|
I didn't put any screenshots or raw data here because I don't know if it is allowed. TL staff please let me know if I am allowed to post this data. I'll also try and keep this simplified and dumbed down so everybody can actually take in what they're reading without having to Google what I'm saying.
So I backed up both copies of SC2, HotS and LotV, on a separate storage device to open all the files for the game in Linux (Windows has trouble/can't open lots of these files that are inside the MPQ files), because after seeing lots of hackers on LotV already I wanted to look into what the new anticheat did. Keep in mind I am not a pro developer or any shit like that, I know the basics of C++, C#, Python, and D, and by that I mean I know enough to understand what I am looking at and maybe change some of it but I don't know enough to develop a full application beyond that of what you would make in high school to impress the other kids or something, and aside from programming languages I have lots of experience with looking at raw hex data. TLDR of this paragraph is that I'm not perfect or even good, but I know exactly what I'm looking at.
To keep it simple until I hear from staff if I am allowed to post this raw data, I put all the variables that are involved with Warden and hidden information (basically what's in the fog of war) side by side with both games, and the only thing that changed was the name of the data that map hacks would target to reveal this information, whether it be through a DLL injection or an overlay. When the map hacking program searches for this stuff in LotV, it says "You're not running StarCraft! I'm useless right now." In order to bypass this, cheat developers simply had to dig for the same information I did and set their map hacks to target the newly named data.
All that has actually changed in these cheating programs for LotV is the target name of the executable, data within the executable, and some of the sensitive data in your RAM that is exploited to cheat. Nothing else has been changed, and as somebody who knows enough about this to change such a thing on my own, this is a terrible excuse for a better anticheat system. I understand it's a beta and all, but preorders are already available, Blizzard refuses to address the cheating issue, and threads about this in Battle.net are being deleted and users are being suspended for even bringing this up. It's obvious they don't want to address this right now, and whether or not that will change in the future is obviously unknown.
So, to wrap it up, Blizzard's current changes to the anticheat consist of the following:
1. Target name for sensitive data has been changed
2. Executable name has been changed
3. 64 bit renders all 32 bit hacks obsolete and vice versa
|
Nice work, man. I think you underestimate your own capabilities; I am a professional programmer and never had the nerve to actually do reverse engineering like that.
|
On July 28 2015 23:22 rockslave wrote:
Nice work, man. I think you underestimate your own capabilities; I am a professional programmer and never had the nerve to actually do reverse engineering like that.
I always end up breaking shit, this is the first time something didn't go horribly wrong. I just want Blizzard to address this because while people can either push the hacking issue to the side or blow it up to Avilo level retarded it's still an issue and this shows how many shits Blizzard gives.
This can all change, and I hope it does, but so far it doesn't seem so.
|
Many hacks work by analysing the RAM and changing values (which you can do absolutely NOTHING against) but there is always security through obscurity. I could imagine automatic updates, perhaps once every week, that move all the variables around and thus make all hacks obsolete. So each time there is an update hackers would have to change their hacks and update as well. This might become tiring for some hackers and discourage them.
|
On July 28 2015 23:42 RoomOfMush wrote:
Many hacks work by analysing the RAM and changing values (which you can do absolutely NOTHING against) but there is always security through obscurity. I could imagine automatic updates, perhaps once every week, that move all the variables around and thus make all hacks obsolete. So each time there is an update hackers would have to change their hacks and update as well. This might become tiring for some hackers and discourage them.
This has been requested by the community for years. I hope it's finally put into action but it took me about two hours in total to find all this stuff. If you're looking for a single variable that is reset by schedule you could easily make a program that will pull that data for you.
|
Depends on how it is implemented. They could change the names and introduce garbage data to make the filtering process harder. This can all be done automatically, there are already programs that do this so there is no fear of breaking anything.
|
|
|
|
|
Wow, you didn't break something or cause a bug this time. I'm impressed.
|
All around good job, but since a few individuals including yourself have programming knowledge/background (more than I care to admit I have personally) here is a question or two.
What if you run a heavy RAM based system that has numerous processes that run and fluctuate the levels of RAM or you have a piece of hardware (MOBO/Processor/GFX/RAM) that is on the brink of failing which in turn will rev up your system and work "over-time" which causes heavy periods of system use that causes audio/video stutters.
Would the new "anti-cheat" understand this or see it as a potential hack?
I would like to guess that it registers it, a Blizzard Rep would review the report and understand either way but that is shooting for the stars.
|
this is awesome its absolutely rediculous ppl hack in the beta but its even more rediculous blizzard hasnt addressed this. how would we get blizzard to impliment this? thank u for using your skills to benefit the community!
|
Poor good guy blizzard.
I think it has more to do with User rights, than it has to do with Blizzard itself.
It is almost impossible to read for a RAM-reader, since it will probably be kernel based tasks, while Blizzards software (Warden) will only have access to the User data. Doing anything more than reading the User values of said program, will immediately start 100 lawsuits in the land of the free, because it will be another form of "invasion of privacy".
So either give Blizzard more rights on your PC to stop cheating, or they can't do shit.
The one thing they can do is increase the ban waves heavily and start banning by ISP (which would kill universities etc  ), but I doubt Blizzard would want 1 or more fulltime employees on a job as cheating investigators.
|
You're doing God's work, Dickbutt
My word, that feels strange to say.
But it's true!
I think at this point it's apparent that Blizzard doesn't want to be held accountable.
Edit: then again, who does? Besides honest people of course. :D
|
On July 29 2015 03:06 Jaedrik wrote:
You're doing God's work, Dickbutt
My word, that feels strange to say.
But it's true!
I think at this point it's apparent that Blizzard doesn't want to be held accountable.
It's not always that Blizz doesn't want to be held accountable, as WonnaPlay said it also has to do with user rights and whatnot, but this is just a blatant "fuck you" if nothing changes in the future. You still have to take into account that it is a beta and this can change, but my personal opinion is that they won't, knowing Blizzard like I do. This is also something that seems much worse if you, for example, take Reddit seriously lol. Not to say it isn't a bad thing, because it is, but the problem is heavily amplified in the heads of those that want something to cry about.
On July 29 2015 01:07 FT.aCt)Sony wrote:
All around good job, but since a few individuals including yourself have programming knowledge/background (more than I care to admit I have personally) here is a question or two.
What if you run a heavy RAM based system that has numerous processes that run and fluctuate the levels of RAM or you have a piece of hardware (MOBO/Processor/GFX/RAM) that is on the brink of failing which in turn will rev up your system and work "over-time" which causes heavy periods of system use that causes audio/video stutters.
Would the new "anti-cheat" understand this or see it as a potential hack?
I would like to guess that it registers it, a Blizzard Rep would review the report and understand either way but that is shooting for the stars.
This isn't something I can answer to considering how many ways an anticheat can be developed, scan for things, etc. I play this game called osu! and when I played on a dying GT 730 hit circles were all showing up in the center of my screen so I was spamming the shit out of the keyboard for high scores, and got hit with a permanent HWID (hard drive) ban, IP ban, Windows copy ban, a ban based on what unique programs and settings I have on my computer to determine if I am on somebody else's computer or a different IP and HDD/SSD (which was resolved with support later). Something like this would NEVER happen with Blizzard's anticheat, I can guarantee this.
I use this example because when the guy that makes osu! developed the antihack, he basically fucked the law and fucked user privacy and can even see your browsing sessions and user history, and it's an example of a unique form of antihack. Warden scans user processes and nothing more. It can't even obtain the details of the programs you're running, so you could be running a SC2 hack that was addressed and prevented by Blizzard and by changing the up-front program details you can easily spoof it as any other application according to what Warden sees. This is possible with pretty much every hacking program aside from ValiantChaos Map Hack because that uses all sorts of direct injections to your game AND running processes.
TLDR There are MANY ways to develop anticheats, so there is no answer to your question.
|
Awesome man! You did an incredible job there. I really think you need to be more confident about you and your own skills 
BTW, for how it looks, it is really hard then for Blizz to stop cheating =/
It is really sad, I hope they can find some way to encrypt the data on the RAM with a unique algorithm the game itself can translate but not easy for hackers, so they won't have it easy simply targeting the items on the RAM.
I thought anyway Blizz could read your RAM freely because I read something like that on WoL times, and thought "Well, I am not using anything weird" (but was kinda scared because I changed the audio files lol, and a lot of people where changing the background on the game as well but I didn't tried)
|
Let's be honest, if the data is on the client side, there is really no way to protect it, the battle will remain on and on between hackers and devs and eventually hackers win and devs give up (happened in many games). The only practical way is to simply not place any information on the client side except the ones that the player is allowed to see. This is rather a huge change that I doubt blizzard will be willing to go through, again I don't know how practical that is for an RTS that includes a lot of units on the map . MOBAs have only few units that need to be hidden and that's why they usually get away with it. Permabans are the way to go.
|
On July 29 2015 03:17 Dickbutt wrote:Show nested quote +On July 29 2015 03:06 Jaedrik wrote:
You're doing God's work, Dickbutt
My word, that feels strange to say.
But it's true!
I think at this point it's apparent that Blizzard doesn't want to be held accountable. It's not always that Blizz doesn't want to be held accountable, as WonnaPlay said it also has to do with user rights and whatnot, but this is just a blatant "fuck you" if nothing changes in the future. You still have to take into account that it is a beta and this can change, but my personal opinion is that they won't, knowing Blizzard like I do. This is also something that seems much worse if you, for example, take Reddit seriously lol. Not to say it isn't a bad thing, because it is, but the problem is heavily amplified in the heads of those that want something to cry about. Aye! It's something I didn't really think about until I read the thread after posting, but it's a good point.
Yes, it's still a big "we don't really care, k."
Also, for the record, I hate Reddit. Was shadowbanned. D:
Now, in an ideal society one could agree to relinquish their privacy via contract, so all Blizz would have to do is attach the contract to their online services.
That's a super broad and simplified statement, however...
The real issue comes up (besides the obvious hackers getting the data, but that's always a threat regardless) is when someone with power (i.e. the government) wants the data Blizzard has access too.
Since they have the culturally-validated threat of violence behind them, they can do all sorts of legal and not-so-legal tricks to get Blizzard to cough up data, so Blizz couldn't guarantee to make good on its promise to protect the data in this hypothetical contract.
They do it with Flash plugins, Windows etc. already to an extent, so, there's the reasonable chance for that moral hazard to take affect!
|
On July 29 2015 00:47 OtherWorld wrote:
Wow, you didn't break something or cause a bug this time. I'm impressed.
User was warned for this post
|
On July 29 2015 03:25 i)awn wrote:
Let's be honest, if the data is on the client side, there is really no way to protect it, the battle will remain on and on between hackers and devs and eventually hackers win and devs give up (happened in many games). The only practical way is to simply not place any information on the client side except the ones that the player is allowed to see. This is rather a huge change that I doubt blizzard will be willing to go through, again I don't know how practical that is for an RTS that includes a lot of units on the map . MOBAs have only few units that need to be hidden and that's why they usually get away with it. Permabans are the way to go.
Even then you can still have micro and macro hacks like automatically building workers, blinking stalkers, splitting marines, etc. Sure, it would cut down on the number of hacks available, but hacks will still exist.
In my opinion the best way to fight hacks is to make hacking something tedious and annoying by constantly changing the API randomly. I dont know how well this could be accomplished, I never tried anything like that myself, but in theory it should be possible.
|
On July 29 2015 03:47 RoomOfMush wrote:Show nested quote +On July 29 2015 03:25 i)awn wrote:
Let's be honest, if the data is on the client side, there is really no way to protect it, the battle will remain on and on between hackers and devs and eventually hackers win and devs give up (happened in many games). The only practical way is to simply not place any information on the client side except the ones that the player is allowed to see. This is rather a huge change that I doubt blizzard will be willing to go through, again I don't know how practical that is for an RTS that includes a lot of units on the map . MOBAs have only few units that need to be hidden and that's why they usually get away with it. Permabans are the way to go. Even then you can still have micro and macro hacks like automatically building workers, blinking stalkers, splitting marines, etc. Sure, it would cut down on the number of hacks available, but hacks will still exist. In my opinion the best way to fight hacks is to make hacking something tedious and annoying by constantly changing the API randomly. I dont know how well this could be accomplished, I never tried anything like that myself, but in theory it should be possible.
Micro and macro hacks are very obvious, especially split hacks. Although these are not obvious to the eye, they are obvious to the system in place to stop them when properly applied. CSGO trigger bots are the best example of this, since it emulates mouse clicks when you hover over an enemy.
Changing things like this are a pain for hackers at first, but after a while they figure it out with programs that will pull this information or even find an alternative to reach their target.
|
|
|
|
|
|
EPT
