The DMZ

12:09 AM

Yeah honestly, if the attacker is already root on my system, be my guest and brick it, because I ain't touching that shit anymore

Or any other server for that matter. I'm clearly not up to the task

forest

I think the issue is that it could be used to damage dedicated servers.

They regularly give people root and simply wipe the server before giving it to someone else.

BIOS and related firmware is write-protected, but the general belief is that a root user cannot damage the system (beyond simply wearing parts out faster by heating it up).

MechMK1

Well, rent one and find out

forest

B-but money!

Dedis aren't cheap.

That's why I'm trying to find some sucker to do it for me. >:D

Anonymous

Well, that's one module completed in 24 hours exactly with just one missing solution.

Anonymous

I need to get a life.

Anonymous

12:12 AM

Jesus. Time to procrastinate, I guess.

Anonymous

Only 11 more to go!

MechMK1

You can have mine but I wouldn't want to be known for shipping damaged goods

Anonymous

To be fair, that was just the WinDbg module, the rest won't be this easy.

forest

>WinDbg

>not using gdb or ddd

pleb

Anonymous

Yeah, I don't like it...

Anonymous

12:13 AM

But the whole course is with WinDbg so they tell you to use it for "simplicity".

MechMK1

>actually using command line debuggers instad of nice visual debuggers integrated into your IDE

^- Has never bothered to learn how gdb works

Anonymous

Yeah I will likely use immunity in my exam

Anonymous

fuck using this the entire time

Anonymous

48 hours of windbg no thanks

forest

@MechMK1 gnu.org/software/ddd

It's not all cli :P

etc

Anonymous

12:15 AM

Don't think I am yet to use DDD. Used gdb for a few ctf challenges.

MechMK1

Yeah, never had to use that

Since I never had non-IL code I had to debug

forest

Yeah I prefer gdb (never used ddd actually). But I'm no expert in it!

I can ni over and over and dump the regs, but that's about it.

Anonymous

I find it quite odd that this course doesn't feature any GUI debuggers. I guess it is just faster to use a command line based one for this stuff.

forest

It's much faster.

Anonymous

But Immunity and such also have scripting as does windbg

Anonymous

12:16 AM

so I dont get the logic..

forest

Well Winblows people tend to like GUIs.

Anonymous

Yeah, exactly...

Anonymous

But not in this case.

Anonymous

Oh well, is what it is. Another tool can't hurt. It is faster to use a CLI.

Anonymous

Well, windbg technically has a gui

Anonymous

12:17 AM

but its just got a command window inside of it

Anonymous

which is totally dumb if you ask me

forest

heh

Anonymous

As you said, they like their guis

Anonymous

even if its just a command box in a gui!

Anonymous

lmfao...

forest

12:18 AM

The thing is, keys are better for nearly everything.

Except perhaps first-person shooters.

MechMK1

Honestly, the extent of my debugger usage was actually, get this, to find bugs

forest

But even managing windows (as in graphical windows in a window manager) is easier with keys. Hence the popularity of tiling window managers (<3 tiling).

MechMK1

Not if you have an aimbot :^D

Anonymous

Oh, absolutely.

Anonymous

Hahaha, what mech said ^^

MechMK1

12:20 AM

Honestly I am pleased to admit I've never cheated in an online game

Anonymous

I wish I could say the same.

Anonymous

I used to be a little prick.

MechMK1

That's something most people would actually assume I have done

Anonymous

Anti-aiming was so much fun.

MechMK1

@J-- All past sins can be forgiven

Anonymous

12:22 AM

Nothing better when the other team thinks they can win

Anonymous

and you just turn on an anti aim and ragebot

MechMK1

But did you really win?

I used to have a program for that

Which just had one button and when you clicked it, it displayed "You won"

I wrote it for a classmate who was so proud about cheating in counter strike

I said that this just expedites the process of external validation

And just purifies it

Anonymous

I dabbled in writing cheats myself for a while, just for my own interest

Anonymous

got bored though, grew up.

MechMK1

Funnily enough, that's something I entirely understand

I really enjoyed messing with Rogue Legacy

Anonymous

12:24 AM

Cheating was very fun when I was 14 years old.

MechMK1

Also, do you want to know something hilarious about Minecraft?

Anonymous

But by the time I was 16 I was playing CS very seriously, going to play at LANs and such so

Anonymous

I used to cheat in minecraft too

Anonymous

nodus on faction servers :D

Anonymous

SO much fun.

MechMK1

12:25 AM

I can't even imagine what "cheating" in a sandbox can be like

Anonymous

Nodus was an xray among other things

Anonymous

SO on faction servers it was llike get loot and pvp right

MechMK1

But yeah, in older versions of minecraft, fall damage did not at all depend on your vertical velocity, but rather the time you have been falling

Anonymous

but if you had xray you could find people starting out.

MechMK1

@J-- Minecraft PvP

Anonymous

12:26 AM

just take their shit and then you'd be rich as fuck

MechMK1

kek

Anonymous

hahahaha yeah

Anonymous

i was like 9 to be fair!

Anonymous

i think it is totally justified to play mc pvp at 9

MechMK1

Yeah, sure

I've just always seen Minecraft as a coop game

It never had engaging PvP combat

Or any engaging combat for that matter

Anonymous

12:28 AM

yeah it was just spam clicking swords to be fair

Anonymous

and spam healing with poitions

Anonymous

but of course because i had xray i had infinite of these things

Anonymous

or basically infinite

MechMK1

Yeah, so I've always liked to play Minecraft with the Infinity Evolved: Expert Mode modpack

Anonymous

i also cheated in dayz for a while that was fun too

MechMK1

12:29 AM

Which adds a lot of machinery, magic, etc...

Anonymous

especially when they had servers with thermal guns

MechMK1

And they were all modified to be intertwined

Anonymous

ive never heard of that mod actually

MechMK1

Nah, never played DayZ

@J-- It's soo good

Anonymous

dayz was great. buggy as fuck but great.

Anonymous

12:29 AM

now i think about i think i cheated in every game i played at least once

MechMK1

So basically, you had two "ladders" in Infinity Evolved: Tech and Magic

Anonymous

hahaha, wow, i was a cunt.

MechMK1

@J-- That fucker cheated in 3D Pinball Space Cadet!

Anonymous

i guess cheating in games was the first time i ran into security in some sense.

Anonymous

are anti cheats considered security? they are right?

Anonymous

12:31 AM

they must be.

MechMK1

Yeah

Anonymous

@MechMK1 oh cool

Anonymous

i played skyrim mod a lot in minecraft

Anonymous

at the time my pc couldnt run skyrim

Anonymous

and someone made this huge fucking mod which had like 60% of skyrim in minecraft

MechMK1

12:32 AM

@J-- So in that modpack, you basically make everything more difficult

And more in-depth

For example, you couldn't just craft pickaxes anymore aside from wooden ones

You needed to use the Tinker's Construct mod

Which allowed you to make tools out of a vast array of materials, including alloys

Tools out of "soft" materials could be crafted at a station, while metallurgy required you to build a smeltery

Which was a multi-block structure that required you to make casts of the things you wanted to do

So that's more or less the beginning of the "tech" ladder

Anonymous

Oh wow, so it basically added a shit load more to do.

Anonymous

Or at least, made the game more content packed.

MechMK1

Exactly, hence the name

The magic ladder contained 4 big magic mods, and they were tweaked to all be intertwined

You couldn't say you just wanted to do, say, Botany, since you required stuff from Thaumcraft, Blood Magic and Witchery

And each of these four magic mods had its own set of systems and micro-games, and you always had to progress in other mods before you could go too far in that one mod

Of course, the tech ladder was also intertwined with the magic ladder

Anonymous

Oh thats actually super cool

Anonymous

cant believe i hadnt hear of this back then

forest

12:36 AM

@J-- What's anti-aiming?

MechMK1

ftb.gamepedia.com/FTB_Infinity_Evolved

Anonymous

@forest SO basically.

MechMK1

@forest basically so you couldn't be hit anymore

Anonymous

It is more useful for HvH.

Anonymous

But you can use it non-hacking only games.

Anonymous

12:37 AM

You have different settings which allow you to move your player in different ways

Anonymous

So spin Y or X for example

Anonymous

With different speeds and angles.

forest

The only game hacks for multiplayer games I know are client-side ones like transparent barriers, walls, etc. Since the server can't detect that at all.

Anonymous

ANd then when ytou're trying to code an aimbot it is a damn lot harder to calculate the aimbot

Anonymous

since if someone is spinning on y axix at 50% and then on x axis at 70% and then you factor that in with randomness and a bunch of other random factoers

Anonymous

12:38 AM

it is a damn lot harder for an aimbot to get the correct calculation

Anonymous

SOme cheats had such well made anti aims that other aimbots could simply not hs you more than 1/1000 times (in cs at least)

MechMK1

@J-- So anyways, before I go to bed, the tech ladder and the magic ladder are also intertwined. For example, a lot of magical constructs require "mundane" materials like steel or such, while some tech constructs require "magical" components like Managlass or such

Anonymous

But of course, everyone eventually got really good at figuring out ways of getting the addresses accurately even with an anti aim running

forest

Why doesn't the server detect that you're doing that?

Anonymous

Oh it does.

MechMK1

12:40 AM

@forest It did :D

Anonymous

That is why it more useful for HvH.

Anonymous

Basically, private servers for cheaters to play against each other.

forest

ah

Anonymous

In actual games, vs non cheaters it was less useful since you'd just get banned.

MechMK1

@forest There are so-called "silent" cheats, which aim (no pun intended) to remain undetected

And what people refer to as "rage hacks", which are blatantly obvious

Anonymous

12:41 AM

Yeah, people would play with like a 2% aimbot.

Anonymous

Which meant if you could get close enough to the head in a 360 degree area

Anonymous

thhere'd be a 2% correction on your aim

Anonymous

so you get within x pixels

Anonymous

it will lock

forest

I wonder if anyone's tried to totally bypass client-side detection for wallhacks by intercepting the commands to the kernel for the GPU and adjusting polygon transparency.

MechMK1

12:41 AM

And in all honesty, it can be pretty difficult to detect someone who has a wallhack if you don't know what you are looking for

forest

There'd be no way to detect that without capturing GPU output.

Anonymous

@MechMK1 Yeah although CS did this thing where the player hitboxes arent visible past a certain range

MechMK1

@forest Even if you had a totally undetectable wallhack, you could still get banned

Anonymous

so like, in cs way back when you could esp across the map

MechMK1

Because of the way you act

forest

12:42 AM

Well that's a matter of behavior.

Anonymous

but they changed that so that hitboxes only come into view when the players are x distance from you

MechMK1

Yeah, that's the thing:

Anonymous

@forest so not sure about gpus but

forest

Like the Allies not giving away that they broke Enigma by not acting on every message.

Anonymous

in CS someone made a cheat which you downloaded via the steam workshop

MechMK1

12:43 AM

Lots of cheaters are retarded

Anonymous

it was a map in the workshop, you download it, it injects into the game

Anonymous

and had an esp built in

MechMK1

@J-- They fixed that

Anonymous

yeah i know.

forest

esp?

MechMK1

12:43 AM

I actually know how that worked :D

Anonymous

but for a long time it was unknown.

MechMK1

Extra-Sense-Perception

Anonymous

extra sensory perception

MechMK1

Basically seeing things you're not supposed to see

Anonymous

:D walls, yeah.

forest

12:43 AM

Ah, like seeing health over an enemy's head?

Or seeing how much ammo they have?

Anonymous

You could never do that in CS, but you could see them across the entire map, their hitbox.

Anonymous

SO it would track all the enemies and draw a box around them

Anonymous

and even if they were behind a wall or something, they were visible. same for smokes, etc.

forest

Sounds like a game of cat and mouse where client-side detection and anti-detection measures keep one-upping each other. Hence my GPU comment (which I think would be undetectable).

Anonymous

Yeah, exactly!

Anonymous

12:45 AM

Even now this costs big companies millions in development costs of their Anti Cheat.

MechMK1

@forest What I wanted to get at before is that a lot of cheaters are idiots

Anonymous

But I think you're right with the GPU thing, nobody has gone that far.

MechMK1

And they just like to show off how great they are

Anonymous

But people have put cheats into mice drivers.

MechMK1

And instead of learning how to play well, they just cheat

But wallhacks isn't a 100% substitute for 1000 hours played

Anonymous

12:46 AM

There's a well known cheat dev that has a mouse which costs about $800 and the driver features a custom aimbot for cs.

forest

@J-- But wouldn't it be extremely effective? I mean, I'm not sure how you could know (in the kernel) which polygons should be made transparent, but it's probably not too hard to do).

MechMK1

It is

Anonymous

@forest oh absolutely, yes.

MechMK1

And people still get caught

Someone who has moderate skill in CS:GO and wallhacks will play fundamentally different than someone who has very high skill and no hacks

Anonymous

As far as the AC detecting a GPU embedded ESP, then yeah, it would never detect it.

MechMK1

12:46 AM

And that disparity gets noticed

Anonymous

But humans could, by reviewing games.

forest

AC being anti-cheat?

MechMK1

Yeah, that's what I am getting at

Anonymous

@forest Yeah.

forest

I wonder what sort of techniques they use, beyond the obvious ones like attaching a debugger and obfuscating addresses/variables (and the dumb techniques like scanning for signatures in the address space). Like, would running in a VM with the host hooking certain behaviors be detected by timing variations?

MechMK1

12:47 AM

Also, a lot of cheaters make dumb mistakes and then overcompensate

Anonymous

As I said, there's a well known cheat dev right now selling a mouse for CS with a smooth aim embedded in the mouses driver. It works on all known ACs as well as ACs used in professional play.

MechMK1

For example, they may look at someone through a wall, and then notice that they have done that for the past 3 rounds

So in the next round, they play super cautiously

Anonymous

Yeah, using ESP, especially on a pro stage is borderline impossible to get away with because of the human behaviour element.

Anonymous

@forest It is funny you say that. So, get this.

MechMK1

Yeah, high-level play is under very high scrutiny

Anonymous

12:49 AM

Until 2017, if you played CS on Linux, you could cheat and the AC could basically NOT detect it.

Anonymous

For the Linux platform the CS AC was basically just... Not doing anything.

Anonymous

Of course, people started to figure this out that the AC for linux client was severely lacking which eventually caused Valve to make a large number of updates to the AC for Linux.

MechMK1

Also, one thing I really like is using expensive skins as a social anti-cheat incentive

Anonymous

As far as bypasses for AC goes these days, most of the top cheats run on a USB stick. That has been popular for a while now.

MechMK1

Because if you get banned, all your extremely valuable skins are gone

So people will naturally want to use good-looking and likely expensive skins when they played for some time

So it works as a deterrent

Anonymous

12:51 AM

It isn't foolproof of course, but running on a USB stick significantly reduces the chance of being detected.

MechMK1

Do you really want to lose 1000 USD worth of skins?

Anonymous

With the exception of the anti-cheat that Valorent runs... That thing is fucking... Nasty.

forest

@J-- Why?

How does that differ from running on your internal drive?

Anonymous

So, Valorents AC is one of the most intrusive ACs on the market.

forest

Don't tell me the anti-cheat is so dumb that it only looks at your C: drive.

Anonymous

12:52 AM

Oh, you mean for USB sticks.

Anonymous

So, I don't actually know why the USB stick worked for so long, since I don't know enough about AC dev but it was something to do with the fact you could unplug the stick once you load the cheat and that made it a lot harder to find the files.

forest

pcgamesn.com/valorant/anti-cheat-system

> “Yes we run a driver at system startup”, but explaining it “doesn’t scan anything (unless the game is running)”. It’s “designed to take up as few system resources as possible and it doesn’t communicate to our servers,” he adds. “You can remove it at anytime.”

wow

Anonymous

Yeah...

Anonymous

Valorents AC is gross.

forest

@J-- So the thing is so dumb that it doesn't even scan running processes? It literally reads files on your filesystem to find the cheats??

Anonymous

12:53 AM

There are very few reliable cheats for that game.

MechMK1

Some game on steam ran with kernel privileges

Anonymous

@forest VAC was doing process scanning but it just wasn't sufficient.

Anonymous

The cheat community was far ahead of VAC for a long time.

MechMK1

I feel the more this conversation goes on, the more I expect @forest to come with a working FUD for CS:GO in the coming days

Anonymous

Nowadays, VAC is much better.

forest

12:54 AM

FUD?

MechMK1

Fully Undetected

Basically a cheat impossible to detect

Anonymous

In the last 2 years, there has been A LOT of work on VAC and also on their AI based AC which analyses player behaviour rather than the technical side of things.

forest

Oh. That's such a script kiddie term.

MechMK1

Yup, guess what, most cheaters are skids

Anonymous

So, a lot of my information is outdated here. The AC has significantly improved.

Anonymous

12:55 AM

Hence why there are people moving to cheats inside mouse drivers, keyboard drivers, etc.

MechMK1

And those who write cheats usually just do so to sell them to skids

forest

Does CS:GO run on *nix?

MechMK1

Yeah

Anonymous

Yeah, it does.

forest

Huh, guess it would be fun to try to bypass detection.

Are there no existing fully undetectable wall hacks?

Anonymous

12:56 AM

Oh there are. Plenty.

forest

Damn. I was hoping I could do something new. :D

Anonymous

So, the main issue with CS now is that they effectively have two anti cheats.

Anonymous

The first is VAC which is a classic AC which does all kinda' things you'd expect, file scanning, process scanning, etc.

forest

Side-channel attack to leak information about which polygons are for walls. Driver to modify GPU behavior to adjust per-polygon transparency before sending it off to the GPU itself. But I guess their anti-cheat is so dumb that such a thing would be massively overkill.

Anonymous

But they also now have this addition to VAC which is an AI behaviour analysis tool.

Anonymous

12:57 AM

It looks at the way reported players play and it tries to figure out if they're using external assistance.

Anonymous

It turns out it is much easier to make an AC that way than it is to do it via process inspection, etc.

forest

> Riot has “tried to be very careful with the security of the driver”, according to the post, bringing in “multiple external security research teams” to take a good look at it for any flaws that could cause problems, such as “accidentally decreas[ing] the security of the computer”. The studio has also taken a “least-privilege approach” towards the anti-cheat system’s driver, which means the non-driver does “the majority of work” and doesn’t actually run unless Valorant itself is running.

ehehehe

Anonymous

But because Valorent have their own driver where VAC do not, they can detect almost everything.

Anonymous

That's why it is so easy to cheat in CS and not in Valorent.

Anonymous

Ultimately, CS does not have enough privileges of the host to be consistent.

forest

12:59 AM

You know, pwning computers through multiplayer games is underrated.

Anonymous

Yeah, I agree!

Anonymous

In-fact, I think it is a rather large unexplored area.

Anonymous

I reckon there are TONNES of cool bugs to be found in this field.

Anonymous

There was a stored XSS in CS not long ago, actually.

forest

The neat thing is that it's not unlikely that you could pwn Xbox/PS4 devices that way.

And from that you have access to their Wi-Fi.

Anonymous

1:00 AM

It affected all the players in a server.

forest

I imagine most games run in supervisor mode, or at least with drivers that do.

Anonymous

You know, maybe once I finish this course, I might go back to this kinda' thing and start trying to find bugs in multiplayer games.

Anonymous

I agree, it is a super cool area and there for sure isn't enough public research into this. Like, not that I've seen. I've seen a few regulars that post blog posts on this kinda' thing but not a huge amount of people in general.

forest

Indeed. Video game devs don't give a shit about security of their client (or server).

Anonymous

Yeah, it is for sure, very, very, very far down on their list if they care at all.

Anonymous

1:02 AM

Hey, look at the Crytek breach!

forest

:p

Anonymous

Yeah, unfortunately the cheating community is filled with skids.

Anonymous

But, it is a super interesting field, I think so, at least.

forest

For sure.

Anonymous

And as far as actually using games to exploit users that is very much underrated as you said.

Anonymous

1:03 AM

I reckon you could find a TONNE of RCEs in games.

forest

Oh yeah.

Anonymous

Maybe you should take it up, Forest :)

Anonymous

2 weeks later

Anonymous

"found 12 rces in 3 games"

forest

lol I wish. My binary exploitation could use some work.

It's hard enough when I can recompile the binary at will. :D

Anonymous

1:04 AM

You know what, this is what I'm going to do.

Anonymous

After I finish this course, I am going to start a personal project.

Anonymous

I am going to pick a game and I'm going to see how bad it really is.

forest

One thing you can do is learn to attack emulators. Some games actually run in emulators natively.

Anonymous

I know that CS has quite a lot of research already in this kinda' thing. I've read a couple blog posts on it.

forest

And emulators have a huge attack surface area.

Anonymous

1:05 AM

Oh that's a great idea.

Anonymous

I think I actually might know someone who worked on that Valorent driver.

Anonymous

Wait, let me double check.

forest

@J-- Find a bug in an NEC PC-9801 emulator and I'll love you forever. :D

Anonymous

Hmm, nevermind, cannot verify that. Still might be the case but not sure.

Anonymous

NEC, wow. That is OLD.

Anonymous

1:08 AM

Where do you even download the emulator from? All of these sites seem... Dodgy.

Anonymous

One says "adult games"...

forest

I know a few good ones. One sec.

Anonymous

Oh, you'll like this, forest.

Anonymous

I just remembered something.

forest

Looking for NekoProject II, Anex86, and T98-Next...

Anonymous

1:10 AM

So, I used to play a game that had a custom AC.

Anonymous

One of their AC features was to regularly take screenshots of the users connected displays.

forest

yui.ne.jp/np2 (NP2) is my favorite NEC PC-9801 emulator.

Anonymous

If you think that is bad, it gets worse. They had another AC component which would try and access browser history and then scan the history for anything related to cheating and pre-emptively ban based on any matching results.

Anonymous

I was like... 9 years old when I played this game?

forest

(Oh huh it's open source too amethyst.yui.ne.jp/svn/pc98/np2/tags/VER_0_86)

@J-- oh my god. What game?

Anonymous

1:11 AM

And then about... 5 years later, I saw a post on a forum where someone had leaked the games files and their AC.

Anonymous

It was actually an emulator of an existing game.

Anonymous

I don't even remember the emulator name.

Anonymous

But basically, the original game got hacked, source code leaked.

Anonymous

The community made a bunch of "emulators" of the original game.

Anonymous

These emulators usually just used like a common anti cheat like easyanticheat or something. But one had its own.

Anonymous

1:12 AM

And it had some WILD features.

Anonymous

@forest oh nice.

forest

Source code is good and easy to read: amethyst.yui.ne.jp/svn/pc98/np2/tags/VER_0_86/timing.c

Anonymous

Heh, this is the lead AC engineer for Valorent.

Anonymous

arkem.org

Anonymous

Specializes in game security. That. Is. Fucking. Cool.

forest

1:15 AM

static REG8 getledstat(void) {

	REG8	ret;

	ret = 0;
	if (keyctrl.kanaref != NKEYREF_NC) {
		ret |= 8;
	}
	if (keyctrl.capsref != NKEYREF_NC) {
		ret |= 4;
	}
	return(ret);
}

(I can't say I like the spacing they use though)

Anonymous

I always liked game dev from a very young age. So doing game security must be SO FUN.

forest

"Game security" in context means DRM.

Anonymous

Is that 8 spaces???

Anonymous

@forest Yeah, I guess what I would like to do would be what we discussed. Not DRM.

Anonymous

:D

forest

1:16 AM

Think it's a tab. But no space after the return. And a weird newline after the {.

But otherwise the code is clean.

Anonymous

Yeah, that is clean :D

Anonymous

Alright, I'm going to go for a few hours. Start the next module, might as well.

forest

aight. later

(Ooh even the sound drivers are clean. That's rare: amethyst.yui.ne.jp/svn/pc98/np2/tags/VER_0_86/sound/tms3631c.c)

hehe

Huh it looks like NP2 is more up to date at nenecchi.kirara.st/#PC-98?

Idk I've been out of the loop.

wow 2021

Anonymous

3:54 AM

Jesus. Why do people even go out of their way to provide a non-answer?

Anonymous

What the hell is there to gain by posting an answer that doesn't answer the question.

Anonymous

Other than inflate your own sense of self-importance, it does absolutely nothing for the OP or anyone else. It is totally, fucking, retarded.

forest

@J-- link?

Anonymous

It isn't here.

Anonymous

What is the fucking point.

forest

3:58 AM

lol

Anonymous

Fucking moron.

Anonymous

I realise I am way too annoyed about this.

Anonymous

Probably bed time soon.

forest

Oh I understand. People can be incredibly... simple, huh.

Anonymous

Yeah... As I said, the only thing it does is inflate their own sense of self importance.

Transcript for