Unveiling the Underground World of Anti-Cheats
summary
Shows concrete bypasses: inject a DLL into LSASS and tunnel commands over a named-pipe to use its process handle, then replace pipes with file-mapping without leaving handles to avoid usermode detection, reimplement NtRead/Write to evade API hooks, and escalate to kernel by abusing a signed vulnerable driver to read/write physical memory and patch handle tables. Demo manipulates Black Desert Online player speed and attack rates to maxima, and a ReClass .NET plugin proves the technique; claim that cheat shops make over $1M/year surfaces.
AI-written summary · about
chapters (31)
- 0:00Introduction
- 2:08AntiCheats
- 2:50Numbers
- 3:40Apex
- 4:00Server
- 4:55Driver
- 5:58dll
- 6:40External Process
- 10:01Cheating on Glasses
- 10:40Market Analysis
- 11:26The Numbers
- 12:21Setting Goals
- 12:48Hijacking
- 13:43Scenario
- 14:22Named Pipes
- 14:39Screenshot
- 16:56Fine Mapping
- 19:37AntiWrite Implementation
- 20:20Hooking Examples
- 21:45DLLs
- 22:33Cold Caves
- 23:29Name Pipes
- 23:46Kernel
- 24:01Drivers
- 25:43Call EC
- 29:52Apex with EC
- 30:44Memory Manipulation
- 34:13Demo
- 37:22Memory Scanner
- 38:39Conclusions
- 39:58GitHub repositories
related talks
48mNext Level Cheating and Leveling Up Mitigations
47mNext Level Cheating and Leveling Up Mitigations
38mBypassing Anti-Cheats & Hacking Competitive Games
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)
18mOutsmarting the System: What Game Cheaters Can Teach Us About Cyber Security
30mCheaters’ Secrets Unveiled – How Cheaters Operate in Mobile Games & How to Counteract Them
44mVideo Game Security
31mBypassing Anti-Debugging: A Hybrid Real-Simulated Approach to Rootkit Analysis