5 ms·

> Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer a

> Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state. Incorrect. DMA (direct memory access) is and can be prevented [1] and detected [2]. [1] https://www.faceit.com/en/news/faceit-rollout-of-tpm-secure-boot-iommu-and-vbs?cp=welcome-landing https://www.faceit.com/en/news/faceit-rollout-of-tpm-secure-... [2] https://community.osr.com/t/detecting-pcie-dma-based-cheating-hardware-in-online-games/55899 https://community.osr.com/t/detecting-pcie-dma-based-cheatin...

sudosysgen 11mo ago
You can still do DMA cheating with IOMMU enabled. There are quite a few relatively widespread bugs with IOMMU that allow you to bypass it, for example https://cloud.google.com/blog/products/gcp/fuzzing-pci-express-security-in-plaintext https://cloud.google.com/blog/products/gcp/fuzzing-pci-expre.... So to be able to actually do IOMMU DMA protection you need to be willing to ban many popular devices. That may be viable for FACEIT and ESEA but it won't be for 99.9% of anticheat deployments. The detection for DMA cheating is based on the DMA engines being unable to emulate 1:1 the actual behavior the hardware ID would be expected to have. This can be fixed by simply doing that properly. But even besides that, DMA through PCIe is just one hardware cheat that fits a separate thread model and therefore has some countermeasures. There are much more robust methods you can use, for example a PCIe interposer between the OS and GPU, or simply direct memory interposes if you want to do DMA without the protections afforded by the PCIe implementation. There are interposets along with machinery to get along memory encryption and other obfuscations that can be made for around 100$.
vablings 11mo ago
Once again back to another arms race. Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) physical access to the hardware is just a function of time and money to get direct access to the memory https://x.com/danielgenkin/status/1989003973429268974?s=12 https://x.com/danielgenkin/status/1989003973429268974?s=12 Something like TEE.fail can be used to read encryption keys for network traffic then a MITM proxy can display player information easily on a second PC, you will never be able to reliably detect this
- bangaladore 11mo ago
  > Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones. > Something like TEE.fail can be used to read encryption keys for network traffic So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often. I don't consider it an arms race if you can prevent cheating to 10s of people in a million-player game. That's noise at best.
  - vablings 11mo ago
    > Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones. I have been loading and using the WinIO driver on windows all the way up to the latest version to read and write any memory I want. I also have a few drivers that are lesser known that are not even flagged by most anti-cheats > So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often. You are going to have to decrypt the memory eventually. Even TEE.fail can get around AMD SEV and Intel's TEE. Reading memory speed doesn't really matter as long as you can find an encryption key for network traffic. Once you can intercept network traffic and decrypt its game over! You do not need an ASIC to interpose DDR5 and steal all the traffic, there are FPGAs that are powerful enough. Once PCIE DMA cards go the way of the dino with IOMMU people will just switch to memory interposers with FPGAs A few years ago, DMA cards cost upwards of $500. Now you can buy cards from china preloaded with pcieleech firmware for around $100. and there are thousands of customers. If you can afford the latest gen gaming gear and afford to spend money on cheats you can certainly fork over a couple hundred dollars for the latest undetected solution

sudosysgen 11mo ago

You can still do DMA cheating with IOMMU enabled. There are quite a few relatively widespread bugs with IOMMU that allow you to bypass it, for example https://cloud.google.com/blog/products/gcp/fuzzing-pci-express-security-in-plaintext https://cloud.google.com/blog/products/gcp/fuzzing-pci-expre.... So to be able to actually do IOMMU DMA protection you need to be willing to ban many popular devices. That may be viable for FACEIT and ESEA but it won't be for 99.9% of anticheat deployments. The detection for DMA cheating is based on the DMA engines being unable to emulate 1:1 the actual behavior the hardware ID would be expected to have. This can be fixed by simply doing that properly. But even besides that, DMA through PCIe is just one hardware cheat that fits a separate thread model and therefore has some countermeasures. There are much more robust methods you can use, for example a PCIe interposer between the OS and GPU, or simply direct memory interposes if you want to do DMA without the protections afforded by the PCIe implementation. There are interposets along with machinery to get along memory encryption and other obfuscations that can be made for around 100$.

vablings 11mo ago

Once again back to another arms race. Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) physical access to the hardware is just a function of time and money to get direct access to the memory https://x.com/danielgenkin/status/1989003973429268974?s=12 https://x.com/danielgenkin/status/1989003973429268974?s=12 Something like TEE.fail can be used to read encryption keys for network traffic then a MITM proxy can display player information easily on a second PC, you will never be able to reliably detect this

bangaladore 11mo ago
> Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones. > Something like TEE.fail can be used to read encryption keys for network traffic So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often. I don't consider it an arms race if you can prevent cheating to 10s of people in a million-player game. That's noise at best.
- vablings 11mo ago
  > Windows eventually tends to revoke the certificate of vulnerable drivers. And prior to that, anti-cheats will flag the signature and prevent booting or outright ban for egregious ones. I have been loading and using the WinIO driver on windows all the way up to the latest version to read and write any memory I want. I also have a few drivers that are lesser known that are not even flagged by most anti-cheats > So, encrypt the memory well then? Also, that attack slows down RAM to 3200 MT/S and is infeasible for game cheating. Maybe if you could make a custom ram stick with an ASIC on it, which would cost millions on millions of dollars to keep up with DDR5, you could capture encrypted bits and crash your system pretty often. You are going to have to decrypt the memory eventually. Even TEE.fail can get around AMD SEV and Intel's TEE. Reading memory speed doesn't really matter as long as you can find an encryption key for network traffic. Once you can intercept network traffic and decrypt its game over! You do not need an ASIC to interpose DDR5 and steal all the traffic, there are FPGAs that are powerful enough. Once PCIE DMA cards go the way of the dino with IOMMU people will just switch to memory interposers with FPGAs A few years ago, DMA cards cost upwards of $500. Now you can buy cards from china preloaded with pcieleech firmware for around $100. and there are thousands of customers. If you can afford the latest gen gaming gear and afford to spend money on cheats you can certainly fork over a couple hundred dollars for the latest undetected solution