| View previous topic :: View next topic |
| Author |
Message |
lylcheater
How do I cheat?
![]() Reputation: 0
Joined: 04 Jun 2010
Posts: 3
|
 Posted: Fri Jun 04, 2010 12:39 pm Post subject: How Anti-Cheat Program Detect CE Currently? |
 |
|
I am just wondering exactly how the anti-cheats detect CE currently. I've no intention in making an UCE myself but rather interested in knowing the techniques behind it.
Is it simply by looking at some specific signature of the process? Just like anti-virus detecting known virus. In that case, if I just insert junk into the code would that means I can bypass the detection? In addition to junk code, should I also worry about API hooking - like recovering the hooked ReadProcessMemory()? I assume all anti-cheats would no doubt hook it, right?
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 470
Joined: 09 May 2003
Posts: 25805
Location: The netherlands
|
| Posted: Fri Jun 04, 2010 1:21 pm Post subject: |
|
|
window titles and classnames(including those of invisible windows)
processname
memory signatures
kernelmode readprocessmemory bypasses the usermode hooked ReadProcessMemory, and virtualpagedir plugin bypasses the kernelmode hook
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
lylcheater
How do I cheat?
![]() Reputation: 0
Joined: 04 Jun 2010
Posts: 3
|
| Posted: Sat Jun 05, 2010 2:10 am Post subject: |
|
|
| Dark Byte wrote: | window titles and classnames(including those of invisible windows)
processname
memory signatures
|
So in addition to inserting junk code, we should shuffle the names of various items.
| Quote: |
kernelmode readprocessmemory bypasses the usermode hooked ReadProcessMemory, and virtualpagedir plugin bypasses the kernelmode hook |
Do you mean CE already has a kernel model component bypassing the usermode hooked ReadProcessMemory? That is, for one to have an UCE, all his has to do is to make sure the process is not detected by inserting junk code and renaming window titles, class names, etc , while safely assuming the user mode hook implemented by anti-cheats is dealt with by CE.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
