« first day (3735 days earlier)      last day (44 days later) » 
00:00 - 04:0004:00 - 00:00

12:09 AM
Yeah honestly, if the attacker is already root on my system, be my guest and brick it, because I ain't touching that shit anymore
Or any other server for that matter. I'm clearly not up to the task
 
I think the issue is that it could be used to damage dedicated servers.
They regularly give people root and simply wipe the server before giving it to someone else.
BIOS and related firmware is write-protected, but the general belief is that a root user cannot damage the system (beyond simply wearing parts out faster by heating it up).
 
Well, rent one and find out
 
B-but money!
Dedis aren't cheap.
That's why I'm trying to find some sucker to do it for me. >:D
 
J--
Well, that's one module completed in 24 hours exactly with just one missing solution.
I need to get a life.
Jesus. Time to procrastinate, I guess.
Only 11 more to go!
 
You can have mine but I wouldn't want to be known for shipping damaged goods
 
J--
12:12 AM
To be fair, that was just the WinDbg module, the rest won't be this easy.
 
>WinDbg
>not using gdb or ddd
pleb
 
J--
Yeah, I don't like it...
But the whole course is with WinDbg so they tell you to use it for "simplicity".
 
>actually using command line debuggers instad of nice visual debuggers integrated into your IDE
^- Has never bothered to learn how gdb works
 
J--
Yeah I will likely use immunity in my exam
fuck using this the entire time
48 hours of windbg no thanks
 
It's not all cli :P
etc
 
J--
12:15 AM
Don't think I am yet to use DDD. Used gdb for a few ctf challenges.
 
Yeah, never had to use that
Since I never had non-IL code I had to debug
 
Yeah I prefer gdb (never used ddd actually). But I'm no expert in it!
I can ni over and over and dump the regs, but that's about it.
 
J--
I find it quite odd that this course doesn't feature any GUI debuggers. I guess it is just faster to use a command line based one for this stuff.
 
It's much faster.
 
J--
But Immunity and such also have scripting as does windbg
so I dont get the logic..
 
12:16 AM
Well Winblows people tend to like GUIs.
 
J--
Yeah, exactly...
But not in this case.
Oh well, is what it is. Another tool can't hurt. It is faster to use a CLI.
Well, windbg technically has a gui
but its just got a command window inside of it
which is totally dumb if you ask me
 
heh
 
J--
As you said, they like their guis
even if its just a command box in a gui!
lmfao...
 
The thing is, keys are better for nearly everything.
Except perhaps first-person shooters.
 
Honestly, the extent of my debugger usage was actually, get this, to find bugs
 
12:18 AM
But even managing windows (as in graphical windows in a window manager) is easier with keys. Hence the popularity of tiling window managers (<3 tiling).
 
Not if you have an aimbot :^D
 
J--
Oh, absolutely.
Hahaha, what mech said ^^
 
Honestly I am pleased to admit I've never cheated in an online game
 
J--
I wish I could say the same.
I used to be a little prick.
 
That's something most people would actually assume I have done
 
J--
12:22 AM
Anti-aiming was so much fun.
 
@J-- All past sins can be forgiven
 
J--
Nothing better when the other team thinks they can win
and you just turn on an anti aim and ragebot
 
But did you really win?
I used to have a program for that
Which just had one button and when you clicked it, it displayed "You won"
I wrote it for a classmate who was so proud about cheating in counter strike
I said that this just expedites the process of external validation
And just purifies it
 
J--
I dabbled in writing cheats myself for a while, just for my own interest
got bored though, grew up.
 
Funnily enough, that's something I entirely understand
I really enjoyed messing with Rogue Legacy
 
J--
12:24 AM
Cheating was very fun when I was 14 years old.
 
Also, do you want to know something hilarious about Minecraft?
 
J--
But by the time I was 16 I was playing CS very seriously, going to play at LANs and such so
I used to cheat in minecraft too
nodus on faction servers :D
SO much fun.
 
I can't even imagine what "cheating" in a sandbox can be like
 
J--
Nodus was an xray among other things
SO on faction servers it was llike get loot and pvp right
 
But yeah, in older versions of minecraft, fall damage did not at all depend on your vertical velocity, but rather the time you have been falling
 
J--
12:26 AM
but if you had xray you could find people starting out.
 
@J-- Minecraft PvP
 
J--
just take their shit and then you'd be rich as fuck
 
kek
 
J--
hahahaha yeah
i was like 9 to be fair!
i think it is totally justified to play mc pvp at 9
 
Yeah, sure
I've just always seen Minecraft as a coop game
It never had engaging PvP combat
Or any engaging combat for that matter
 
J--
12:28 AM
yeah it was just spam clicking swords to be fair
and spam healing with poitions
but of course because i had xray i had infinite of these things
or basically infinite
 
Yeah, so I've always liked to play Minecraft with the Infinity Evolved: Expert Mode modpack
 
J--
i also cheated in dayz for a while that was fun too
 
Which adds a lot of machinery, magic, etc...
 
J--
especially when they had servers with thermal guns
 
And they were all modified to be intertwined
 
J--
12:29 AM
ive never heard of that mod actually
 
Nah, never played DayZ
@J-- It's soo good
 
J--
dayz was great. buggy as fuck but great.
now i think about i think i cheated in every game i played at least once
 
So basically, you had two "ladders" in Infinity Evolved: Tech and Magic
 
J--
hahaha, wow, i was a cunt.
 
@J-- That fucker cheated in 3D Pinball Space Cadet!
 
J--
12:30 AM
i guess cheating in games was the first time i ran into security in some sense.
are anti cheats considered security? they are right?
they must be.
 
Yeah
 
J--
@MechMK1 oh cool
i played skyrim mod a lot in minecraft
at the time my pc couldnt run skyrim
and someone made this huge fucking mod which had like 60% of skyrim in minecraft
 
@J-- So in that modpack, you basically make everything more difficult
And more in-depth
For example, you couldn't just craft pickaxes anymore aside from wooden ones
You needed to use the Tinker's Construct mod
Which allowed you to make tools out of a vast array of materials, including alloys
Tools out of "soft" materials could be crafted at a station, while metallurgy required you to build a smeltery
Which was a multi-block structure that required you to make casts of the things you wanted to do
So that's more or less the beginning of the "tech" ladder
 
J--
Oh wow, so it basically added a shit load more to do.
Or at least, made the game more content packed.
 
Exactly, hence the name
The magic ladder contained 4 big magic mods, and they were tweaked to all be intertwined
You couldn't say you just wanted to do, say, Botany, since you required stuff from Thaumcraft, Blood Magic and Witchery
And each of these four magic mods had its own set of systems and micro-games, and you always had to progress in other mods before you could go too far in that one mod
Of course, the tech ladder was also intertwined with the magic ladder
 
J--
12:36 AM
Oh thats actually super cool
cant believe i hadnt hear of this back then
 
@J-- What's anti-aiming?
 
J--
@forest SO basically.
 
@forest basically so you couldn't be hit anymore
 
J--
It is more useful for HvH.
But you can use it non-hacking only games.
You have different settings which allow you to move your player in different ways
So spin Y or X for example
With different speeds and angles.
 
12:37 AM
The only game hacks for multiplayer games I know are client-side ones like transparent barriers, walls, etc. Since the server can't detect that at all.
 
J--
ANd then when ytou're trying to code an aimbot it is a damn lot harder to calculate the aimbot
since if someone is spinning on y axix at 50% and then on x axis at 70% and then you factor that in with randomness and a bunch of other random factoers
it is a damn lot harder for an aimbot to get the correct calculation
SOme cheats had such well made anti aims that other aimbots could simply not hs you more than 1/1000 times (in cs at least)
 
@J-- So anyways, before I go to bed, the tech ladder and the magic ladder are also intertwined. For example, a lot of magical constructs require "mundane" materials like steel or such, while some tech constructs require "magical" components like Managlass or such
 
J--
But of course, everyone eventually got really good at figuring out ways of getting the addresses accurately even with an anti aim running
 
Why doesn't the server detect that you're doing that?
 
J--
Oh it does.
 
12:40 AM
@forest It did :D
 
J--
That is why it more useful for HvH.
Basically, private servers for cheaters to play against each other.
 
ah
 
J--
In actual games, vs non cheaters it was less useful since you'd just get banned.
 
@forest There are so-called "silent" cheats, which aim (no pun intended) to remain undetected
And what people refer to as "rage hacks", which are blatantly obvious
 
J--
Yeah, people would play with like a 2% aimbot.
Which meant if you could get close enough to the head in a 360 degree area
thhere'd be a 2% correction on your aim
so you get within x pixels
it will lock
 
12:41 AM
I wonder if anyone's tried to totally bypass client-side detection for wallhacks by intercepting the commands to the kernel for the GPU and adjusting polygon transparency.
 
And in all honesty, it can be pretty difficult to detect someone who has a wallhack if you don't know what you are looking for
 
There'd be no way to detect that without capturing GPU output.
 
J--
@MechMK1 Yeah although CS did this thing where the player hitboxes arent visible past a certain range
 
@forest Even if you had a totally undetectable wallhack, you could still get banned
 
J--
so like, in cs way back when you could esp across the map
 
12:42 AM
Because of the way you act
 
Well that's a matter of behavior.
 
J--
but they changed that so that hitboxes only come into view when the players are x distance from you
 
Yeah, that's the thing:
 
J--
@forest so not sure about gpus but
 
Like the Allies not giving away that they broke Enigma by not acting on every message.
 
J--
12:43 AM
in CS someone made a cheat which you downloaded via the steam workshop
 
Lots of cheaters are retarded
 
J--
it was a map in the workshop, you download it, it injects into the game
and had an esp built in
 
@J-- They fixed that
 
J--
yeah i know.
 
esp?
 
12:43 AM
I actually know how that worked :D
 
J--
but for a long time it was unknown.
 
Extra-Sense-Perception
 
J--
extra sensory perception
 
Basically seeing things you're not supposed to see
 
J--
:D walls, yeah.
 
12:43 AM
Ah, like seeing health over an enemy's head?
Or seeing how much ammo they have?
 
J--
You could never do that in CS, but you could see them across the entire map, their hitbox.
SO it would track all the enemies and draw a box around them
and even if they were behind a wall or something, they were visible. same for smokes, etc.
 
Sounds like a game of cat and mouse where client-side detection and anti-detection measures keep one-upping each other. Hence my GPU comment (which I think would be undetectable).
 
J--
Yeah, exactly!
Even now this costs big companies millions in development costs of their Anti Cheat.
 
@forest What I wanted to get at before is that a lot of cheaters are idiots
 
J--
But I think you're right with the GPU thing, nobody has gone that far.
 
12:45 AM
And they just like to show off how great they are
 
J--
But people have put cheats into mice drivers.
 
And instead of learning how to play well, they just cheat
But wallhacks isn't a 100% substitute for 1000 hours played
 
J--
There's a well known cheat dev that has a mouse which costs about $800 and the driver features a custom aimbot for cs.
 
@J-- But wouldn't it be extremely effective? I mean, I'm not sure how you could know (in the kernel) which polygons should be made transparent, but it's probably not too hard to do).
 
It is
 
J--
12:46 AM
@forest oh absolutely, yes.
 
And people still get caught
Someone who has moderate skill in CS:GO and wallhacks will play fundamentally different than someone who has very high skill and no hacks
 
J--
As far as the AC detecting a GPU embedded ESP, then yeah, it would never detect it.
 
And that disparity gets noticed
 
J--
But humans could, by reviewing games.
 
AC being anti-cheat?
 
12:47 AM
Yeah, that's what I am getting at
 
J--
@forest Yeah.
 
I wonder what sort of techniques they use, beyond the obvious ones like attaching a debugger and obfuscating addresses/variables (and the dumb techniques like scanning for signatures in the address space). Like, would running in a VM with the host hooking certain behaviors be detected by timing variations?
 
Also, a lot of cheaters make dumb mistakes and then overcompensate
 
J--
As I said, there's a well known cheat dev right now selling a mouse for CS with a smooth aim embedded in the mouses driver. It works on all known ACs as well as ACs used in professional play.
 
For example, they may look at someone through a wall, and then notice that they have done that for the past 3 rounds
So in the next round, they play super cautiously
 
J--
12:48 AM
Yeah, using ESP, especially on a pro stage is borderline impossible to get away with because of the human behaviour element.
@forest It is funny you say that. So, get this.
 
Yeah, high-level play is under very high scrutiny
 
J--
Until 2017, if you played CS on Linux, you could cheat and the AC could basically NOT detect it.
For the Linux platform the CS AC was basically just... Not doing anything.
Of course, people started to figure this out that the AC for linux client was severely lacking which eventually caused Valve to make a large number of updates to the AC for Linux.
 
Also, one thing I really like is using expensive skins as a social anti-cheat incentive
 
J--
As far as bypasses for AC goes these days, most of the top cheats run on a USB stick. That has been popular for a while now.
 
Because if you get banned, all your extremely valuable skins are gone
So people will naturally want to use good-looking and likely expensive skins when they played for some time
So it works as a deterrent
 
J--
12:51 AM
It isn't foolproof of course, but running on a USB stick significantly reduces the chance of being detected.
 
Do you really want to lose 1000 USD worth of skins?
 
J--
With the exception of the anti-cheat that Valorent runs... That thing is fucking... Nasty.
 
@J-- Why?
How does that differ from running on your internal drive?
 
J--
So, Valorents AC is one of the most intrusive ACs on the market.
 
Don't tell me the anti-cheat is so dumb that it only looks at your C: drive.
 
J--
12:52 AM
Oh, you mean for USB sticks.
So, I don't actually know why the USB stick worked for so long, since I don't know enough about AC dev but it was something to do with the fact you could unplug the stick once you load the cheat and that made it a lot harder to find the files.
 
> “Yes we run a driver at system startup”, but explaining it “doesn’t scan anything (unless the game is running)”. It’s “designed to take up as few system resources as possible and it doesn’t communicate to our servers,” he adds. “You can remove it at anytime.”
wow
 
J--
Yeah...
Valorents AC is gross.
 
@J-- So the thing is so dumb that it doesn't even scan running processes? It literally reads files on your filesystem to find the cheats??
 
J--
There are very few reliable cheats for that game.
 
Some game on steam ran with kernel privileges
 
J--
12:54 AM
@forest VAC was doing process scanning but it just wasn't sufficient.
The cheat community was far ahead of VAC for a long time.
 
I feel the more this conversation goes on, the more I expect @forest to come with a working FUD for CS:GO in the coming days
 
J--
Nowadays, VAC is much better.
 
FUD?
 
Fully Undetected
Basically a cheat impossible to detect
 
J--
In the last 2 years, there has been A LOT of work on VAC and also on their AI based AC which analyses player behaviour rather than the technical side of things.
 
12:55 AM
Oh. That's such a script kiddie term.
 
Yup, guess what, most cheaters are skids
 
J--
So, a lot of my information is outdated here. The AC has significantly improved.
Hence why there are people moving to cheats inside mouse drivers, keyboard drivers, etc.
 
And those who write cheats usually just do so to sell them to skids
 
Does CS:GO run on *nix?
 
Yeah
 
J--
12:56 AM
Yeah, it does.
 
Huh, guess it would be fun to try to bypass detection.
Are there no existing fully undetectable wall hacks?
 
J--
Oh there are. Plenty.
 
Damn. I was hoping I could do something new. :D
 
J--
So, the main issue with CS now is that they effectively have two anti cheats.
The first is VAC which is a classic AC which does all kinda' things you'd expect, file scanning, process scanning, etc.
 
Side-channel attack to leak information about which polygons are for walls. Driver to modify GPU behavior to adjust per-polygon transparency before sending it off to the GPU itself. But I guess their anti-cheat is so dumb that such a thing would be massively overkill.
 
J--
12:57 AM
But they also now have this addition to VAC which is an AI behaviour analysis tool.
It looks at the way reported players play and it tries to figure out if they're using external assistance.
It turns out it is much easier to make an AC that way than it is to do it via process inspection, etc.
 
> Riot has “tried to be very careful with the security of the driver”, according to the post, bringing in “multiple external security research teams” to take a good look at it for any flaws that could cause problems, such as “accidentally decreas[ing] the security of the computer”. The studio has also taken a “least-privilege approach” towards the anti-cheat system’s driver, which means the non-driver does “the majority of work” and doesn’t actually run unless Valorant itself is running.
ehehehe
 
J--
But because Valorent have their own driver where VAC do not, they can detect almost everything.
That's why it is so easy to cheat in CS and not in Valorent.
Ultimately, CS does not have enough privileges of the host to be consistent.
 
You know, pwning computers through multiplayer games is underrated.
 
J--
Yeah, I agree!
In-fact, I think it is a rather large unexplored area.
I reckon there are TONNES of cool bugs to be found in this field.
There was a stored XSS in CS not long ago, actually.
 
The neat thing is that it's not unlikely that you could pwn Xbox/PS4 devices that way.
And from that you have access to their Wi-Fi.
 
J--
1:00 AM
It affected all the players in a server.
 
I imagine most games run in supervisor mode, or at least with drivers that do.
 
J--
You know, maybe once I finish this course, I might go back to this kinda' thing and start trying to find bugs in multiplayer games.
I agree, it is a super cool area and there for sure isn't enough public research into this. Like, not that I've seen. I've seen a few regulars that post blog posts on this kinda' thing but not a huge amount of people in general.
 
Indeed. Video game devs don't give a shit about security of their client (or server).
 
J--
Yeah, it is for sure, very, very, very far down on their list if they care at all.
Hey, look at the Crytek breach!
 
:p
 
J--
1:02 AM
Yeah, unfortunately the cheating community is filled with skids.
But, it is a super interesting field, I think so, at least.
 
For sure.
 
J--
And as far as actually using games to exploit users that is very much underrated as you said.
I reckon you could find a TONNE of RCEs in games.
 
Oh yeah.
 
J--
Maybe you should take it up, Forest :)
2 weeks later
"found 12 rces in 3 games"
 
lol I wish. My binary exploitation could use some work.
It's hard enough when I can recompile the binary at will. :D
 
J--
1:04 AM
You know what, this is what I'm going to do.
After I finish this course, I am going to start a personal project.
I am going to pick a game and I'm going to see how bad it really is.
 
One thing you can do is learn to attack emulators. Some games actually run in emulators natively.
 
J--
I know that CS has quite a lot of research already in this kinda' thing. I've read a couple blog posts on it.
 
And emulators have a huge attack surface area.
 
J--
Oh that's a great idea.
I think I actually might know someone who worked on that Valorent driver.
Wait, let me double check.
 
@J-- Find a bug in an NEC PC-9801 emulator and I'll love you forever. :D
 
J--
1:07 AM
Hmm, nevermind, cannot verify that. Still might be the case but not sure.
NEC, wow. That is OLD.
Where do you even download the emulator from? All of these sites seem... Dodgy.
One says "adult games"...
 
I know a few good ones. One sec.
 
J--
Oh, you'll like this, forest.
I just remembered something.
 
Looking for NekoProject II, Anex86, and T98-Next...
 
J--
So, I used to play a game that had a custom AC.
One of their AC features was to regularly take screenshots of the users connected displays.
 
yui.ne.jp/np2 (NP2) is my favorite NEC PC-9801 emulator.
 
J--
1:11 AM
If you think that is bad, it gets worse. They had another AC component which would try and access browser history and then scan the history for anything related to cheating and pre-emptively ban based on any matching results.
I was like... 9 years old when I played this game?
 
(Oh huh it's open source too amethyst.yui.ne.jp/svn/pc98/np2/tags/VER_0_86)
@J-- oh my god. What game?
 
J--
And then about... 5 years later, I saw a post on a forum where someone had leaked the games files and their AC.
It was actually an emulator of an existing game.
I don't even remember the emulator name.
But basically, the original game got hacked, source code leaked.
The community made a bunch of "emulators" of the original game.
These emulators usually just used like a common anti cheat like easyanticheat or something. But one had its own.
And it had some WILD features.
@forest oh nice.
 
Source code is good and easy to read: amethyst.yui.ne.jp/svn/pc98/np2/tags/VER_0_86/timing.c
 
J--
Heh, this is the lead AC engineer for Valorent.
Specializes in game security. That. Is. Fucking. Cool.
 
static REG8 getledstat(void) {

	REG8	ret;

	ret = 0;
	if (keyctrl.kanaref != NKEYREF_NC) {
		ret |= 8;
	}
	if (keyctrl.capsref != NKEYREF_NC) {
		ret |= 4;
	}
	return(ret);
}
(I can't say I like the spacing they use though)
 
J--
1:16 AM
I always liked game dev from a very young age. So doing game security must be SO FUN.
 
"Game security" in context means DRM.
 
J--
Is that 8 spaces???
@forest Yeah, I guess what I would like to do would be what we discussed. Not DRM.
:D
 
Think it's a tab. But no space after the return. And a weird newline after the {.
But otherwise the code is clean.
 
J--
Yeah, that is clean :D
Alright, I'm going to go for a few hours. Start the next module, might as well.
 
aight. later
(Ooh even the sound drivers are clean. That's rare: amethyst.yui.ne.jp/svn/pc98/np2/tags/VER_0_86/sound/tms3631c.c)
hehe
Huh it looks like NP2 is more up to date at nenecchi.kirara.st/#PC-98?
Idk I've been out of the loop.
wow 2021
 
 
2 hours later…
J--
3:54 AM
Jesus. Why do people even go out of their way to provide a non-answer?
What the hell is there to gain by posting an answer that doesn't answer the question.
Other than inflate your own sense of self-importance, it does absolutely nothing for the OP or anyone else. It is totally, fucking, retarded.
 
@J-- link?
 
J--
It isn't here.
What is the fucking point.
 
lol
 
J--
Fucking moron.
I realise I am way too annoyed about this.
Probably bed time soon.
 
Oh I understand. People can be incredibly... simple, huh.
 
J--
3:59 AM
Yeah... As I said, the only thing it does is inflate their own sense of self importance.
 
00:00 - 04:0004:00 - 00:00

« first day (3735 days earlier)      last day (44 days later) »