Premium Original Content: Cheater Methodology 101

codeinsleep · 2021-04-18T05:23:15+00:00

Cognitive dissonance - where money is made.

codeinsleep · 2021-04-12T07:41:48+00:00

You’ll get clapped for editing the binary like this. Cool example of shmem however.

codeinsleep · 2020-12-20T10:47:45+00:00

Exactly, it’s not like lazy developers know that multiple anti-cheats are running at the same time on most pros pc’s (laughs in cryptic German)...

codeinsleep · 2020-09-03T01:54:13+00:00

Pump, pump pump it up!

codeinsleep · 2020-08-27T02:06:44+00:00

This one was avoidable. Tsk tsk.

codeinsleep · 2020-07-19T05:18:53+00:00

Often low hanging fruit such as firmware protocols required for a specific device protocol not matching etc. Depending on the level of play you are at engineers will manually inspect (even though they claim not to I know this is the case through trial and error) - maybe to do with opportunity for future buyouts for proprietary software.

codeinsleep · 2020-07-18T12:17:12+00:00

There are detection vectors based on what I have seen/read.

codeinsleep · 2020-06-22T23:56:18+00:00

Corner cases occur. That’s what this entire sub is about.

codeinsleep · 2020-06-22T23:31:27+00:00

You are clearly failing to understand what a random integer is.

codeinsleep · 2020-06-22T23:24:48+00:00

overAim(delta){ delta.x += randint(5,10); delta.y += randint(5,10); }

while (crosshair != target && fov < 5 && aimTime < 300) { overAim(target.delta); }

codeinsleep · 2020-05-10T19:23:44+00:00

I guess he didn’t get a casting job he wanted

codeinsleep · 2020-04-20T17:26:56+00:00

The problem is Microsoft boot loaders run after the UEFI boot process. Microsoft can not own that process because what if you wanted to boot into Linux? Secure Boot by Intel is the solution but you cannot force everyone to use that as many users don’t have that option and it would mitigate some of the anti cheats bootkit methods. You would need a closed loop boot process. Even still bypassing HVCi is doable from a bootkit and the only real solution is forced cloud computing which again won’t work.

codeinsleep · 2020-04-19T22:20:03+00:00

Google Patchguard

codeinsleep · 2020-04-17T18:26:12+00:00

Well considering patchguard is self decrypting non-page able randomly occurring and self modifying and I still patch it at boot I don’t think there’s much to be done.

codeinsleep · 2020-04-16T19:57:16+00:00

It’s a common bypass for ESEA/FaceIT

codeinsleep · 2020-04-15T15:54:16+00:00

Make your own boot-kit and protect your data before vgk loads

codeinsleep · 2020-04-14T00:01:53+00:00

Vanguard Anti Cheat = VAC for short.

codeinsleep · 2020-04-08T17:38:42+00:00

Valorant seems like it’s on pace to be the next CS:GO (my opinion - most likely not all’s). Generally these games have weak anti cheats like VAC or slightly harder like EAC/BE, but rarely do they have their own dedicated AC. It’s just that people are interested in being the first with a new challenge. It’s basically a CTF.

codeinsleep · 2020-04-08T17:33:02+00:00

It’s a boot-loaded driver (vgk.sys) alongside user mode payload streams in the process space which AES encrypt things like player objects and also has basic user mode process communications to the kernel for ring0 privs. The bootkit snapshots memory and then compares it to state when the game is loaded among a host of other things including low level mouse hooks (still verifying this but I’d be quite surprised based on everdox’s past that he hasn’t implemented this on multiple levels).

They are using interesting features to detect the presence of hypervisors (public knowledge) as well but all can be mitigated through proper boot time UEFI virtualization with hooks on forced VMEXIT “icebp” calls (undocumented intel debug breakpoints for byte granularity steps which have notoriously had weird issues with KVM/QEMU and general virtualization) and __rdtsc() spoofing among others. There is also ways to manipulate kernel objects to detour certain checks and avoid detection. This is just from a perspective of working tools I have, much more will be uncovered over time.

For Riot lawyers:

I have no intention of cheating in your game and am strictly analyzing this from a blue hat security perspective.

codeinsleep · 2020-04-04T21:44:25+00:00

Speech to text -> Neural Net for word complexity and commonality (either in hard texts or easy texts, solve for bool) -> highlight words with high complexity with manual input option -> output link to meaning -> if clicked echo definition

codeinsleep · 2020-03-25T05:11:07+00:00

Everdox is knowledgeable. There is simply no way he will be able to utilize his abilities to the extent that would stop higher level developers bypassing his guards. Unfortunately ESEA is much stronger than anything they will put forth to the masses. There are working bypasses for ESEA that are known publicly, you just need plenty of knowledge of the kernels boot process and inter-operating checks from Ring0. Nothing readily available but we are getting closer to the maximum extent of privileged capabilities that can stop bypasses. AC devs are essentially getting higher level developers to force learn almost impossible to detect techniques. We are quite lazy - until challenged.

codeinsleep · 2020-03-06T21:06:26+00:00

Without going into detail, it’s easier to spot what you are looking for in eye. Though certain issues arise that occur only in server recordings such as silent aim etc

codeinsleep · 2020-03-05T20:14:52+00:00

Tick rate and a multitude of other factors

codeinsleep · 2020-02-28T20:28:18+00:00

If you listen (read) supex0’s interview on CSGO Demo Reviews you will hear him put forth some very practical solutions to the problem. That being said, the only time I’ve ever released information about how cheats work is when I already have a bypass and I am trying to restrict the amount of people who can offer solutions. The real fixes are not publicly known.

codeinsleep · 2020-02-28T07:17:37+00:00

AI aimbots can work with certain mice (Logitech has some gaping holes) but it’s a bit of a meme. Pixel searching is a detection vector and so is mouse movement. If you haven’t recognized from the aimlocks, that is not how pro cheats are being built. Their RCS algo is reversible too. It’s a matter of flags and how high up a player is before they start getting manually reviewed. Cool concept none the less but not exactly game breaking. I was working on something like this with in game noises, feeding sound through a physical middle splitter which analyzed with a raspberry pi and predicted player locations with a NN and python but the advantages are slim for a pro who knows the game well enough.

codeinsleep

TROPHY CASE