Deobfuscation and Analysis of Ring-1.io

[kuschku]

> The client should be treated as untrusted. All the real classification logic belongs server-side where it can’t be tampered with.

That's such a hilarious quote, as it explains exactly why client-side anti-cheat is silly in the first place.

[B3L]

It's not silly, for many types of games, having access to privileged information on the client is simply a necessity. Any multiplayer FPS client will have to know the positions of other players before they come into view for latency reasons. The client will have to know exact origin points of any sounds other players might make. Player models fully occluded by transparency effects will still have to be rendered and cheaters could just forgo the transparency pass all together. Same story with things like overlay effects and postprocessing (flash bangs, blurry vision, b&w image, ...). Texture changes can give a visibility advantage. The list goes on and on. Developers rely on client-side AC out of necessity, not out of ignorance.

[charcircuit]

If PCs caught up to Mac in terms of hardware security you would be able to use remote attestation to be able to detect tampering.

[Hikikomori]

Hard to believe that not a single game developer thought of this.

[not_a9]

Always a treat to see these people’s articles. Game hacking is wild - though in this case, wouldn’t enforcement of Secure Boot do the trick?

[mafriese]

From the conclusion

> Importantly, this work also highlights the defensive implications of such techniques. While Secure Boot and firmware integrity mechanisms would prevent this attack chain when correctly enforced, the explicit requirement for users to disable Secure Boot demonstrates how social and usability tradeoffs continue to undermine otherwise effective platform defenses.

[arcfour]

There are a number of Microsoft-signed drivers that have vulnerabilities in them that can be exploited allowing kernel-level access (memory read/write primitives, etc.) - they would load fine under Secure Boot - and, indeed, malware already has exploited this before.

This does make cheating harder, and does make it a cat-and-mouse game where signatures are revoked and they move on to a new driver, but the fact of the matter is - there are a ton of drivers out there and some of them will always be vulnerable in some way. To this end, I think focusing on client-side anti-cheat at all is a lost cause.

[Hikikomori]

Valorant and Battlefield 6 does require secure boot and they do not sell their cheat for those games. Though there are still cheats available for those games, in particular using DMA hardware.

You connect the DMA PCIe card to a laptop/pc with USB, then it can read any memory on the game PC and display a radar on the laptop screen. They even sell mouse and hdmi/dp mergers, these allow the laptop to show an ESP overlay over your game and aimbotting by sending mouse inputs.

[hrimfaxi]

I got a refund for battlefield 6 after finding out it requires secure boot (the error was not helpful in figuring that out though).

[cancername]

didn't expect an analysis of a cheat from them, interesting technical bits though.

[direwolf20]

Video game companies should lobby for a DMCA–style law against cheating.

[bayindirh]

No. That's too soft. We should go one step further and make computers immutable appliances the moment any game is installed, or maybe out of the box.

macOS, Windows and Linux has the technology. Why wait? Kill general purpose comp^H^H^H^H^ communism right now! Protect the children, save the capit^H^H^H^H nation!

[hollow-moe]

How in the world can any sane person see how DMCA got off rails and suggest another one for any kind of purpose ???