4 ms·
It looks like the original poster (on the cheating forum) claims to have a solution to this in development (https://sync.top/ https://sync.top/). I'm very inex
by metalcrow 2y ago
It looks like the original poster (on the cheating forum) claims to have a solution to this in development (https://sync.top/ https://sync.top/).
I'm very inexperienced with TPMs, but it seems a theoretical solution would be a hypervisor where the Endorsement Key and Attestation Key are passed through from a real TPM, but the rest of the state in the MIMO is totally artificially generated. That is unless that state is also signed by the TPM, in which case you would need to extract the Endorsement Private key from the hardware and sign the state yourself, and as i understand it extracting the private key is designed to be near impossible at the physics level. Or you could work around that some way with a replay attack of the signatures maybe?
- mike_hearn 2y agoIndeed there is a challenge nonce that's signed by the TPM.
- metalcrow 2y agoIn that case, maybe you could do a sort of replay attack? Take a TPM, record a million or so valid states and their signature, and replay those in order every boot? Assuming the TPM is deterministic on startup and you record enough states that you don't have to loop them before reboot, you would have, in effect, a swappable TPM. Of course, if you get banned then you need to record a new TPM and use that, and that may be difficult.
- utensil4778 2y agoA nonce is a token specifically meant to prevent replay attacks. There's no sane reason to assume TPM is deterministic, as that would defeat the purpose of all the security.
- metalcrow 2y agoYou're right, i somehow skipped over that in reading. And you would want a TPM to be deterministic, after all one major use of the TPM is validating the hardware and boot state is unchanged. Is the state except of the nonce deterministic?
- richbell 2y agoMy understanding is that replay attacks are possible with a TPM, if the consuming logic is flawed. IIRC Microsoft's original implementation of signing Primary Refresh Tokens with TPM was flawed in this way.
- snailmailman 2y agoI know in Proxmox there are options to add a TPM to a virtual machine. I don’t know the specifics of how it’s working behind the scenes, but I know I had to do it to setup a windows 11 VM. And it worked? Windows isn’t complaining at least. But maybe it’s just passing things through to the host’s TPM I’m not sure.
- justinclift 2y agoPretty sure (~90%) it's a virtual TPM, as the Proxmox GUI requires you to give it a new storage location for storing the saved info in.