UltimateAntiCheat

https://github.com/AlSch092/UltimateAntiCheat

by skibz • 2 years ago

71 127 2 years ago

nathas3• 2 years ago

Question for people that build hacks: given how robust this open-source anti-cheat is, does building the cheat give more reward than playing the game? It seems like it would take a ton of hours to be effective..

Iridescent_• 2 years ago

Well of course if you sell it

nathas3• 2 years ago

I meant the intangible, personal gratification that comes with pwning noobs as a reward but fair enough :)

Etheryte• 2 years ago

Just like any software, game cheats are build once, sell as many times as you can. If a game is popular, this can be a very lucrative business. The fact that game developers will play the cat and mouse game with you to block you out only adds to this fact, as so long as you can keep up, you can get repeat customers.

nathas3• 2 years ago

Now I want to read an article about the economics of selling game hacks. I just assumed they weren't really worth the investment to build since the number of people that want to cheat seems low.

After typing that I realize this is like coming to understand just how many people are on steroids to get a physique they want. It's like nah no one takes steroids except EVERY HUGE PERSON you've ever seen, barring the extremely rare genetic outliers.

Fascinating.

hypeatei• 2 years ago

There is huge money in making cheats and this one seems to operate in userspace only. Most cheats and anti-cheats these days are running in lower rings (kernel or device driver)

I believe there is also hardware cheats but I'm not sure how common those are. EDIT: See "DMA cheats" or "DMA cards"

Der_Einzige2• 2 years ago

There's also a lot of AI cheats now, which are resistant to most detection methods: https://github.com/Babyhamsta/Aimmy

Several hundred hours of my "the finals" experience have been helped by this :)

miffe• 2 years ago

It's pretty common. Valve is now banning certain keyboards from CS2.

0x1ch• 2 years ago

Go to aliexpress. Google cheat cards. They've proliferated pretty heavily in the last couple years.

My buddy and I were actually just discussing ring 0 anti cheat circumvention and we started researching these units. Our guess is that the hardware slightly changes every iteration with updated firmware to circumvent general heuristics like HWID.

shdh5• 2 years ago

Developing a cheat is far easier than developing an anti-cheat.

Its a constant arms race, at least until the AC devs bow out.

There is no 100% perfect solution. There are tons of ways to circumvent anti-cheats using a second computer as well.

2four2• 2 years ago

I've built hacks to undermine recurring payment structures in games. It has very little to do with cheating, and everything to do with fighting a corporate trend that I would like to see abolished in games.

Gaming companies care far more about these kind of hacks, but frequently lump them into the "cheating" category for better optics.

PhasmaFelis• 2 years ago

When I see a game that sucks on purpose, my solution is to simply play a good game instead, rather than spend hours trying to work around the suckage.

Bad games don't deserve your time any more than they deserve your money.

GuB-42• 2 years ago

does building the cheat give more reward than playing the game?

Absolutely! At least for the kind of people who like cracking games. Think of it as a puzzle game.

Being able to play the game as a cheater is like getting the final weapon in a game where it requires completing the most challenging part. You have fun for a bit, destroying everything in your path, that's your reward, but you quickly lose interest as you have nothing interesting left to do.

martin_• 2 years ago

yes- I have been out of the "game" for a while, but, the economics are strong. Used to sell bots that could automate tasks to get gold in various games (WoW and Runescape as examples) and we had customers that would buy 100s of licenses monthly and had factories that they'd use to farm and then sell the gold on eBay, etc.

qdot763672• 2 years ago

I mod games to add buttplug.io support.

Most of my users seem to agree that yes, it is more reward than just playing the game.

Hikikomori9• 2 years ago

It's not robust and neither is anything out there really effective except for Riots anticheat, though they put in immense effort.

beeboobaa37• 2 years ago

games are requiring secure boot now? No thanks.

shdh5• 2 years ago

Valve Anti-Cheat (VAC) is still running in user space.

tapoxi3• 2 years ago

And is universally hated by CS2 and TF2 players. TF2 has been unplayable for years.

J_Shelby_J2• 2 years ago

Games or esports? Riot’s Valorant used a kernel level anti-cheat that needs to be enabled at boot.

It’s super problematic from a security perspective.

That being said, I’ve played competitive FPS games my entire life, and valorant is the only game I’ve never ran into a cheater in. So it works, and I’ll say, it should be a hard requirement going forward for the anti-cheat to be a core part of the game architecture. A game getting popular enough to attract cheat developers to make an sdk for a game isn’t “suffering from success.” It’s a death sentence for the game. There are popular streamers and YouTube content creators out there that go through extreme lengths to avoid cheaters, but in the end they always just stop playing the games.

Hikikomori9• 2 years ago

Pretty much all anticheat is kernel level because that's where hacks are now, it was not a new thing when vanguard came out either, it had been like this for years already.

Not that it matters that much for data privacy if you game on the same user anyway as userspace anticheat can access all your users data.

josephcsible2• 2 years ago

This is fundamentally the wrong way to do anti-cheat. Anything you do on the client will fundamentally always be bypassable, and it tends to always have at least some negative side effects. Proper anti-cheat needs to happen on the server.

shdh5• 2 years ago

Only analyzing client command network frames and entities on the server isn't enough.

aeonik• 2 years ago

Why not? What more do you need? Trusting the client is always going to be fraut with failure.

mschuster915• 2 years ago

Doesn't work. Say, a shooter has support for surround/immersive audio - the client has to know where an approaching enemy is so that it can appropriately render footstep sounds or shadows. That in turn can be used by cheat aids to warn about someone sneaking up on you.

josephcsible2• 2 years ago

But such a cheat aid could also just be connected to your speaker jack.

tapoxi3• 2 years ago

You can make it hard by forcing secure boot and doing remote attestation.

nimih• 2 years ago

I don't think the situation is so clear-cut to be able to make categorical statements like that: server-side cheat prevention is also bypassable, and depending on how it is implemented, also has the potential for negative side effects. No matter what approach the developer takes, they're going to be making a trade-off of efficacy, player convenience, and developer effort, and that trade-off is going to be influenced by a lot of different things, such that client-side cheat prevention (or, likely, a mix of client-side and server-side measures) will be the most reasonable option in at least some circumstances.

kstrauser2• 2 years ago

Programmable keyboard macros for the win.

No, like, literally.

qdot763672• 2 years ago

ahk, the ultimate cheat tool

kstrauser2• 2 years ago

I'm not actually good enough at anything to be tempted to cheat, even if I were persuaded to become ethically OK with it. But if I were, I think that's where I'd start. Oh, some game is blocking a specific model? A recompile of the firmware says look at me, I'm a Microsoft Ergonomic Keyboard!

Cieric5• 2 years ago

As someone who has been in the graphics card driver side of things for almost 3 years now, anti-cheat has been the bane of my existence. Some anti-cheat has been strong enough that is has actively stopped me from fixing games, doubly so when we can't get into contact with the game developers. I would not be surprised if in the future some games might just never run on one gpu due to a mix of anti-cheat, legal, and driver signing troubles.

While I have a massive disdain for anti-cheat enough that I've built hacks just so I can fix the games my employer pays me to fix, I'm not going to encourage developers to drop them if they truly think it's needed. But please, contact gpu manufactures and provide them the tools or builds needed to fix and debug your game.

fletchowns• 2 years ago

Cheating in online gaming is such a blight on the industry. Such a waste of time & money for every legitimate participant in the market, except for the groups making and profiting of the cheats of course.

I still like my idea for a third-party reputation service that has consequences for not just one game but every multiplayer game participating in the program: https://news.ycombinator.com/item?id=28634784

I really do think it would make cheating non-existent, and allow developers to focus on building cool games instead of building invasive & ineffective rootkits we have to install just to play games online fairly.

gxs2• 2 years ago

At first I was optimistic that AI would greatly alleviate the issue here, but no dice.

As someone who was super competitive about the games they played (reformed, no longer play), I can tell you online cheating is completely out of hand.

There are cheats nowadays that don't even require software to be on your computer. You just put up a camera on your screen and an AI bot helps you by manipulating your controller (e.g., aim) - it really is a cat and mouse game and I don't think the issue in general will be resolved anytime soon.

I know there is an entire industry built around gaming and custom PCs so this is a pipe dream, but I'd love it if instead of all the time and effort that goes into supporting these rigs, the business models for consoles were optimized such that consoles could be top of the line rigs with very strict upgrade paths. This is really the only way I can see us actually putting a dent into this problem

mschuster915• 2 years ago

I still like my idea for a third-party reputation service that has consequences for not just one game but every multiplayer game participating in the program: https://news.ycombinator.com/item?id=28634784

So, essentially China's Social Credit Score, just for gaming... a bad idea IMHO, a really bad one.

For one, that centralized reputation service that actually has data linked back to government-issued credentials (ID cards, passports, ...) must be ridiculously secured, because it will be among the juiciest targets on the planet - be it trolls or deranged stalkers of either gender (although most tend to be male [3]), people are willing to go to ridiculous lengths to abuse fellow gamers, especially (large) streamers. Ordering pizza, SWATting, or even cases of rape and murder [1][2], all of that has happened. Give 4chan enough incentive and they will crack open anything. Or they'll just outright infiltrate the company, someone has to run it after all, and whoever has admin access, no matter the audits and internal controls, will find a way to exfiltrate stuff.

And even assuming the reputation service doesn't get hacked, the participant games are another target - this time, not for the data that's held by the reputation service, but for reporting "cheating" by the target person. Either technical bugs or infiltrating the customer service, both can yield results - game companies largely crap on code quality, even the biggest ones (remember Rockstar's GTA JSON bug lol), and customer service jobs are low paid and have high attrition, easy targets for infiltrators.

And then gamers themselves are also valid targets. Manage to get a piece of malware onto a streamer's computer that gets detected as a cheat, boom. And that's easy to do, RCE vulnerabilities crop up every now and then for major games (Minecraft for example had BleedingPipe and log4j, GTA had one in 2024 and in 2023).

[1] https://www.nytimes.com/2023/03/11/us/podcast-husband-killed...

[2] https://thelmaarose.wixsite.com/whattaweek/post/a-female-gam...

[3] https://www.businessinsider.com/twitch-streamers-are-being-s...

BrianGragg• 2 years ago

Making some assumptions here but I suspect most game developers outsource their anti cheat to a 3rd party and that is what you are running into. Some of the 3rd party anti cheat rootkit computers. Some are okay and some are just terrible.

Cieric5• 2 years ago

You're correct, most companies don't make their own anti-cheat. We have categorized the different anti-cheats and have ways around them where needed. But whether or not the game devs or some 3rd party makes the anti-cheats it still leads to the same problems, I'm blocked from fixing their games on our hardware. I can't/won't share to many details about or internal process.

Aurornis• 2 years ago

I'm not going to encourage developers to drop them if they truly think it's needed.

When I've only got an hour or two to game and my gaming friends can only get everyone together once a week, it's crushing to have a good game ruined by cheaters.

Hopefully gamedevs can work with people like you to fix bugs. However, leaving anti-cheat out of multiplayer games is a complete non-starter in today's environment. Even if anti-cheat only slows the cheat devs down and turns into a game of whack-a-mole with cheats, it's still preferable to having every game get crushed by cheaters every time you play.

Cieric5• 2 years ago

Don't get me wrong I understand the sentiment there. I'm sadly locked out of most of those games from the get go being on linux though. Most of the games that give me trouble aren't online games to begin with. Most online games we do have good contact with the developers since they're typically actively working on the game.

fnfjfk2• 2 years ago

Don’t really play multiplayer games anymore, but back when I did a lot there was a “vote kick”/“vote ban” feature that people used to get rid of the cheaters instantly sniping everyone from across the map, it wasn’t like they were very subtle.

Does that simpler social approach not work anymore?

Kerrick• 2 years ago

As of about a year ago, Team Fortress 2 bots were so pervasive that they would often teamu p to use the "vote kick" functionality to kick non-bot players from public games.

fnfjfk2• 2 years ago

Ok that’s pretty hilarious, but what’s the point, is this just like playing battlebots for TF2 bot authors? (But if it was couldn’t they set up a purpose-built server for that?)

jabroni_salad• 2 years ago

As of about a year ago,

This started about 5 years ago and continues today. They aimbot, spam both voice and textchat, dodge bullets, can fly, and hijack any vote to ensure their continued survival. If you can't get an invite to a private lobby you may as well play a different game. Either one that has anticheat or something singleplayer. If there was a silver bullet that made online play nice and respected your computer, someone would have shot it by now.

mschuster915• 2 years ago

It hasn't worked for a looooooong time, you'd have 4chan and its offshoots running around coordinating offsite to yeet random players. And that was in an era where people had to pay for games and risked global bans (UT2k4 had that) on their license #, nowadays in the f2p game scene that has zero cost attached it's become all but pointless.

vitaflo• 2 years ago

When they first added this feature to Overwatch, one of the best sniper players in the world got banned because people thought he had an auto-aim cheat. Turns out he was just really really good.

ultimafan5• 2 years ago

Some games this is still applicable. But as of a few years ago, there's been a LOT of multiplayer shooters coming out with a battle royale style of genre, where you load into a 30-40 minute match with a single life and are booted when you die. You don't have access to a list of players at any point or votekick/voteban mechanics, at best there'll be a report button on the death screen if you thought something was fishy. So you really have no way of knowing in these games at what point the match will be ruined, someone can toggle cheats on 20-30 minutes in and you won't know until you die to them nor have any way to communicate that to the other players still ingame.

pstrateman2• 2 years ago

This is still playing defense.

Anti-cheat needs to be more or less a kernel level remote code executor.

NotPractical4• 2 years ago

Nobody wants that running on their computer though.

Maybe it's time to just give up on PC gaming and use dedicated game consoles instead, which are locked down by design? The only real alternative seems to be running a cryptographically-verified known-good OS signed by one of the big three OS companies, which is also locked down enough such that cheating becomes impossible, or installing what is essentially kernel-level malware, just to play the latest games.

pstrateman2• 2 years ago

Why?

Modern games all have 10GiB+ updated constantly that you're not disassembling.

What's the difference?

Hikikomori9• 2 years ago

How protected do you think you are from user space software you install?

dnos• 2 years ago

I wonder if a statistics-based cheating detection system could work in more of the esports style games? Chess.com seems to have a pretty good method to detect cheaters based on analysis of post-game data: https://www.chess.com/article/view/chess-com-fair-play-and-c...

Even in something like an FPS, if player movements or action patterns could be compared to normal patterns, it would be incredibly obvious who is cheating regardless of HOW the player managed to cheat.

Even something as elaborate as a full AI-powered robot that physically hit the keys could be detected when it made a move that was not within the patterns of human players.

Of course, the cat and mouse game then becomes more about the cheat algorithms learning to act more human to avoid detection, but they have a long way to go. Plus, each time they have to adjust and become more human, the less and less of an advantage the cheater has!

eddythompson802• 2 years ago

That already happens. That's why you see waves of bans in certain games based on evaluating/re-evaluating previous post-game data.

UltimateAntiCheat

Related Stories