7 ms·

I’m glad someone preserved these tutorials. I was focused on cracking Safedisc games at the time, and even wrote some Safedisc/Safecast tutorials myself. I neve

I’m glad someone preserved these tutorials. I was focused on cracking Safedisc games at the time, and even wrote some Safedisc/Safecast tutorials myself. I never had the skills to crack Securom though, respect to Human and Deroko and the others on the ARTeam forums at the time. Also iirc after this tutorial deroko wrote another one one breaking the Securom VM obfuscation. It was great work, one of the first public tutorials at the time on breaking such obfuscation. I wonder if its also been archived. Finally, it should be noted that Securom is a predecessor to Denuvo. I remember debugging early versions of Denuvo and being struck by how similar they are. I wonder how much of the code and techniques are in common between the two, especially now in 2024. The old reversing scene has changed. I guess everyone grew up and got families and jobs. But when I see what the kids are up to in the multiplayer cheating forums, I see the spirit is still alive and well. Cheers and happy debugging.

jsheard 3y ago
The cracking scene seems to be split between two extremes nowadays, on one end most new games are just using the basic Steam or Epic DRM, which are trivially defeated with open source wrappers so making a pirate release is mostly just boring acquisition and packaging work that basically anyone can do. The other extreme is Denuvo protected games which are so tedious to crack that there's almost no overlap between people with the skills to do it and those with the time and patience to do it.
- punkybr3wster 3y ago
  And seemingly the few that are willing are somewhat insane. I know it takes a special type but wowzers.
  - jsheard 3y ago
    Shout-out to that one guy who has figured out Denuvo but only appears once a year to crack the latest Football Manager game, refuses to elaborate, and leaves until the next Football Manager game comes out. They know what they like, and it's Football Manager, exclusively.
    - z8 3y ago
      Unfortunately MKDEV announced their retirement last year. FIFA 23 was their last release.
    - farmdve 3y ago
      I was going to play around with Denuvo years ago, like in 2015 or 2016, but I quickly lost interest. There were no games I wanted to play. And this is still true today.
  - lpcvoid 3y ago
    If you're referring to EMPRESS, I still don't know if they are just being edgy or truly insane.
    - notso411 3y ago
      [dead]
    - punkybr3wster 3y ago
      That… is exactly who I mean.
girvo 3y ago
> But when I see what the kids are up to in the multiplayer cheating forums The EFI-based cheats, or even the DMA PCI-e hardware streaming memory data out to a second computer are fascinating, to get around ring-0 anticheats like Vanguard
- DaiPlusPlus 3y ago
  Can you elaborate? I know there’s hypervisor-detection, but surely any kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? Maybe even Rowhammer too? …which makes me wonder if anything’s running in SME mode instead thesedays.
  - ace2358 3y ago
    I think the have a pci-e card on the computer playing the game. The card sends hardware level debugging information (memory dma) to another computer. This second computer is connected to the first computer by usb, to spoof a HID (mouse, keyboard, controller etc). It reads the data from the pci card on the first computer and sends inputs via usb. Done right, and it can’t be detected via software. Behaviour analysis still works for aim hacks. Now days I think there are even devices that will tap the hdmi stream and use the video data to calculate inputs and the send the input via usb/hid/controller. This works on console I think!
  - girvo 3y ago
    > kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? At least for Vanguard specifically, nope you'll get pinged if you try that naively; mainly because Vanguard looks for funky USB devices (among other things) Now the way to approach it is to spoof USB hardware IDs and data streams, so you can then use approaches like what you've described, and some even use that to inject HID/mouse movement back into the host PC. Basically allows cheats with nothing more than a micro-controller and a second PC, but it is still more detectable/cat-and-mouse than PCIe DMA devices + second PCs (and video muxing/overlay devices to put the ESP/whatever over the existing "clean" host PC's output) Also if you're running Windows 11, Vanguard requires TPM 2.0 + Secure Boot which makes some things a lot more painful

jsheard 3y ago

The cracking scene seems to be split between two extremes nowadays, on one end most new games are just using the basic Steam or Epic DRM, which are trivially defeated with open source wrappers so making a pirate release is mostly just boring acquisition and packaging work that basically anyone can do. The other extreme is Denuvo protected games which are so tedious to crack that there's almost no overlap between people with the skills to do it and those with the time and patience to do it.

punkybr3wster 3y ago
And seemingly the few that are willing are somewhat insane. I know it takes a special type but wowzers.
- jsheard 3y ago
  Shout-out to that one guy who has figured out Denuvo but only appears once a year to crack the latest Football Manager game, refuses to elaborate, and leaves until the next Football Manager game comes out. They know what they like, and it's Football Manager, exclusively.
  - z8 3y ago
    Unfortunately MKDEV announced their retirement last year. FIFA 23 was their last release.
  - farmdve 3y ago
    I was going to play around with Denuvo years ago, like in 2015 or 2016, but I quickly lost interest. There were no games I wanted to play. And this is still true today.
- lpcvoid 3y ago
  If you're referring to EMPRESS, I still don't know if they are just being edgy or truly insane.
  - notso411 3y ago
    [dead]
  - punkybr3wster 3y ago
    That… is exactly who I mean.

girvo 3y ago

> But when I see what the kids are up to in the multiplayer cheating forums The EFI-based cheats, or even the DMA PCI-e hardware streaming memory data out to a second computer are fascinating, to get around ring-0 anticheats like Vanguard

DaiPlusPlus 3y ago
Can you elaborate? I know there’s hypervisor-detection, but surely any kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? Maybe even Rowhammer too? …which makes me wonder if anything’s running in SME mode instead thesedays.
- ace2358 3y ago
  I think the have a pci-e card on the computer playing the game. The card sends hardware level debugging information (memory dma) to another computer. This second computer is connected to the first computer by usb, to spoof a HID (mouse, keyboard, controller etc). It reads the data from the pci card on the first computer and sends inputs via usb. Done right, and it can’t be detected via software. Behaviour analysis still works for aim hacks. Now days I think there are even devices that will tap the hdmi stream and use the video data to calculate inputs and the send the input via usb/hid/controller. This works on console I think!
- girvo 3y ago
  > kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? At least for Vanguard specifically, nope you'll get pinged if you try that naively; mainly because Vanguard looks for funky USB devices (among other things) Now the way to approach it is to spoof USB hardware IDs and data streams, so you can then use approaches like what you've described, and some even use that to inject HID/mouse movement back into the host PC. Basically allows cheats with nothing more than a micro-controller and a second PC, but it is still more detectable/cat-and-mouse than PCIe DMA devices + second PCs (and video muxing/overlay devices to put the ESP/whatever over the existing "clean" host PC's output) Also if you're running Windows 11, Vanguard requires TPM 2.0 + Secure Boot which makes some things a lot more painful