Bypassing Anti-Cheats And Hacking Competitive Games

Bypassing Anti-Cheats And Hacking Competitive Games

Speakers: Rohan Aggarwal (DefCore Security)

Conference: HITB Amsterdam

YouTube: https://www.youtube.com/watch?v=vwnjqmAruEw

Overview

In this comprehensive talk from HITB Amsterdam, Rohan Aggarwal, founder of DefCore Security, delves into the intricate world of competitive game hacking, offering a detailed exploration of techniques used to bypass modern anti-cheat systems. The presentation, titled "Bypassing Anti-Cheats And Hacking Competitive Games," addresses the significant impact of cheating on the multi-million dollar gaming industry and the relentless cat-and-mouse game between anti-cheat developers and hackers. Aggarwal shares his personal game hacking experiences, demonstrating both sophisticated kernel-level cheats for games like Apex Legends and hardware-based pixel bots designed to circumvent even the most robust anti-cheats, such as Valorant's Vanguard.

The talk is not focused on exploiting game server vulnerabilities or client-side bugs for griefing, but rather on gaining a competitive advantage over other players. Aggarwal highlights the stark contrast between games like Valorant, renowned for its strong anti-cheat, and Counter-Strike, often criticized for its weaker defenses, emphasizing that dedicated hackers will always find a way to circumvent security measures. Beyond the immediate implications for gaming, the speaker also points out the transferable nature of these advanced reverse engineering and system-level programming skills, which are highly valuable in fields like malware analysis. The presentation serves as an eye-opener to the technical depth involved in modern game cheating and the constant innovation required by both sides of this digital arms race.

Background

▶ Watch: Introduction: The Pain of Cheaters & Hacking Overview (0:00)

The history of cheating in games dates back to the very origins of public gaming. While the first game, a tennis simulation, emerged in 1957, widespread gaming and the accompanying rise of cheating truly began in the 1970s and 1980s with the introduction of home PCs and consoles. Early forms of cheating involved simple modding using command-line hex editors in the 1980s. The landscape shifted dramatically with the introduction of the first Aimbot for Doom 2 in 1995, but the real impact of cheating became evident with the advent of popular multiplayer games like Counter-Strike in the early 2000s. In single-player games, cheating primarily affected the individual player, but in online competitive environments, it directly impacts the experience of other players, eroding the integrity and success of the game.

This growing threat spurred the development of anti-cheat systems. The first notable anti-cheats, PunkBuster and Wallhack, emerged in the early 2000s, operating primarily in user mode. While initially successful, hackers quickly discovered methods to bypass them using kernel-level cheats. This marked a significant escalation, leading to today's powerful kernel-level anti-cheats such as Easy Anti-Cheat, BattlEye, and Vanguard. Anti-cheat systems function much like classic anti-debuggers or antivirus software, relying on three core pillars: detection (using signatures, statistics, and heuristics), discovery (developers finding new cheats, in-game reporting systems), and prevention (binary obfuscation, sandboxing). The transition to kernel-level anti-cheats was a major leap, initially eliminating a significant percentage of cheaters, but never achieving a 100% success rate.

The fundamental distinction between user mode and kernel mode is crucial to understanding anti-cheat bypasses. User mode is where applications execute, while kernel mode handles core operating system functionalities, granting privileged access to hardware and memory. A user-mode process cannot directly access kernel-mode processes or memory. This means a user-mode anti-cheat cannot detect a driver loaded into the kernel, providing a critical advantage for cheaters. Game cheats themselves are broadly categorized into internal cheats, injected directly into the game process for high performance and functionality (but complex to develop, requiring game engine knowledge), and external cheats, which run as separate processes and manipulate game memory externally. External cheats are easier to develop but generally offer lower performance and less functionality. The speaker opted for external methods due to their relative simplicity.

Key Findings

▶ Watch: Methodology for Bypassing Kernel Anti-Cheats (8:35)

The talk presents two primary methodologies for bypassing anti-cheat systems, demonstrating a sophisticated understanding of operating system internals and hardware interaction. The first key finding revolves around a kernel-level bypass technique designed to defeat user-mode anti-cheats and even some kernel-mode ones by operating at the highest privilege level of the operating system. This involves developing a custom kernel driver to read and write game memory, circumventing anti-cheat detection mechanisms that monitor user-mode memory access attempts. The core challenge here lies in creating, loading, and communicating with an unsigned kernel driver without detection, requiring advanced techniques like system call hooking and vulnerable driver exploitation for driver loading.

The second significant finding addresses the most robust anti-cheat systems, exemplified by Valorant's Vanguard, which loads at boot time and is notoriously difficult to bypass at the software level. For such strong defenses, the talk introduces external hardware cheats, specifically pixel bots (also known as color bots). These cheats operate by scanning pixels directly from the monitor feed rather than interacting with the game's memory or process. By identifying enemy outlines or specific colors on the screen, the bot then uses an external hardware device (like an Arduino spoofing a mouse) to simulate mouse movements, thus performing actions like aiming. This approach is highly effective because it entirely circumvents the game's memory space and anti-cheat protection, appearing to the system as legitimate user input from a standard peripheral. The demonstration of both an Apex Legends wallhack (kernel-based) and a Valorant Aimbot (hardware-based pixel bot) clearly illustrates the versatility and adaptability of modern game hacking techniques against varying levels of anti-cheat sophistication.

Technical Deep Dive

▶ Watch: DEMO: Apex Legends Kernel-Level Wallhack (33:00)

The development of sophisticated game cheats, particularly kernel-level ones, follows a methodical approach, which the speaker outlines in five key steps: reversing, hooking, driver creation, driver loading, and user-mode development.

Reversing is the initial reconnaissance phase, akin to information gathering in penetration testing. The primary goal is to find crucial game offsets—relative memory addresses that remain constant even as base addresses change with each game launch. For instance, to modify a player's health, one must first locate the memory address where health is stored. Aggarwal prefers using Cheat Engine as a debugger for this purpose due to its user-friendliness, avoiding the complexities of deobfuscating heavily protected game binaries and understanding specific game engines (like Unreal Engine or Unity) required by disassemblers such as IDA. Offsets are critical because absolute memory addresses for game components change every time the game launches. By identifying an offset (e.g., player health is always 3 bytes away from the game's base address, or ammo is 4 bytes away from the player structure, which itself is 10 bytes from the game's base), cheaters can reliably locate and manipulate data. These can be multi-level pointers, requiring a chain of offsets to reach the target data. For those disinclined to manual reversing, public resources like firstone.post, UnknownCheats, and GitHub repositories often host updated game offsets.

Driver Creation involves developing the kernel-mode component of the cheat. Similar to a main function in C++, a kernel driver starts execution at DriverEntry. The speaker demonstrated a basic "Hello World" driver, emphasizing that the driver entry point name can be customized via linker settings. Debugging kernel drivers is fraught with peril; a single error can crash the entire system due to the shared virtual memory space in the kernel. To safely test and debug, Windows offers a test mode, enabled via bcdedit /set testsigning on, which allows loading unsigned drivers.

Hooking serves as the vital communication bridge between the user-mode cheat and the kernel-mode driver, especially since unsigned drivers cannot directly communicate with user-mode applications. The technique involves hijacking a suitable, officially signed system call within a legitimate Windows driver (e.g., dxgkrnl.sys, specifically NtOpenCompositionService). The custom kernel driver replaces the initial instructions of this system call with a Shellcode—typically mov rax, [address_of_custom_driver_function]; jmp rax. This Shellcode redirects the system call's execution flow to the custom driver's handler function. When the user-mode cheat calls the legitimate system call, it unknowingly triggers the custom kernel driver. The driver's responsibilities include finding the target system call's address, changing its memory protection to read/write to insert the Shellcode, implementing a hook handler to process read/write requests from user mode, and crucially, clearing traces (e.g., MmUnloadDrivers table, PnP cache table) to avoid detection by anti-cheats monitoring kernel artifacts.

Driver Loading is one of the most challenging aspects, as Windows typically prohibits loading unsigned kernel drivers. While test mode allows it, anti-cheats detect test mode and prevent game execution. Paying Microsoft for a signed driver is expensive and risks revocation if detected. The most common and effective method is to exploit vulnerabilities in officially signed drivers. The speaker highlights KD Mapper, a tool that exploits a known CVE in an Intel driver to manually map an unsigned driver into kernel memory. Manual mapping involves allocating kernel memory and simply "throwing" the driver's binary into it, bypassing the standard driver loading process. KD Mapper also automatically clears some common traces like MmUnloadPfnDatabase and PiDDBLock but requires further reversal of the anti-cheat to identify and clear all specific detection vectors. Other public resources like the KDU utility and various GitHub repositories list publicly known vulnerable drivers that can be exploited for this purpose.

Finally, User-Mode Development is comparatively straightforward. This involves calling the custom hook function exposed by the kernel driver, preparing read/write instructions (e.g., specifying an address and value), and implementing the actual cheat logic (e.g., Aimbot trigonometry, ESP rendering). An example provided was an Apex Legends wallhack, which involved finding the offset for the "glow mode" ability (similar to Bloodhound's ability to see enemies through walls) and continuously spamming that offset from the user-mode cheat to keep enemies highlighted.

For games with exceptionally strong anti-cheats like Valorant's Vanguard, which loads at boot time, a different approach is necessary: external hardware cheats, specifically pixel bots. These bots do not interact with game memory. Instead, they operate on three principles:

1. Pixel Capture: Continuously capturing screen pixels (e.g., using OBS or custom Python code).
2. Enemy Detection: Applying color filtering (e.g., using OpenCV) to identify specific enemy outlines or colors on the screen, calculating their coordinates relative to the crosshair. The speaker demonstrated filtering purple enemy outlines from purple environment elements by fine-tuning HSV color ranges.
3. Mouse Movement: Sending calculated coordinates to an external device that simulates mouse movement.

The evolution of pixel bots highlights the cat-and-mouse game:

• Gen 1 (Software Libraries): Used C++/Python libraries for mouse movement, quickly blocked by anti-cheats.
• Gen 2 (Third-Party Drivers): Employed drivers like Interception to simulate input, also blocked.
• Gen 3 (Macro Software): Utilized macros in legitimate mouse drivers (Razer Synapse, Logitech G Hub), which were then detected and blocked.
• Gen 4 (External Devices): Introduced external devices to send mouse commands, making it harder for anti-cheats to distinguish from real input. However, the use of two mice (one real, one simulated) was detected and blocked by Valorant.
• Gen 5 (Spoofed Arduino): The current working solution involves connecting a real mouse to an Arduino via a USB Host Shield. The Arduino then acts as a proxy, receiving commands from the Python pixel bot (via serial communication) and simultaneously relaying real mouse input and simulated input to the PC. By spoofing the Arduino's vendor and product IDs (e.g., to a "Razer Viper"), the PC only sees a single, legitimate-looking mouse, making detection extremely difficult. The Arduino code takes coordinates, converts them to signed integers, and uses Mouse.move() to simulate precise movements while also handling actual mouse input. While Vanguard monitors serial ports, unique encoding of coordinates (e.g., adding prefixes) can bypass signature-based detection.

Demo / Proof of Concept

▶ Watch: Hardware Cheats: Pixel Bots for Games like Valorant (34:00)

The talk included two compelling demonstrations, showcasing the practical application of both kernel-level and hardware-based cheating techniques.

For the kernel-level cheat, the speaker presented a wallhack for Apex Legends. This demo highlighted the power of memory manipulation at the kernel level. By identifying and continuously writing to the specific "glow mode" offset within the game's memory—an offset that enables an ability similar to Bloodhound's, allowing players to see enemies through walls—the cheat effectively rendered all opponents visible regardless of obstructions. The demonstration clearly showed enemies outlined and visible through terrain, providing a significant unfair advantage to the player.

The second demonstration focused on the hardware-based pixel bot for Valorant, designed to bypass its notoriously strong Vanguard anti-cheat. This Aimbot showcased the external nature of the cheat. The setup involved a Python script running the pixel detection and calculation logic, communicating via serial port with an Arduino board equipped with a USB Host Shield. A physical mouse was connected to the Arduino, which then connected to the PC. The speaker demonstrated holding the mouse completely still, with only the left mouse button pressed, while the pixel bot automatically detected enemies on screen (identified by their outlines) and precisely moved the crosshair to secure headshots. This visual proof underscored how the cheat operates entirely outside the game's memory space, relying solely on screen analysis and simulated physical input, making it incredibly challenging for traditional anti-cheat mechanisms to detect.

Defensive Implications

▶ Watch: Q&A: Exploiting Signed Drivers to Load Unsigned Ones (53:00)

The detailed exploration of game hacking techniques also provides crucial insights into the defensive strategies anti-cheat developers must employ.

For kernel-level cheats, anti-cheat systems must evolve their detection capabilities beyond simple signature matching:

• Hooked Functions and System Calls: Anti-cheat developers are aware of popular system calls and drivers targeted for hooking (e.g., dxgkrnl.sys). They develop signatures for known hooks, necessitating that cheaters find increasingly obscure or unique system calls and drivers to hijack.
• Shellcode Signatures: Generic Shellcodes like mov rax, [address]; jmp rax are widely recognized. Anti-cheats can detect these patterns, requiring cheaters to craft more complex, polymorphic, or unique Shellcodes to evade detection.
• Driver Loading and Traces: Loading unsigned drivers via Windows test mode is easily detected by anti-cheats, which will prevent game execution. Manual mapping using tools like KD Mapper, while effective, leaves traces in kernel memory (e.g., MmUnloadPfnDatabase, PnP cache table). Anti-cheat developers continuously reverse engineer these loading mechanisms to identify and monitor specific kernel tables, internal structures, and undocumented functions for anomalies indicative of manually mapped drivers. They can also patch vulnerabilities in legitimate drivers that cheaters exploit (e.g., the Intel driver CVE exploited by KD Mapper).
• Kernel Callbacks: Anti-cheats use kernel callbacks (e.g., PsSetLoadImageNotifyRoutine, ObRegisterCallbacks) to monitor driver loads, process creation, and handle duplication, which are all activities a kernel cheat might perform. Cheaters must learn to unregister or spoof these callbacks.

For hardware-based pixel bots, particularly those targeting strong anti-cheats like Valorant's Vanguard, the defensive implications are different:

• Outline Removal: As demonstrated by Valorant's recent patch allowing users to disable outlines, removing these visual aids is a direct countermeasure to color-based pixel bots. If enemies no longer have distinct outlines, color filtering becomes significantly harder or impossible.
• AI-Based Detection: Even if outlines are removed, future advancements in AI, such as YOLO AI, could enable bots to identify enemy models directly from raw pixel data, even without specific visual cues, provided sufficient training data. Anti-cheats would need to develop their own AI-based detection for such sophisticated visual analysis.
• Serial Port Monitoring: Vanguard already monitors serial port communication. While public cheats using common command patterns are detected, cheaters can encode or obfuscate their communication (e.g., adding prefixes, encryption) to evade signature-based detection on the serial port. Anti-cheats need to employ more advanced heuristics and behavioral analysis on serial data.
• Hardware Fingerprinting and Spoofing Detection: Anti-cheats can improve their ability to fingerprint connected hardware devices. While Arduino spoofing (changing vendor and product IDs) is currently effective, anti-cheats could develop more robust methods to identify actual device characteristics beyond simple IDs, or flag devices that exhibit unusual behavior patterns inconsistent with typical human input.
• Input Latency Analysis: Hardware cheats introduce additional latency. Anti-cheats could potentially analyze input timing and latency patterns for anomalies that distinguish human input from bot-generated input, although this is complex.

In essence, anti-cheat development is a continuous arms race requiring constant adaptation, deep system-level knowledge, and the ability to anticipate and counter novel attack vectors, whether they originate from kernel-level software exploits or external hardware manipulations.

Key Takeaways

• The Anti-Cheat Arms Race is Perpetual: Modern game hacking involves a continuous, escalating battle between sophisticated anti-cheat systems and determined cheaters, with each side constantly developing new techniques and countermeasures.
• Kernel-Level Access is Paramount for Software Cheats: Bypassing contemporary anti-cheats often necessitates operating in kernel mode, requiring advanced skills in reverse engineering, driver development, system call hooking, and exploiting vulnerable signed drivers.
• Hardware Cheats Circumvent Memory-Based Detection: For the strongest anti-cheats, external hardware-based pixel bots offer a viable bypass by operating outside the game's memory space, relying on screen analysis and simulated physical input, making traditional anti-cheat detection methods ineffective.
• Obfuscation and Uniqueness are Critical for Evasion: Whether it's crafting unique Shellcode, finding obscure system calls, or encoding serial communication, cheaters must continuously innovate to avoid signature-based detection by anti-cheat systems.
• Game Hacking Skills are Highly Transferable: The advanced reverse engineering, system-level programming, and anti-detection techniques employed in game hacking are directly applicable and highly valuable in other cybersecurity domains, such as malware analysis and exploit development.
• Anti-Cheats Must Adapt Beyond Software: To counter hardware cheats, anti-cheat developers must consider non-software-based countermeasures like altering game visuals (removing outlines) and developing AI-driven detection or advanced hardware fingerprinting.

About the Speaker(s)

Rohan Aggarwal is the founder of DefCore Security, a testament to his expertise in cybersecurity. He is an active participant in the bug bounty community, having engaged in live hacking events with prominent platforms like HackerOne and Intigriti. Beyond his professional pursuits in security, Rohan is also an avid gamer, though he emphasizes his preference for playing without cheats. His background combines practical offensive security experience with a deep understanding of system internals, making him uniquely qualified to speak on the intricate subject of anti-cheat bypasses.