Patchi/fyi

Pentesting | Red Teaming
Game Hacking | Anti Cheat

[Patchi/fyi @PatchRequest]

My macOS anti-cheat is coming together. With the APIs of a Security Extension, I have a stable way (no kernel extension) to monitor cheating TTPs and report them securely to a backend. I built it game-agnostic, so it works everywhere. Finally a solid anti-cheat for macOS :D

[SEKTOR7 Institute @SEKTOR7net]

Make your payload "sleep" to look like any real Windows activity.

BusyWork is a Rust library that swaps each pause for randomized real work - hashing, file enumeration, registry queries, DNS lookups - drawn from 76 tasks across seven categories with ±30% jitter on every parameter.

No two "pauses" produce the same API sequence, and no timing primitives survive in the compiled binary.

A post by Daniel (@PatchRequest)

Source: https://t.co/DPKQn6D6Qn

#redteam #blueteam

[Patchi/fyi @PatchRequest]

Just a horse game or malware? A friend got invited to a private Star Stable Online server, via a Tor onion site serving an exe and a .hors file. Down the rabbit hole: NSIS installers, AES-256-GCM encrypted packages, DLL proxying, ECDSA-signed profiles:
https://t.co/XROkk5i3aP

[Patchi/fyi @PatchRequest]

@HackingLZ That's exactly what I used for my Windows agent, my gaming PC is filled with C2 implants now lol
https://t.co/k0KC1R9IOX

[Patchi/fyi @PatchRequest]

@HackingLZ In my case, I gave it access to a Mythic instance and Playwright for browser testing, so it could verify all features with real execution, pretty fun to watch :D

[Patchi/fyi @PatchRequest]

@eversinc33 @daaximus @ipurple You are trolling, right? In your own screenshot it says "break behavioral pattern matching by ... anti-cheat systems" or do we just ignore 90% of the sentence and look at two words? O.o
It does not claim to just bypass all of anticheat but break one potential component?!

[Patchi/fyi @PatchRequest]

@eversinc33 @daaximus @ipurple the repo and i never claimed to bypass AC.
The repo says:
evade behavioral pattern matching
the claim of
It states evasion of anti-cheat systems
was made up by @daaximus
so calling it a buzzword repo because it does not have a feature it never had claimed to have is just weird

[Patchi/fyi @PatchRequest]

@daaximus @ipurple The repo never promised to hide any calls or prevent telemetry, but it helps to break behavioral pattern matching and that’s what it does. When the AC does not use it, obviously it cannot interfere with it, lol.
So it just does what it claims to do, how is this engagement bait?

[Patchi/fyi @PatchRequest]

@daaximus @ipurple The concept of BusyWork is nothing new and not an invention by me, but a proven idea in MalDev. Here it is mentioned in a redsiege talk:
https://t.co/0U6btl44ql
or here another talk (slide 153)
https://t.co/YzLtUIOsyk

[Patchi/fyi @PatchRequest]

@MySanityWasted @daaximus @ipurple Having lots of non-cheat API calls mixed in makes it harder to confidently flag it as a cheat. Overall, it makes both static and dynamic analysis more difficult.
I am not a complete noob in the field: https://t.co/hgBHDbcSxN

[Patchi/fyi @PatchRequest]

@MySanityWasted @daaximus @ipurple I know ACs will still see the handle, but usually there's no ban just for that, there are valid use cases, like Discord using handles for its in-game overlay. An analyst or mechanism will look at what the program actually did. 1/2

[Patchi/fyi @PatchRequest]

@daaximus @ipurple I know, not the strongest argument, but when building my learning anti-cheat, I had the feeling it made it harder to automatically categorise something confidently as a cheat::
https://t.co/hgBHDbcSxN

[Patchi/fyi @PatchRequest]

@daaximus @ipurple an example how to do this can be seen in my mythic agent:
https://t.co/k0KC1R9IOX
i break patterns in stuff like reflective loading or up/downloading with busywork here

[Patchi/fyi @PatchRequest]

@_EthicalChaos_ A few month back a colleague published a Mythic C2 profile with tailscale: https://t.co/8YTzhrmqEK
an example implementation can be seen here:
https://t.co/k0KC1R9IOX

[Patchi/fyi @PatchRequest]

@RossMichaels328 Sure Busywork is not a new concept:
https://t.co/0U6btl44ql
Slides 18-22 and 35 - 36 even with a falcon example :)
here is even more: https://t.co/YzLtUIOsyk
Slide 153
and even some academic work on the topic:
https://t.co/trPPYic68Z

[Patchi/fyi @PatchRequest]

EDR has the attention span of a toddler. If it doesn't see the exact pattern it was trained on (sleep, allocate, inject, sleep), it just moves on. Anything else between your calls and it forgets you exist. So I built a library that does exactly that

https://t.co/pZWlTt863l

[Patchi/fyi @PatchRequest]

New Rust lib drop🦀 Got tired of rewriting userland unhooking and direct/indirect syscalls from scratch for every project. So I built a lib that makes it dead simple: unhook a single syscall, rehook afterwards, or go fully indirect/direct with Halo’s Gate

https://t.co/jsYtkwJrU3

[Patchi/fyi @PatchRequest]

Updated my DLL proxy framework. It now clones the metadata and signature from the original onto the proxy. Properties show the same company, description, and signer, so sideloading is harder to spot. Looks just like the real thing, just a hash mismatch :)

https://t.co/ITYw9J6dfY

[Patchi/fyi @PatchRequest]

@yates82 @momo5502 If you're interested in a readable anti-cheat, I have an open-source one: https://t.co/hgBHDbcSxN
It has no backend, just a local GUI client, since it's not for production, but sending data to the backend isn't the hard part. Usually you just send all events there for analysis