a shader compiler anyway, why can't it do a good enough job at optimizing the shader for the particular GPU architecture? It's kinda the same reason almost no one writes assembly any more, because modern compilers are so good at generating optimized machine code.
- baq 3y ago
  Because a studio has a deal with nvidia but then AMD or Intel also want the triple-A game to perform well on their hardware, for example.

filterfiber 3y ago

From the game's perspective this was a cheat. The anti-cheats job is to make sure nobody tresspasses with the game logic. They modified where methods returned to so they could run their own code before returning to the game. VAC cannot determine if this was a bhop-wallhack or an anti-lag feature. It just sees that someone modified the game. This is like walking up to someone's building and spray painting a mural without permission. No matter how innocent or well intentioned it is - internal modification is a red line.

rat9988 3y ago
Being caught by an anti cheat doesn't make you a cheat. This a false positive.
- filterfiber 3y ago
  So yes it is a false positive, but it's not the type VAC is concerned about. What AMD did was like crossing the DMZ. It doesn't matter who you are or what your intentions are. It's not possible for normal applications to do this unless they're specifically trying to. You cannot cross the DMZ without special permission, and even then it's more likely valve adds it directly to the engine instead. There's more "accidental" type of detections which would be false positives too - but this is a clear line in the sand AMD crossed. --- There is no anti-cheat that will let you do this. You contact valve and work with them to add support in engine. What AMD did was insane.