3 ms·

No it's definitely not. Reading yes (antivirus). Writing no, that's rare and generally purposeful. I have no idea what processes you have that do that unless

No it's definitely not. Reading yes (antivirus). Writing no, that's rare and generally purposeful. I have no idea what processes you have that do that unless they're specialty tools like reshade, autohotkey, etc. Programs do hook the screen for the overlay but that's outside of the game's logic.

AnthonyMouse 3y ago
There are plenty of perfectly ordinary reasons to do this, e.g. you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. Some enterprise BS does this so it can scan TLS traffic. It has long been common to do this sort of thing specifically to games and generally to precompiled binaries without published source code, to mod them in ways that aren't related to cheating. It can make sense for interpreted languages to sandbox the interpreted code into its own process, which the interpreter process might then be writing to. It's not at all unusual.
- filterfiber 3y ago
  > you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. You would have to be manually looking for it then? Also if you do this to the main engine.dll you WILL be banned. Most of the things you're mentioning you wouldn't hook the main engine.dll, you'd be hooking the system api's, directx, etc. I'm not sure many people commenting here play competitive games, it's a ruthless cat-mouse war with cheaters. Anticheat is NOT friendly to modding any of the game code. Yes some anti-cheats will ban you for use autohotkey.

3 ms·

No it's definitely not. Reading yes (antivirus). Writing no, that's rare and generally purposeful. I have no idea what processes you have that do that unless

by filterfiber 3y ago

AnthonyMouse 3y ago
There are plenty of perfectly ordinary reasons to do this, e.g. you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. Some enterprise BS does this so it can scan TLS traffic. It has long been common to do this sort of thing specifically to games and generally to precompiled binaries without published source code, to mod them in ways that aren't related to cheating. It can make sense for interpreted languages to sandbox the interpreted code into its own process, which the interpreter process might then be writing to. It's not at all unusual.
- filterfiber 3y ago
  > you have an untrusted binary and you want to analyze it to determine if it's malicious, or hook its encryption function so you can decrypt the traffic and see what it's sending out of your machine. Program debuggers do this in general. You would have to be manually looking for it then? Also if you do this to the main engine.dll you WILL be banned. Most of the things you're mentioning you wouldn't hook the main engine.dll, you'd be hooking the system api's, directx, etc. I'm not sure many people commenting here play competitive games, it's a ruthless cat-mouse war with cheaters. Anticheat is NOT friendly to modding any of the game code. Yes some anti-cheats will ban you for use autohotkey.