4 ms·

yes, by manipulating running code from another process. I'm actually quite amazed no AV software immediately stopped it.

johntb86 3y ago
Parts of the graphics driver is loaded into the application process (as a DLL), so it's not quite that suspicious. But once they start modifying the application code itself, that's when the problem happens.
- mananaysiempre 3y ago
  Nit: AFAIU there is no literal modification of machine code going on—instead the import address table (IAT, the Windows counterpart of Linux’s GOT) is patched (the Windows tradition calls this “detoured”, from the quite popular Microsoft hack[1] that does it). [1] https://github.com/microsoft/Detours https://github.com/microsoft/Detours
adamrezich 3y ago
aren't graphics drivers generally given free reign to do pretty much whatever?
- paulmd 3y ago
  drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. reflex and antilag basically work by flipping the vsync model around. instead of "render a frame -> wait for the monitor to be ready to draw", it's "wait -> render". And by dynamically adjusting the wait time, you can have the frame ready at the last possible moment before the monitor is ready. This means game state is $WAIT_TIME milliseconds fresher, and you've reduced latency by that amount. well, that means you have to have some method to control when the game starts doing the game loop. So you have to be inside the engine somehow - either you have a WAIT_FOR_REFLEX() in the code, or you grab control of the frame queue and don't return control until you're ready, and you just block until the right moment. AMD injected that part.
  - kiririn 3y ago
    They should already have enough control to implement what you describe without changing the game at all, unless the game is doing something to introduce latency outside the drivers control such as threaded rendering I’m very interested to know what they did beyond standard low latency frame scheduling, and why it required hooking into games to the point of triggering anti cheat
  - adamrezich 3y ago
    > drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. isn't this pretty much exactly what graphics drivers have been for years now though? game-specific behavior, day-one driver updates, and all that. the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer.
    - filterfiber 3y ago
      > the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer. Nvidia did it "properly" and worked with valve to develop it in-engine. I could definitely be wrong but I think many of the game-specific optimizations have to to with how they handle the draw-calls, not modifying the actual games themselves.
  - epups 3y ago
    I'm not sure I understand - is AMD merely refreshing frames in a faster way than usual (something that players with better equipment already are doing), or are they also interfering with the game process in some way (ie actively adjusting your aim or performing other commands)?
    - LeifCarrotson 3y ago
      They're doing the former harmless thing, but in the same way that people who are trying to do the latter malicious thing might do it. The ban system detects the method, not the effect and certainly not the motive.
AnthonyMouse 3y ago
Manipulating code running from another process is a completely normal thing for privileged processes to do.
- filterfiber 3y ago
  No it's definitely not. Reading yes (antivirus). Writing no, that's rare and generally purposeful. I have no idea what processes you have that do that unless they're specialty tools like reshade, autohotkey, etc. Programs do hook the screen for the overlay but that's outside of the game's logic.
  - AnthonyMouse 3y ago
    There are plenty of perfectly ordinary reasons to do this, e.g. you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. Some enterprise BS does this so it can scan TLS traffic. It has long been common to do this sort of thing specifically to games and generally to precompiled binaries without published source code, to mod them in ways that aren't related to cheating. It can make sense for interpreted languages to sandbox the interpreted code into its own process, which the interpreter process might then be writing to. It's not at all unusual.
    - filterfiber 3y ago
      > you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. You would have to be manually looking for it then? Also if you do this to the main engine.dll you WILL be banned. Most of the things you're mentioning you wouldn't hook the main engine.dll, you'd be hooking the system api's, directx, etc. I'm not sure many people commenting here play competitive games, it's a ruthless cat-mouse war with cheaters. Anticheat is NOT friendly to modding any of the game code. Yes some anti-cheats will ban you for use autohotkey.
Buttons840 3y ago
Don't graphics pipelines compile shaders though? Are you going to ask me to run an optimizing compiler on your shader and then complain I altered it? Or do you want me to run the raw text on the hardware somehow?
- filterfiber 3y ago
  > graphics pipelines compile shaders though? From my understanding the newer api's have built in methods to negotiate these optimizations. And the gpu driver is free to do whatever it likes after the api calls. So the game tells the driver what to render, which they can reorder/optimize/modify/cache/compile as they like. What they can't do is hijack the game, and modify it's internal logic.

johntb86 3y ago

Parts of the graphics driver is loaded into the application process (as a DLL), so it's not quite that suspicious. But once they start modifying the application code itself, that's when the problem happens.

mananaysiempre 3y ago
Nit: AFAIU there is no literal modification of machine code going on—instead the import address table (IAT, the Windows counterpart of Linux’s GOT) is patched (the Windows tradition calls this “detoured”, from the quite popular Microsoft hack[1] that does it). [1] https://github.com/microsoft/Detours https://github.com/microsoft/Detours

adamrezich 3y ago

aren't graphics drivers generally given free reign to do pretty much whatever?

paulmd 3y ago
drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. reflex and antilag basically work by flipping the vsync model around. instead of "render a frame -> wait for the monitor to be ready to draw", it's "wait -> render". And by dynamically adjusting the wait time, you can have the frame ready at the last possible moment before the monitor is ready. This means game state is $WAIT_TIME milliseconds fresher, and you've reduced latency by that amount. well, that means you have to have some method to control when the game starts doing the game loop. So you have to be inside the engine somehow - either you have a WAIT_FOR_REFLEX() in the code, or you grab control of the frame queue and don't return control until you're ready, and you just block until the right moment. AMD injected that part.
- kiririn 3y ago
  They should already have enough control to implement what you describe without changing the game at all, unless the game is doing something to introduce latency outside the drivers control such as threaded rendering I’m very interested to know what they did beyond standard low latency frame scheduling, and why it required hooking into games to the point of triggering anti cheat
- adamrezich 3y ago
  > drivers are a black box, yes, but in this case, the driver is trying to get the game to act in a certain specific way, and it needs to either have these calls added to the game engine, or it needs to inject itself and rewrite the game code (detouring) dynamically at runtime. isn't this pretty much exactly what graphics drivers have been for years now though? game-specific behavior, day-one driver updates, and all that. the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer.
  - filterfiber 3y ago
    > the only (unfortunately) novel thing here is doing this without the express consent and cooperation of the game's developer. Nvidia did it "properly" and worked with valve to develop it in-engine. I could definitely be wrong but I think many of the game-specific optimizations have to to with how they handle the draw-calls, not modifying the actual games themselves.
- epups 3y ago
  I'm not sure I understand - is AMD merely refreshing frames in a faster way than usual (something that players with better equipment already are doing), or are they also interfering with the game process in some way (ie actively adjusting your aim or performing other commands)?
  - LeifCarrotson 3y ago
    They're doing the former harmless thing, but in the same way that people who are trying to do the latter malicious thing might do it. The ban system detects the method, not the effect and certainly not the motive.

AnthonyMouse 3y ago

Manipulating code running from another process is a completely normal thing for privileged processes to do.

filterfiber 3y ago
No it's definitely not. Reading yes (antivirus). Writing no, that's rare and generally purposeful. I have no idea what processes you have that do that unless they're specialty tools like reshade, autohotkey, etc. Programs do hook the screen for the overlay but that's outside of the game's logic.
- AnthonyMouse 3y ago
  There are plenty of perfectly ordinary reasons to do this, e.g. you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. Some enterprise BS does this so it can scan TLS traffic. It has long been common to do this sort of thing specifically to games and generally to precompiled binaries without published source code, to mod them in ways that aren't related to cheating. It can make sense for interpreted languages to sandbox the interpreted code into its own process, which the interpreter process might then be writing to. It's not at all unusual.
  - filterfiber 3y ago
    > you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. You would have to be manually looking for it then? Also if you do this to the main engine.dll you WILL be banned. Most of the things you're mentioning you wouldn't hook the main engine.dll, you'd be hooking the system api's, directx, etc. I'm not sure many people commenting here play competitive games, it's a ruthless cat-mouse war with cheaters. Anticheat is NOT friendly to modding any of the game code. Yes some anti-cheats will ban you for use autohotkey.

Buttons840 3y ago

Don't graphics pipelines compile shaders though? Are you going to ask me to run an optimizing compiler on your shader and then complain I altered it? Or do you want me to run the raw text on the hardware somehow?

filterfiber 3y ago
> graphics pipelines compile shaders though? From my understanding the newer api's have built in methods to negotiate these optimizations. And the gpu driver is free to do whatever it likes after the api calls. So the game tells the driver what to render, which they can reorder/optimize/modify/cache/compile as they like. What they can't do is hijack the game, and modify it's internal logic.