2

One thing that I have seen commonly used by game cheating engines it to control variables that the game is using. The idea is to edit the variables used by the game to say, give ones self unlimited ammunition. One example of this type of tool is tsearch.

I have no idea how to replicate this attack on my own, nor what it is called. I would like to learn about how it works, and how to mitigate it.

2

This is generally done by reverse engineering the game to find out where in running memory these variables live within the program. There are two ways to modify those variables.

Program Patch
An attacker can patch the executable or DLL itself if there is no integrity protections on it. Basically the actual bytes of the program are modified to be/do something different. As long as the program does not check to ensure no data has been changed this is a very viable option.

This can be mitigated by performing some type of checksum over the entire executable. A cryptographicly strong hash would do. You wouldn't want to use something like CRC32 because with enough changes to the binary an attacker could make the checksums match.

You could also sign your program. Before executing the program it verifies the signature of the program. If this fails then the program doesn't execute.

In Memory Patch
This technique is generally a bit more annoying. While the program is running an attacker either injects code into it, or finds where it's living in RAM and patches the program there. Code injection is much harder to do, but the memory patching is almost the same as regular patching. The attacker has to perform this every time that the program is run though since RAM will get cleared. This is much harder to mitigate since you're program is already running.


There are techniques you can use to prevent reverse engineering in general. During portions of the program you want to protect you can detect the presence of a debugger. Reverse engineers will almost certainly need to use a debugger to figure out exactly what pirtions of memory effect what the program does during execution. Manipulating memory in a debugger to see how the program is affected.

You can also use code obfuscation to make the disassembly or decompiling of your code much harder.

Here is a fun link in that general direction.

  • This explains the attack very well. Thanks for the fun link, I will look into it! – Aurora Jan 20 '15 at 21:35
0

Generally speaking, this falls under not properly validating untrusted input. If there is data (the level of ammunition) that is controlled by an untrusted entity (the user) and this is not validated by the application (it doesn't verify that they quantity of ammunition hasn't been modified by the user) then you have a potential vulnerability.

Now, whether this is an actual vulnerability depends on your threat model. For instance, if this is an offline single-player game, it may well not be. You may not care that the user can manipulate the game in this way. For an online multi-player game, it may be a very real vulnerability. In this case, you mitigate it by either:

  1. Validating the input from the user to ensure it hasn't been tampered with, or:
  2. Containing the value behind a trust boundary, for instance, setting and maintaining the correct level of ammunition on the server, without relying on values from the client.
  • I am well aware of how this could affect a program, but I am looking to see how the attack can be replicated to gain a greater understanding of it. Also what could be done to verify a variable has not been modified without slowing down the program? – Aurora Jan 20 '15 at 21:04
0

Let's start by your questions:

I have no idea how to replicate this attack on my own

Start learning C and how computer memory works then reverse engineering (at least the basics)

I would like to learn about how it works

The variables you said are addresses, so for instance: When the programmer declares a variable like HP or Ammo, it represents an address that stores the value in the computer memory (RAM).

Example:

The HP variable in memory has the following address 0x7fff9575c05f that stores the integer number 100 (example), if you have access to that address you can view or change the content.

So, softwares like tsearch can hook to a PID to analyze only the addresses of interest.

how to mitigate it.

Well, you can Encrypt all the data you think is critical, but the better way is to use an external server to work with this data. The ideia behind the existing techniques is to difficult as possible any change, but overall, if the data is on the client-side, you will not have assurance of integrity.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.