An ioctl() call to detect memory writes

Posted Aug 11, 2023 8:22 UTC (Fri) by edeloget (subscriber, #88392)
In reply to: An ioctl() call to detect memory writes by KJ7RRV
Parent article: An ioctl() call to detect memory writes

> Isn't a real, non-cheating player suddenly getting better possible?

Yes, of course.

Anyone can have a gotcha moment when playing a video game, resulting in a detectable jump in their playing abilities. Some players might just change their glasses and become suddenly better. Or you might start playing a game while being temporarily disabled (broken arm for example) and then become visibly better when that condition disapear.

There are tons of reasons why a player might legitimately become better so the game server cannot act on this information alone (and in most case, that's only what it gets).

An ioctl() call to detect memory writes

Posted Aug 11, 2023 10:22 UTC (Fri) by paulj (subscriber, #341) [Link] (1 responses)

And how is a local memory watch thing going to do this any better? (beyond the very short term)

An ioctl() call to detect memory writes

Posted Aug 11, 2023 13:40 UTC (Fri) by rincebrain (subscriber, #69638) [Link]

Not the person you were replying to, but I think it's somewhat analogous to why modern games use copy-protecting DRM for the initial release and drop it after like 3-6 months.

You aren't going to stop everything - if there's an enormous market for your project, people are going to throw themselves at it and eventually some portion are going to find ways around your mitigations.

But if you, say, filter out 95% of the people trying to circumvent you by making the barrier high enough, that may result in a good enough result that the thing you're trying to optimize for (protecting the huge upfront hump of initial sales, preventing your multiplayer experience from having a reputation for being instakill aimbots with no stopping them) might be achievable.

Of course, unlike that kind of use-until-burned DRM, cheat detection becomes an ongoing cat and mouse game for the game's lifecycle even if you are doing deeply invasive monitoring, so at some point you're (probably) going to end up having a tradeoff between using it as a varyingly weak signal to get human attention to look at a player and go "...are they obviously doing impossible things" and playing whack-a-mole with even more weird heuristics (and then, if you scale enough that you can't justify humans to do a priori review, just ban on the signal and clean up reports of false positives...).

I'm not, to be clear, claiming that any of the above invasive monitoring is good, nor that even the arguments about using e.g. Denuvo for protecting week 1 sales are accurate, but that that is my understanding of the rationales and tradeoffs involved.