Hacker News Reader

Comment by nickphx | Hacker News Reader

It's trivial to bypass EAC though..

It’s trivial to bypass, not sure if it’s that trivial to evade getting caught though.

Getting caught just closes the game. They aren't banning modders.

As with all DRM, it will pose no real obstacle to abusers will inconveniencing regular users (in this case, people using quality-of-life mods).

Yeah, still fine with loading a modified kernel32.dll as long as it is EV signed for example.

it's relatively simple to bypass EAC when you're just a single user since it just ignores all of the blatant signals you're giving off, it just doesn't scale well

Eventually those signals can accumulate to some threshold and they will ban single users. They do improve their anti cheat pretty regularly and a cheat that only provided 1 or 2 suspicious signals (e.g. rxw memory in the kernal space that isn't backed by some valid module) might eventually provide 3 or 4 as they improve their anti cheat (maybe they start looking in some obscure windows table to find evidence that you loaded a bad driver in the past or they stackwalk your kernel thread to find it executing in unbacked memory).

> (e.g. rxw memory in the kernal space that isn't backed by some valid module)

They do flag you for this but not actionable on its own as PatchGuard demonstrates the exact same kind of behavior. RWX memory in Kernel Space that's not associated with a signed module.

As you also surely know, there is also a lot of rwx memory that's not actually utilized yet allocated by many drivers that you can deploy your shellcode into.

> They do flag you for this but not actionable on its own as PatchGuard demonstrates the exact same kind of behavior. RWX memory in Kernel Space that's not associated with a signed module.

I'm sure most cheats use drivers that are pretty similar to each other (e.g. will have the same imports that show up as plaintext I think) so they can look for that. And PG threads/pages have plenty of identifiers.

> As you also surely know, there is also a lot of rwx memory that's not actually utilized yet allocated by many drivers that you can deploy your shellcode into.

Usually most cheats will use this shellcode to still jump back into the larger suspicious RWX memory region. I guess discardable sections might be large enough to hold an entire driver. I haven't really been following the latest developments in this field≥

Pretty much all EAC games that are worthy targets have paid hacks/cheats/botting suites that are widely used and not detected. I would guess that it depends on the game's vendor and most don't care enough to actually improve the detections and just use it as a "we tried" excuse.

EV certs are 100s of dollars though...

You can add your own "EV" certs to the Windows certificate store very easily.

Most of these check the certificate chain, and I've seen a few also upload fingerprints of certs that are rare or not seen before.

Reply on news.ycombinator.com