5 ms·

It works in the sense it allows you to run the game; but it does not prevent cheating. Obviously, Window's kernel anti-cheet is also only partially effective an

by ZiiS 11mo ago

It works in the sense it allows you to run the game; but it does not prevent cheating. Obviously, Window's kernel anti-cheet is also only partially effective anyway, but the point of open-source is to give you control which includes cheating if you want to. Linux's profiling is just too good; full well documented sources for all libraries and kernel, even the graphics are running through easier to understand translation layers rather than signed blobs.

reactordev 11mo ago
These things do not prevent cheating at all. They are merely a remote control system that they can send instructions to look for known cheats. Cheating still exists and will always exist in online games. You can be clever and build a random memory allocator. You can get clever and watch for frozen struct members after a known set operation, what you can’t do is prevent all cheating. There’s device layer, driver layer, MITM, emulation, and even now AI mouse control. The only thing you can do is watch for it and send the ban hammer. Valve has a wonderful write up about client-side prediction recording so as to verify killcam shots were indeed, kill shots, and not aim bots (but this method is great for seeing those in action as well!)
- Goronmon 11mo ago
  Cheating still exists and will always exist in online games. Sure, but you still have to make a serious attempt or the experience will be terrible for any non-cheaters. Or you just make your game bad enough that no one cares. That's an option too.
  - reactordev 11mo ago
    Other options exist but it’s not an option for these real-time games like FPS’s. I get it. If you don’t need real-time packets and can deal with the old school architecture of pulses, there’s things you can do on the network to ensure security. You do this too on real-time UDP it’s just a bit trickier. Prediction and analysis pattern discovery is really the only options thus far. But I could be blowing smoke and know nothing about the layers of kernel integration these malware have developed.
    - cyberax 11mo ago
      > But I could be blowing smoke and know nothing about the layers of kernel integration these malware have developed. Kernel level? The SOTA cheats use custom hardware that uses DMA to spy on the game state. There are now also purely external cheating devices that use video capture and mouse emulation to fully simulate a human.
      - jsheard 11mo ago
        > The SOTA cheats use custom hardware that uses DMA to spy on the game state. And the SOTA anti-cheats now use IOMMU shenanigans to keep DMA devices from seeing the game state. The arms race continues.
      - strbean 11mo ago
        You'll never stop the arms race, but requiring specialized hardware to cheat is as close as you'll get to a decisive victory against cheats. The vast majority of cheaters in most games are not sophisticated users. Ease of access and use is the biggest issue.
- plufz 11mo ago
  That sounds like it does prevent cheating? But maybe doesn’t prevent ALL cheats. Or do you mean they work so poorly that it doesn’t make any difference at all?
  - reactordev 11mo ago
    I mean it works by someone saying look for DotaCheat4.exe and it searches for it. That’s basically it. Also if your engine has the ability to be hooked into (ahem, gta) it will detect that a process has been attached. It may do some memory scanning if they implemented the allocator from the sdk. What I’m saying is, it’s a crap shoot out there whether the devs did or not. Executives use it as a blanket as to not get sued. “We have anti-cheat”. They can claim it was “circumvented” or whatever. They are all garbage. BattleEye, EasyAntiCheat, Vanguard. If you don’t know, here LL giving a run down. https://m.youtube.com/watch?v=VtHlMTc8lR4&t=49s https://m.youtube.com/watch?v=VtHlMTc8lR4&t=49s
  - viraptor 11mo ago
    It makes cheating harder and the timeline to a cheat product gets longer than the iteration speed of anticheat. Kind of like fancy locks don't prevent break ins, just take longer to pick and require more specialised tools.
    - nialv7 11mo ago
      As they say, locks only stop honest people.
      - raydev 11mo ago
        The honest people are a larger group than the dishonest people. And being real, the zero-day cheats are closely guarded and trickled out and sold for high prices as other cheats get found out, so for AAA games, the good cheats are priced out of comfort zone and anyone who attempts the lazy/cheap cheats is banned pretty quickly. A significant portion of the dishonest becomes honest through laziness or self-preservation. Only a select few are truly committed to dishonesty enough to put money and their accounts on the line. Same way there are fewer murderers and thieves than there are non-murderers and non-thieves (at least in western countries).
- babypuncher 11mo ago
  > These things do not prevent cheating at all. Yes they do. They don't stop all cheating, but they raise the barrier to entry which means fewer cheaters. I don't like arguments that sound like "well you can't stop all crime so you may as well not even try"
  - deleted 11mo ago
    [deleted]
  - reactordev 11mo ago
    Ok, they prevent known cheats that the company has found online behind some subscription site run in the basement in Jersey. True. They do raise the bar, but they aren’t the barrier.
- Hikikomori 11mo ago
  They do prevent some cheating methods on Window, like blocking other processes from reading/writing game process memory.
- cortesoft 11mo ago
  > These things do not prevent cheating at all. I feel like this is the same as saying "seatbelts don't prevent car accident deaths at all", just because people still die in car accidents while wearing seat belts. Just because something isn't 100% effective doesn't mean it doesn't provide value. There is a LOT less cheating in games with good anti-cheat, and it is much more pleasant to play those games because of it. There is a benefit to making it harder to cheat, even if it doesn't make it impossible.
  - SeanAnderson 11mo ago
    I don't think that analogy holds because the environment isn't actively in an arms race against seatbelts. The qualifier "good" for "good anti-cheat" is doing a lot of heavy lifting. What was once good enough is now laughably inadequate. We have followed that thread to its logical conclusion with the introduction of kernel-level anti-cheat. That has proven to be insufficient, unsurprisingly, and, given enough time, the act of bypassing kernel-level anti-cheat will become commoditized just like every other anti-cheat prior.
    - phainopepla2 11mo ago
      > the environment isn't actively in an arms race against seatbelts. I would beg to differ. In the US at least, there does seem to be a hidden arms race between safety features and the environment (in the form of car size growth)
    - raydev 11mo ago
      No. The same way piracy has been diminished in the mainstream by years of lawsuits and jailtime against the loudest most available sources, the strongest anti-cheats have suppressed the easiest and cheapest paths to cheating on AAA games. Piracy hasn't gone away, but the number of people doing it peaked last decade. Anti-cheat makers doesn't need to eliminate cheating completely, they just need to capture enough cheating (and ban unpredictably) that average people are mostly discouraged. As long as cheat-creators have to scurry around in secrecy and guard their implementations until the implementation is caught, the "good" cheats will never be a commodity on mainstream well-funded games with good anti-cheat. Cheat-creators have to do the hard hacking and put their livelihoods on the line, they make kids pay up for that.
- phendrenad2 11mo ago
  That's easy to say. But they do prevent some cheating. Don't believe me? Consider the simplest case: No anti-cheat whatsoever. You can just hook into the rendering engine and draw walls at 50% transparency. That's the worst case. Now, we add minimal anti-cheat that convolutes the binary with lots of extra jumps and loops at runtime. Now, someone needs to spend time figuring out the pattern. That effort isn't free. Now, people have to pay for cheats. Guess what? Visa doesn't want to handle payment processing for your hacks & cheats business. So now you're using sketchy payment processors based out of a third-world country. Guess what else? People will create fake hacks & cheats websites that use those same payment processors, and will just take people's money and never deliver the cheats. You get to try to differentiate yourself from literal scammers, how are you going to do that? You can't put the Visa logo on your website. Because you're legit, and you don't want to get sued. Then, the anti-cheat adds heuristic detection for cheat processes. The anti-cheat company BUYS the cheats and reverse-engineers them and improves the heuristics. then the game company makes everyone sign up with a phone number, and permabans that phone number when they're caught cheating. Now some gamers don't want to risk getting banned. Saying that these factors simply don't exist or are insignificant is certainly one of the opinions of all time.
  - jorl17 11mo ago
    100% agree. This is exactly the kind of big picture thinking that so many people often seem to miss. I did too, when I was young and thought the world was just filled with black and white, good vs evil dichotomies
  - KolmogorovComp 11mo ago
    > You can just hook into the rendering engine and draw walls at 50% transparency A properly designed game should not send the position of ennemies out of view
    - dontlaugh 11mo ago
      That is not always possible for genres with fast gameplay like most shooters. It's quite common for player movement to be able to put an enemy in view before the light could've round-tripped from the server. This is generally the anti-cheat problem. Certain genres have gameplay that cannot be implemented without trusting the client at least some of the time.
- anvuong 11mo ago
  I don't know why you brought up VAC as an example. It is a horrible AC, so bad so that an entire service (FaceIT) was built to capitalize on that. VAC is still a laughing joke in CS2, literally unplayable when you reached 15k+. Riot Vanguard is extremely invasive, but it's leaps and bounds a head of VAC. And Valve's banning waves long after the fact doesn't improve the players experience at all. CS2 is F2P, alts are easy to get, cheating happens in alost every single high-ranked game, players experience is shit.
  - treyd 11mo ago
    > CS2 is F2P Not anymore for the competitive gamemodes. This was reversed a while ago.
jchw 11mo ago
Anti-cheat is a misnomer; it's much more about detecting cheats more than it is preventing them. For people who are familiar with how modern anti-cheat systems work, actually cheating is really the easy part; trying to remain undetected is the challenge. Because of that, usermode anti-cheat is definitely far from useless in Wine; it can still function insofar as it tries to monitor the process space of the game itself. It can't really do a ton to ensure the integrity of Wine directly, but usermode anti-cheat running on Windows can't do much to ensure the integrity of Windows directly either, without going the route of requiring attestation. In fact, for the latest anti-cheat software I've ever attempted to mess with, which to be fair was circa 2016, it is still possible to work around anti-cheat mechanisms by detouring the Windows API calls themselves, to the extent that you can. (If you be somewhat clever it can be pretty useful, and has the bonus of being much harder to detect obviously.) The limitation is obviously that inside Wine you can't see most Linux resources directly using the same APIs, so you can't go and try to find cheat software directly. But let's be honest, that approach isn't really terribly relevant anymore since it is a horribly fragile and limited way to detect cheats. For more invasive anti-cheat software, well. We'll see. But just because Windows is closed source hasn't stopped people from patching Windows itself or writing their own kernel drivers. If that really was a significant barrier, Secure Boot and TPM-based attestation wouldn't be on the radar for anti-cheat vendors. Valve however doesn't seem keen to support this approach at all on its hardware, and if that forces anti-cheat vendors to go another way it is probably all the better. I think the secure boot approach has a limited shelf life anyways.
- buildbot 11mo ago
  Speaking of Anti-Cheat and secure boot, you need SB for Battlefield 6. The game won't start without it. So it's happening! I don't hate the lack of cheating compared to older Battlefield games if I am going to be honest.
  - kouteiheika 11mo ago
    > Speaking of Anti-Cheat and secure boot, you need SB for Battlefield 6. The game won't start without it. So it's happening! I'm curious, does anyone know how exactly they check for this? How was it actually made unspoofable?

by ZiiS 11mo ago

reactordev 11mo ago

These things do not prevent cheating at all. They are merely a remote control system that they can send instructions to look for known cheats. Cheating still exists and will always exist in online games. You can be clever and build a random memory allocator. You can get clever and watch for frozen struct members after a known set operation, what you can’t do is prevent all cheating. There’s device layer, driver layer, MITM, emulation, and even now AI mouse control. The only thing you can do is watch for it and send the ban hammer. Valve has a wonderful write up about client-side prediction recording so as to verify killcam shots were indeed, kill shots, and not aim bots (but this method is great for seeing those in action as well!)

Goronmon 11mo ago
Cheating still exists and will always exist in online games. Sure, but you still have to make a serious attempt or the experience will be terrible for any non-cheaters. Or you just make your game bad enough that no one cares. That's an option too.
- reactordev 11mo ago
  Other options exist but it’s not an option for these real-time games like FPS’s. I get it. If you don’t need real-time packets and can deal with the old school architecture of pulses, there’s things you can do on the network to ensure security. You do this too on real-time UDP it’s just a bit trickier. Prediction and analysis pattern discovery is really the only options thus far. But I could be blowing smoke and know nothing about the layers of kernel integration these malware have developed.
  - cyberax 11mo ago
    > But I could be blowing smoke and know nothing about the layers of kernel integration these malware have developed. Kernel level? The SOTA cheats use custom hardware that uses DMA to spy on the game state. There are now also purely external cheating devices that use video capture and mouse emulation to fully simulate a human.
    - jsheard 11mo ago
      > The SOTA cheats use custom hardware that uses DMA to spy on the game state. And the SOTA anti-cheats now use IOMMU shenanigans to keep DMA devices from seeing the game state. The arms race continues.
    - strbean 11mo ago
      You'll never stop the arms race, but requiring specialized hardware to cheat is as close as you'll get to a decisive victory against cheats. The vast majority of cheaters in most games are not sophisticated users. Ease of access and use is the biggest issue.
plufz 11mo ago
That sounds like it does prevent cheating? But maybe doesn’t prevent ALL cheats. Or do you mean they work so poorly that it doesn’t make any difference at all?
- reactordev 11mo ago
  I mean it works by someone saying look for DotaCheat4.exe and it searches for it. That’s basically it. Also if your engine has the ability to be hooked into (ahem, gta) it will detect that a process has been attached. It may do some memory scanning if they implemented the allocator from the sdk. What I’m saying is, it’s a crap shoot out there whether the devs did or not. Executives use it as a blanket as to not get sued. “We have anti-cheat”. They can claim it was “circumvented” or whatever. They are all garbage. BattleEye, EasyAntiCheat, Vanguard. If you don’t know, here LL giving a run down. https://m.youtube.com/watch?v=VtHlMTc8lR4&t=49s https://m.youtube.com/watch?v=VtHlMTc8lR4&t=49s
- viraptor 11mo ago
  It makes cheating harder and the timeline to a cheat product gets longer than the iteration speed of anticheat. Kind of like fancy locks don't prevent break ins, just take longer to pick and require more specialised tools.
  - nialv7 11mo ago
    As they say, locks only stop honest people.
    - raydev 11mo ago
      The honest people are a larger group than the dishonest people. And being real, the zero-day cheats are closely guarded and trickled out and sold for high prices as other cheats get found out, so for AAA games, the good cheats are priced out of comfort zone and anyone who attempts the lazy/cheap cheats is banned pretty quickly. A significant portion of the dishonest becomes honest through laziness or self-preservation. Only a select few are truly committed to dishonesty enough to put money and their accounts on the line. Same way there are fewer murderers and thieves than there are non-murderers and non-thieves (at least in western countries).
babypuncher 11mo ago
> These things do not prevent cheating at all. Yes they do. They don't stop all cheating, but they raise the barrier to entry which means fewer cheaters. I don't like arguments that sound like "well you can't stop all crime so you may as well not even try"
- deleted 11mo ago
  [deleted]
- reactordev 11mo ago
  Ok, they prevent known cheats that the company has found online behind some subscription site run in the basement in Jersey. True. They do raise the bar, but they aren’t the barrier.
Hikikomori 11mo ago
They do prevent some cheating methods on Window, like blocking other processes from reading/writing game process memory.
cortesoft 11mo ago
> These things do not prevent cheating at all. I feel like this is the same as saying "seatbelts don't prevent car accident deaths at all", just because people still die in car accidents while wearing seat belts. Just because something isn't 100% effective doesn't mean it doesn't provide value. There is a LOT less cheating in games with good anti-cheat, and it is much more pleasant to play those games because of it. There is a benefit to making it harder to cheat, even if it doesn't make it impossible.
- SeanAnderson 11mo ago
  I don't think that analogy holds because the environment isn't actively in an arms race against seatbelts. The qualifier "good" for "good anti-cheat" is doing a lot of heavy lifting. What was once good enough is now laughably inadequate. We have followed that thread to its logical conclusion with the introduction of kernel-level anti-cheat. That has proven to be insufficient, unsurprisingly, and, given enough time, the act of bypassing kernel-level anti-cheat will become commoditized just like every other anti-cheat prior.
  - phainopepla2 11mo ago
    > the environment isn't actively in an arms race against seatbelts. I would beg to differ. In the US at least, there does seem to be a hidden arms race between safety features and the environment (in the form of car size growth)
  - raydev 11mo ago
    No. The same way piracy has been diminished in the mainstream by years of lawsuits and jailtime against the loudest most available sources, the strongest anti-cheats have suppressed the easiest and cheapest paths to cheating on AAA games. Piracy hasn't gone away, but the number of people doing it peaked last decade. Anti-cheat makers doesn't need to eliminate cheating completely, they just need to capture enough cheating (and ban unpredictably) that average people are mostly discouraged. As long as cheat-creators have to scurry around in secrecy and guard their implementations until the implementation is caught, the "good" cheats will never be a commodity on mainstream well-funded games with good anti-cheat. Cheat-creators have to do the hard hacking and put their livelihoods on the line, they make kids pay up for that.
phendrenad2 11mo ago
That's easy to say. But they do prevent some cheating. Don't believe me? Consider the simplest case: No anti-cheat whatsoever. You can just hook into the rendering engine and draw walls at 50% transparency. That's the worst case. Now, we add minimal anti-cheat that convolutes the binary with lots of extra jumps and loops at runtime. Now, someone needs to spend time figuring out the pattern. That effort isn't free. Now, people have to pay for cheats. Guess what? Visa doesn't want to handle payment processing for your hacks & cheats business. So now you're using sketchy payment processors based out of a third-world country. Guess what else? People will create fake hacks & cheats websites that use those same payment processors, and will just take people's money and never deliver the cheats. You get to try to differentiate yourself from literal scammers, how are you going to do that? You can't put the Visa logo on your website. Because you're legit, and you don't want to get sued. Then, the anti-cheat adds heuristic detection for cheat processes. The anti-cheat company BUYS the cheats and reverse-engineers them and improves the heuristics. then the game company makes everyone sign up with a phone number, and permabans that phone number when they're caught cheating. Now some gamers don't want to risk getting banned. Saying that these factors simply don't exist or are insignificant is certainly one of the opinions of all time.
- jorl17 11mo ago
  100% agree. This is exactly the kind of big picture thinking that so many people often seem to miss. I did too, when I was young and thought the world was just filled with black and white, good vs evil dichotomies
- KolmogorovComp 11mo ago
  > You can just hook into the rendering engine and draw walls at 50% transparency A properly designed game should not send the position of ennemies out of view
  - dontlaugh 11mo ago
    That is not always possible for genres with fast gameplay like most shooters. It's quite common for player movement to be able to put an enemy in view before the light could've round-tripped from the server. This is generally the anti-cheat problem. Certain genres have gameplay that cannot be implemented without trusting the client at least some of the time.
anvuong 11mo ago
I don't know why you brought up VAC as an example. It is a horrible AC, so bad so that an entire service (FaceIT) was built to capitalize on that. VAC is still a laughing joke in CS2, literally unplayable when you reached 15k+. Riot Vanguard is extremely invasive, but it's leaps and bounds a head of VAC. And Valve's banning waves long after the fact doesn't improve the players experience at all. CS2 is F2P, alts are easy to get, cheating happens in alost every single high-ranked game, players experience is shit.
- treyd 11mo ago
  > CS2 is F2P Not anymore for the competitive gamemodes. This was reversed a while ago.

jchw 11mo ago

Anti-cheat is a misnomer; it's much more about detecting cheats more than it is preventing them. For people who are familiar with how modern anti-cheat systems work, actually cheating is really the easy part; trying to remain undetected is the challenge. Because of that, usermode anti-cheat is definitely far from useless in Wine; it can still function insofar as it tries to monitor the process space of the game itself. It can't really do a ton to ensure the integrity of Wine directly, but usermode anti-cheat running on Windows can't do much to ensure the integrity of Windows directly either, without going the route of requiring attestation. In fact, for the latest anti-cheat software I've ever attempted to mess with, which to be fair was circa 2016, it is still possible to work around anti-cheat mechanisms by detouring the Windows API calls themselves, to the extent that you can. (If you be somewhat clever it can be pretty useful, and has the bonus of being much harder to detect obviously.) The limitation is obviously that inside Wine you can't see most Linux resources directly using the same APIs, so you can't go and try to find cheat software directly. But let's be honest, that approach isn't really terribly relevant anymore since it is a horribly fragile and limited way to detect cheats. For more invasive anti-cheat software, well. We'll see. But just because Windows is closed source hasn't stopped people from patching Windows itself or writing their own kernel drivers. If that really was a significant barrier, Secure Boot and TPM-based attestation wouldn't be on the radar for anti-cheat vendors. Valve however doesn't seem keen to support this approach at all on its hardware, and if that forces anti-cheat vendors to go another way it is probably all the better. I think the secure boot approach has a limited shelf life anyways.

buildbot 11mo ago
Speaking of Anti-Cheat and secure boot, you need SB for Battlefield 6. The game won't start without it. So it's happening! I don't hate the lack of cheating compared to older Battlefield games if I am going to be honest.
- kouteiheika 11mo ago
  > Speaking of Anti-Cheat and secure boot, you need SB for Battlefield 6. The game won't start without it. So it's happening! I'm curious, does anyone know how exactly they check for this? How was it actually made unspoofable?