[VB.NET] Run an application when terminated in Taskmanager

[jcgo16]

Run an application when terminated in Taskmanager

does anyone know this?

when i terminate my program using task manager, it will run a program first before it will be killed

 

[TimeBomb]

If I remember correctly, the end task function in task manager is catchable with the onClose event method in the .NET framework. But, the end process function in the task manager is not catchable easily, if at all. I forget if hooking on to it is possible; I don't think so. Certainly not without it being caught by any antivirus or antispyware application.

 

[jcgo16]

im trying to make a gameguard sort of

still trying to figure it out

 

[TimeBomb]

Ah, .NET based anticheat? Alright then.

First, you'll need a .NET based launcher/patcher that requires admin privileges to start. Make sure that the game client only starts through the launcher, and not through any other method.

Then, right before the game starts, start the anticheat. Make sure to start it with specific parameters. If the game tries to start when the anticheat should be open, but the anticheat is nowhere to be found, then don't start the game.

Have the anticheat application close instantly if it is not started with the correct parameters[that only the launcher knows].

If the game closes, detect it in the anticheat and close the anticheat.
Have the anticheat do whatever anticheat measures it does(i.e. look for processes in the background).

Every couple minutes, the anticheat should phone home and tell the server that it is open. The server should similarly look for this 'phone home' at the same interval of time. If the anticheat has not phoned home, then disconnect the user from the server and log it [so you can ban/question them later if you want].

You can also use a second application that detects if the main anticheat or game have closed. If so, it kills off all the anticheat and game processes instantly. Apply similar functionality to the main anticheat. This will help prevent killing the anticheat through task manager, but it won't prevent more intelligent users killing off both anticheat processes simultaneously, and thus the game won't close.

If you can, don't allow the game client to log you in or/and run unless the other processes[anticheat] are open and have correct md5 hashes.


Do note that most of this description comes from when I was working on a anticheat-like application for a private server on VB.Net[maybe C#]. That was a while ago, and I haven't had a need for an anticheat since, so the information here may not be the best way to do things; in fact, it probably is not.
Do note that you will need to create your own custom launcher (and obviously anticheat) with this method, and you will need access to the inner workings of the client and server, at least enough to do what is described in this thread.

G'luck.

 

[XZeenon]

Ah, .NET based anticheat? Alright then.

First, you'll need a .NET based launcher/patcher that requires admin privileges to start. Make sure that the game client only starts through the launcher, and not through any other method.

Then, right before the game starts, start the anticheat. Make sure to start it with specific parameters. If the game tries to start when the anticheat should be open, but the anticheat is nowhere to be found, then don't start the game.

Have the anticheat application close instantly if it is not started with the correct parameters[that only the launcher knows].

If the game closes, detect it in the anticheat and close the anticheat.
Have the anticheat do whatever anticheat measures it does(i.e. look for processes in the background).

Every couple minutes, the anticheat should phone home and tell the server that it is open. The server should similarly look for this 'phone home' at the same interval of time. If the anticheat has not phoned home, then disconnect the user from the server and log it [so you can ban/question them later if you want].

You can also use a second application that detects if the main anticheat or game have closed. If so, it kills off all the anticheat and game processes instantly. Apply similar functionality to the main anticheat. This will help prevent killing the anticheat through task manager, but it won't prevent more intelligent users killing off both anticheat processes simultaneously, and thus the game won't close.

If you can, don't allow the game client to log you in or/and run unless the other processes[anticheat] are open and have correct md5 hashes.


Do note that most of this description comes from when I was working on a anticheat-like application for a private server on VB.Net[maybe C#]. That was a while ago, and I haven't had a need for an anticheat since, so the information here may not be the best way to do things; in fact, it probably is not.
Do note that you will need to create your own custom launcher (and obviously anticheat) with this method, and you will need access to the inner workings of the client and server, at least enough to do what is described in this thread.

G'luck.

I agree with this guy.

I created an anti-cheat in .NET once.

TLR

Launch 2 applications.
One would be a secret application that no one knows exists.
The other would be your main anti-cheat.

Run timers on each one, to check for the opposite app.
If one doesn't find the app running, terminate everything.

Tada.

 

[jcgo16]

ok thanks guys, this would be a great help to me

 

[TimeBomb]

I agree with this guy.

I created an anti-cheat in .NET once.

TLR

Launch 2 applications.
One would be a secret application that no one knows exists.
The other would be your main anti-cheat.

Run timers on each one, to check for the opposite app.
If one doesn't find the app running, terminate everything.

Tada.

The only problem would be that anyone could create a simple application with a few lines that could kill both processes at the same time.

That's why you should incorporate either server or clientside - preferably serverside - some sort of protection. Whether this is the server checking for a 'phone home' function and kicking you out if it doesn't find it.. or the client checking to make sure the .exe's are running.

The problem is that, with the client mods, it can usually be easily bypassed unless replacing the client with a different version doesn't work, and the current client is encrypted (after you modify it).

Nonetheless, a simple anticheat such as this shouldn't be expected to keep smart peoples out. It should, and usually does, keep around 80-90% of script kiddies out. You know.. the 14 year olds who think they are 1337 hax0rz because they downloaded a program(that is probably also a keylogger) and pressed one or two buttons. Those are the main game hackers; those are the ones you are going to be able to deal with using a simple anticheat like this.

Oh, and something I forgot to tell you OP:
Obfuscate your launcher and anticheat applications. Google ".net obfuscator" if you need to. Essentially, obfuscating a .net application is essentially like encrypting a file. Without doing it, your application will be very easy to disassemble... then I can get all the parameters, and possibly even your database information... as well as the whole application source code.

 

[jcgo16]

thanks i got it ehehe

 

[XZeenon]

The only problem would be that anyone could create a simple application with a few lines that could kill both processes at the same time.

That's why you should incorporate either server or clientside - preferably serverside - some sort of protection. Whether this is the server checking for a 'phone home' function and kicking you out if it doesn't find it.. or the client checking to make sure the .exe's are running.

The problem is that, with the client mods, it can usually be easily bypassed unless replacing the client with a different version doesn't work, and the current client is encrypted (after you modify it).

Nonetheless, a simple anticheat such as this shouldn't be expected to keep smart peoples out. It should, and usually does, keep around 80-90% of script kiddies out. You know.. the 14 year olds who think they are 1337 hax0rz because they downloaded a program(that is probably also a keylogger) and pressed one or two buttons. Those are the main game hackers; those are the ones you are going to be able to deal with using a simple anticheat like this.

Oh, and something I forgot to tell you OP:
Obfuscate your launcher and anticheat applications. Google ".net obfuscator" if you need to. Essentially, obfuscating a .net application is essentially like encrypting a file. Without doing it, your application will be very easy to disassemble... then I can get all the parameters, and possibly even your database information... as well as the whole application source code.

Programs work by thread.
It won't execute one until the other one is finished.

So, if they're trying to kill both processes, the first will end and before the second call is made, your application should have enough time to react before the second thread is started.

Also, if you hide the app very well (create it into a temp directory, run it as a hidden process) most likely, they won't figure it out.

 

[TimeBomb]

Programs work by thread.

Err I.. suppose? If you put it that way, what is stopping the user from splitting off in to two threads and simultaneously having each thread kill one process, thus doing it at exactly the same time?

It won't execute one until the other one is finished.

So, if they're trying to kill both processes, the first will end and before the second call is made, your application should have enough time to react before the second thread is started.

Also, if you hide the app very well (create it into a temp directory, run it as a hidden process) most likely, they won't figure it out.

It will execute one line right after another - not 0 milliseconds after, but just about - especially since it is a command that tells Windows to kill the process... it doesn't have to do much of anything after initializing the action of asking Windows to kill the process. (Correct me if I am wrong)

Thus, it can go from one process killing to another very quickly. If you have an anticheat check whether or not the other one is running more than once every second, then it will start being noticeably resource-intensive.

I agree that hiding your anticheat well is a good idea, but anyone who isn't an idiot, has access to google, and has time, can figure out which process is your anticheat. Just check which processes are running when the game is open, and which are running when the game is closed.


There are a few ways to do an anticheat...

1) The easy way, which is pretty much what I have been explaining throughout this thread. It's not too difficult to code, it's below par in terms of hacking protection and even moreso in terms of being able to bypass it.

2) The 'gameguard' way. Block as much as you are aware of, and then some. Block anything suspicious. Make the anticheat act as a backdoor rootkit(may have some.. off.. terminology there, so correct me if I am wrong), and don't worry much if a user's computer isn't 100% compatible or if a normal application makes the anticheat complain.

3) The good way. Do it all serverside. Make very little happen clientside past displaying what needs to be displayed to the end user. Check everything at the source of the server. Anything that may have a tiny chance to be abused or modified in a way you don't want it - encrypt/hide/secure(change) it. This way is done moreso in Western MMO's than Asian MMO's.