The ABI status of ELF hash tables

Posted Aug 19, 2022 14:34 UTC (Fri) by josh (subscriber, #17465)
Parent article: The ABI status of ELF hash tables

If EAC were Free Software (and still for some mystifying reason existed at all), someone could have observed before now that it used DT_HASH. Since it isn't, there was neither an issue tracker to file the bug in nor a straightforward means for someone to notice in order to file one.

The ABI status of ELF hash tables

Posted Aug 19, 2022 14:40 UTC (Fri) by immibis (subscriber, #105511) [Link] (14 responses)

These kinds of anti-cheat systems fundamentally cannot be free software; rather, a free-software version of the game could not come with a useful anti-cheat system at all.

The ABI status of ELF hash tables

Posted Aug 19, 2022 17:13 UTC (Fri) by flussence (guest, #85566) [Link] (13 responses)

Doing anticheat with free software isn't impossible, it just needs to be thought of differently; you could use the flight computer quorum model where each client does sanity checking and reporting on the input received from others and the server offlines anything that consistently runs out of spec.

The ABI status of ELF hash tables

Posted Aug 19, 2022 17:35 UTC (Fri) by tux3 (subscriber, #101245) [Link] (5 responses)

The problem is not just manipulated output from a client. If the server is not sufficiently fine-grained with the info it sends, some cheats can reveal people hiding behind walls, disperse fog of war, or reveal other such byte patterns in memory that are not normally rendered.

Anticheats are in the business of preventing you from controlling the code that runs on your machine, so that you can't decide to run code that would give you an unfair advantage.

Which, short of imposing remote attestation hardware DRMs, tends to be strongly at odds with a free software system.

The ABI status of ELF hash tables

Posted Aug 20, 2022 13:31 UTC (Sat) by gray_-_wolf (subscriber, #131074) [Link]

> If the server is not sufficiently fine-grained with the info it sends, some cheats can reveal people hiding behind walls, disperse fog of war, or

Just to add to this, sometimes being fine-grained enough is simply not possible due to latency requirements. Sometimes in very fast paced games the client need to have more information than user (player) should see in order to be able to quickly react to inputs.

The ABI status of ELF hash tables

Posted Aug 21, 2022 2:57 UTC (Sun) by bartoc (guest, #124262) [Link] (3 responses)

You could try and detect that the player was seeing more info than they should behaviorally, but then you could start detection "star sense" as cheaters, which is not great.

Ultimately an open source anti-cheat probably could catch a lot of people, anti-cheat by it's nature tends not to catch the kind of people that can decipher anti-cheat source code. It's more to catch people using known cheats I think.

The ABI status of ELF hash tables

Posted Aug 21, 2022 20:33 UTC (Sun) by jkingweb (subscriber, #113039) [Link] (2 responses)

> You could try and detect that the player was seeing more info than they should behaviorally, but then you could start detection "star sense" as cheaters, which is not great.

What is "star sense"?

The ABI status of ELF hash tables

Posted Aug 21, 2022 21:53 UTC (Sun) by bartoc (guest, #124262) [Link] (1 responses)

sometimes (probably more often) called "game sense" it's the ability to basically use very limited information to predict what your opponent is doing. Basically knowing the game the metagame so well you can basically tell what your opponent is doing by just thinking "what would I do" and evaluating what actions they could do would be worst for you.

In any event really good game sense can result in you taking actions to respond to stuff before you can see it. You see this in Starcraft a lot, it can look like someone is using maphacks but in reality they are just really experienced.

The ABI status of ELF hash tables

Posted Oct 26, 2022 17:54 UTC (Wed) by sammythesnake (guest, #17693) [Link]

So, "intuitive minimax" then?

https://en.m.wikipedia.org/wiki/Minimax

To be fair, I use this kind of thing (along with other reasonable understandings of less deterministic but still somewhat predictable behaviour - something more akin to a Bayesian model, but again more intuitive than rigorous) all the time while doing such boringly quotidian things as driving - it's not at all rare that I twig somebody's planning to execute a turn a fair time before they remember that indicators are a thing, for example (assuming they ever actually do - BMW/Audi/etc. stereotypes notwithstanding) It's literally saved my life on a few occasions...

The ABI status of ELF hash tables

Posted Aug 19, 2022 17:45 UTC (Fri) by tshow (subscriber, #6411) [Link] (5 responses)

The flight computer quorum model doesn't have to deal with the possibility that any or all of the systems may have malicious intent. Consider an esports context where an entire team's computers (and thus, half the computers in the game) could be colluding.

It's a far thornier problem.

That said, the companies that make anti-cheat software haven't exactly covered themselves in glory. A lot of what's in the field look suspiciously like what would happen if you got the enthusiastic intern to write a rootkit.

The ABI status of ELF hash tables

Posted Aug 19, 2022 20:39 UTC (Fri) by camhusmj38 (subscriber, #99234) [Link] (1 responses)

I’m suspicious of anything that requires me to run a driver in kernel mode just to play a game.

The ABI status of ELF hash tables

Posted Sep 2, 2022 13:45 UTC (Fri) by Darkstar (guest, #28767) [Link]

> I’m suspicious of anything that requires me to run a driver in kernel mode just to play a game.

You probably wouldn't play any competitive First-Person Shooter games anyway, I assume?

Because if you did, and you knew that everyone else could be cheating on you without you knowing, I guess you would be more open to having a kernel-based anti-cheat driver.

The ABI status of ELF hash tables

Posted Aug 21, 2022 9:30 UTC (Sun) by jengelh (guest, #33263) [Link] (1 responses)

>Consider an esports context where an entire team's computers (and thus, half the computers in the game) could be colluding.

Any 2-team n-vs-n player setup reduces to a 1-vs-1 problem, because the other team could *also* be colluding.
Playground piece of wisdom: If you don't like the rules or how they are applied by the other player(s) and/or the umpire (if there is one), stop participating.

The ABI status of ELF hash tables

Posted Aug 22, 2022 7:12 UTC (Mon) by NYKevin (subscriber, #129325) [Link]

The rules prohibit such collusion, by assumption (or else it would not be brought up in a discussion of cheating in the first place). So your suggestion boils down to "don't play if you don't like other people cheating." Which is terrible for obvious reasons.

The ABI status of ELF hash tables

Posted Aug 22, 2022 19:58 UTC (Mon) by flussence (guest, #85566) [Link]

> Consider an esports context where an entire team's computers (and thus, half the computers in the game) could be colluding.

If it's an entirely remote event then the problem is interesting, but at a live event I'd imagine a client-server setup where one team's clients are raising red flags with the server and the others are silent would quickly become embarrassing to the cheaters.

FWIW, even proprietary anti-cheat software hasn't stopped people cheating all the way to finals on stage and then getting caught there.

The ABI status of ELF hash tables

Posted Aug 19, 2022 17:50 UTC (Fri) by excors (subscriber, #95769) [Link]

That won't help with even the most basic cheats like aimbots (where the player's inputs follow all the normal rules and are processed perfectly legitimately, but they don't come directly from the player's hand) or wall hacks (where players can see through walls, detecting enemies who ought to be hard to see).

You need to either lock down the client hardware so thoroughly that you can be certain it's only running the software provided by the game developer (as with consoles), or engage in an endless arms race of updating detection for cheats which are then updated to circumvent that detection. Game developers will never completely win, but in practice they usually do a good enough job to stop the game being made unplayable by a flood of cheaters. They'd find it much harder if they freely shared their detection algorithms with the cheat developers.

(You can also limit yourself to developing games where players don't gain an unfair advantage by cheating, but a lot of people enjoy competitive PvP action games and it'd be a shame to rule them out.)