Ch40zz

Reverse Engineering, Windows Internals, Exploiting, Gamehacking
Programming Languages: C/C++, x86/x64 Assembly, C#, Python, JS, PHP

[Ch40zz @Ch40zz_]

@valigo If the developers implement it correctly these checks run once every 10 seconds or only on special events such as loading screens, when entering a car or w/e. Also his research is done on an old version using VMP - new versions have a dif VM. Whole malware and ACs run in VMs too.

[vx-underground @vxunderground]

This YouTube Twitch Game Bro says he's been a hacker for 20 years and did anti cheat stuff at Blizzard

He said he pulled it out into assembly, grabbed the code cave (?) and removed "the polymorphic" (?).

What the fuck is this guy talking about

https://t.co/fHhbQORbJI

[vx-underground @vxunderground]

Gamers express concern over anti-cheats and assert them to be spyware running as "root" on Windows.

Malware doesn't need to be ran at an elevated privilege (especially "root") to achieve it's objective of exfiltrating sensitive information or "spying" on you by watching what you're doing.

All of this can be achieved easily from user mode and can (usually) work even in restricted environments.

tl;dr these large game publishers don't need an anti-cheat to spy on you. They can do it easily from user mode.

[Ch40zz @Ch40zz_]

@LucyIsZombie @NetEaseGames_JP @NetEaseGames_EN @NetEase_Global @MarvelRivals Oh nooo you are right! They make use of "LibreHardwareMonitor" which *still* after all the bad news is using WinRing0... my god

Embedded driver here: https://t.co/WYe1d4Uvpq

Still, why is it dropped as powershell.sys? That was done by Marvel Rivals devs, not by LibreHWMonitor.

[Ch40zz @Ch40zz_]

@NetEaseGames_JP @NetEaseGames_EN @NetEase_Global @MarvelRivals What's the reason you guys drop a vulnerable and exploitable driver called WinRing0 (version 1.2.0.5) on everyone's machine and try to hide it as powershell.sys in a legitimate powershell system folder?

[Ch40zz @Ch40zz_]

@AzakaSekai_ That is no valid reason to require the main game executable to have admin rights?? You can install a service and modify DACL so it can start without admin for example. This is horrible, lazy and insecure design.
At least EasyAntiCheat and BattlEye got that correct.

[Ch40zz @Ch40zz_]

@GatorzVR @AzakaSekai_ That is no valid reason to require the main game executable to have admin rights. You can install a service and modify DACL so it can start without admin for example. This is horrible, lazy and insecure design.

[Ch40zz @Ch40zz_]

@adinathenerd @justmazz_ @gamingatdenuvo No. Devs pay them to get access to the tooling and the actual implementation into the game is done by the game devs. If you virtualize/protect a function running 2000 times a frame it will obviously start to lag. Capcom is notorious for doing it wrong. Game devs have little time.

[Ch40zz @Ch40zz_]

@Jonathan_Blow All my hope is now on the Snapdragon ARM CPUs for laptops, I pray they fix many of the efficiency issues that plagued my last few laptops. The rest can be fixed with software hacks if you invest some time. Shouldn't be required when paying that much...

[Ch40zz @Ch40zz_]

@Jonathan_Blow Sounds to me like a bad mix of crappy hardware (x86 is unusable for laptops for a while now, let's hope ARM can fix this efficiency mess for Win too), bad BIOS impl and OS nonsense e.g. malware scans when you don't move your mouse for 30 secs. Had many issues with new laptops too

[Ch40zz @Ch40zz_]

@markrussinovich The driver was abused in a bunch of cheats so yeah, fair game.

[Ch40zz @Ch40zz_]

@7ndrew This is the VMProtect integrity-check fail dialog...
It means the file on disk has been modified by a program, probably malware.
Scan your computer for malware instead of blaming the Company lmao

[Can Bölük @_can1357]

> Want to reverse engineer notepad.exe for lulz to figure out what hotkey is toggling right-to-left reading order because I keep hitting it accidentally
> MBA obfuscated imports

[Ch40zz @Ch40zz_]

@ootiosum This is how I hardened my HV against EAC annoyances too btw, takes a bit of time but you should have all the info required to fix the issue

[Ch40zz @Ch40zz_]

@ootiosum Still sounds like PG checking for non-legit HVs running on the system. Implement a serial logger and buy a small serial to USB dongle, use putty or w/e on a second PC to read the logs. Just spam info in all vm exits and check the logs to what the last few exits were + ext info.

[Ch40zz @Ch40zz_]

@intigriti The close button.

[Ch40zz @Ch40zz_]

@pcwalton ASan found 2 bugs in total when we introduced it. after that it never found anything again. so yes, depending on the team it might simply not find any issues, especially when talking about automotive and MISRA C

[Ch40zz @Ch40zz_]

@timmisiak Desktop duplication should work on nearly everything unless someone called the DRM API (SetWindowDisplayAffinity). If you want to get your hands dirty, hooking into DWM (DirectX 11 Present) can capture literally everything that is not fullscreen. Goes well together with Desk Dup

[Ch40zz @Ch40zz_]

@samrussellnz CPU: *crying in Kernel CET exceptions*