Cheat Engine

ulysse31

Hi, I am using an online game which has a launcher on UE and one on NA, detecting each others on the OS (ie you cannot launch NA launcher if UE or NA launcher is already open and vice versa). Both launchers are developed by the same company.

And so I am curious as to how it can detect that a Launcher is already started, I have tried renaming the process and the window name, it doesn't impact detection. So I am wondering how else can this be done ?
My final goal being to hook the APIs which allow this detection to fake the result.

Dark Byte · Posted: Tue May 17, 2016 6:30 am Post subject:

run the other game in a virtual machine.

or use process explorer and see if it creates named objects and see if you can do something about it. (e.g hooking the launcher exe on creation, and then do a api hook)

ulysse31 · Posted: Tue May 17, 2016 8:14 am Post subject:

atom0s · Posted: Tue May 17, 2016 1:03 pm Post subject:

There are various ways it can detect another instance:
- Mutex instance.
- Semaphore instance.
- Named pipe.
- MMF
- Process scanning.
- FindWindow scanning for a window name/class.

The most common used method that I've seen with games is the mutex method.

ulysse31 · Posted: Tue May 17, 2016 2:33 pm Post subject:

Some hints tend for a mutex method, at least that's what an IDA function shows. However I am cautious about my unpack because it doesn't actually launch correctly (its an upx SFX ZIP packed exe with signature and certificate which makes it too hard to unpack for me).

But there is also something fishy on the TCP connections ie i noticed the real launcher window has plenty connections among which 2 TCP that are listening to the own local computer while the error launcher only has 1 connection which is also listening to the computer and has just a few bytes of traffic.
=> i am guessing something similar to what IDA does to spot other network sessions with same key but here only on the same computer.