Client sided Anti hack c++

Quget · Aug 29, 2011

Story(Skip if you hate to read)
I have been working on a client sided anti hack in c++ this time.
Someone gave me a tip going in c++ and check on a other way for hacks

The release is dll based and will/is (be) useable on other games aswell.

Attachment Info
The attachments contains prototypes.
A dll file/lib file for your game(Neuz)
A Test application.To test the dll.
The dll holds 1 function name: HackCheck
Version log
version 1
Able to Block Cheat engine speed hack.
Download Version 1: Removed

version 2
Able to block packet editors
Just 1 exported Function
Creates its own threads
Download Version 2:

To view the content, you need to sign in or register

Protection rate:Blocks Mega Noobs:/:

version 3
Networking has been added to see if the anti hack runs or not.
A build of the ServerSided check.
DLL/Server reads a .ini file with a ip addres.
Server listens to port 666 I will add that in the ini read next time
Download Version 3:

To view the content, you need to sign in or register

Protection rate:Blocks Noobs:/:

version 4 (First Release)
Ports added in configs.
Renamed client config.
Killing threads -> closes .exe(Importand)
Download Version 4:

To view the content, you need to sign in or register

Config example

Code:

127.0.0.1
13

Code:

[ip addres]
[port]

Protection rate:Blocking Noobs(Maybe More):/:

Owh a quick show how to import dll's in your project.
For c++ Users

Code:

#pragma comment(lib, "ANTIHACKDLL.lib")
using namespace std;
typedef void (*HackCheck)();
BOOL CallDLL()
{
   HackCheck _HackCheck;
   HINSTANCE hInstLibrary = LoadLibrary(L"ANTIHACKDLL.dll");

   if (hInstLibrary)
   {
	  _HackCheck = (HackCheck)GetProcAddress(hInstLibrary,"HackCheck");
         _HackCheck();
   }
   else
   {
	  ExitProcess( -1 );
   }
   return true;
}

For c# Users

Code:

namespace AntiHack
{
    class Program
    {
        [DllImport(@"ANTIHACKDLL.dll")]
        public static extern void HackCheck();
        static void Main(string[] args)
        {
            HackCheck();
            Console.ReadKey();
        }
    }
}

How to add it in your Neuz.exe
open up NeuzMsgProc.cpp
Look for void SkipPatch() at the end of the function
add this

Code:

#ifdef Q_PROTECT
#pragma comment(lib, "ANTIHACKDLL.lib")//Lib directory
using namespace std;
typedef void (*HackCheck)();
BOOL CallDLL()
{
   HackCheck _HackCheck;
   HINSTANCE hInstLibrary = LoadLibrary("ANTIHACKDLL.dll");

   if (hInstLibrary)
   {
	  _HackCheck = (HackCheck)GetProcAddress(hInstLibrary,"HackCheck");
      _HackCheck();
   }
   else
   {
	  ExitProcess( -1 );
   }
   return true;
}
#endif//Q_PROTECT

Then find

Code:

int APIENTRY WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow )
{

And add under {

Code:

#ifdef Q_PROTECT
	CallDLL();
#endif//Q_PROTECT

In versioncommon.h
add

Code:

#define Q_PROTECT

This will make it work on the Neuz.

Testing results.

CheatEngine Speed hack wont work at all. -> Cheatengine crash
rpe packet editor wont work at all. -> Neuz.exe -> exit
wpe packet editor wont work at all. -> Neuz.exe -> exit
Infiltration wont work at all. -> Neuz.exe -> exit
Possible block Yanic mama paket editor.

ServerSided check closed-> clients closes.
ServerSided not running?-> Client wont start.

Stress test Localhost ran up to 200 clients(Console test DLL) at the same time.

Bugs
Didnt look for it.

Bypasses
PM me those incase random user uses this

tt1:
Backdoors
None I don't add backdoors in my projects.

Any help/Sugestions/tips are welcome :thumbup1:

Special thanks:
phoen1x(For the basics)

spikensbror · Aug 29, 2011

You should make a proper wrapper for it.
And just make one validation return in the dll.
Basically just checking validation like: CheckAntihackStatus() instead of calling every hack check individually.
Just look at how GameGuard does it in the flyff source.

Quget · Aug 29, 2011

spikensbror said:
You should make a proper wrapper for it.
And just make one validation return in the dll.
Basically just checking validation like: CheckAntihackStatus() instead of calling every hack check individually.
Just look at how GameGuard does it in the flyff source.

alrigth ty

i will check it out xD

edit
Version 2 have been uploaded.
It creates its own threads.
The way of loading the dll has been improved.
you just have to call 1 function

Mootie · Aug 30, 2011

Without even opening it, I can tell you many vulnerabilities it has. You could easily detour ExitProcess on ring0 or ring3 around the actual function. I'm not sure what the actual antihack checks for, but you'll need a lot more than a check function to secure the client from memory modification.

spikensbror · Aug 30, 2011

Another thing you could do is dump all current process memory on startup and then verify it against the current process memory every 30 seconds or something.

Quget · Aug 30, 2011

xLethal said:
Without even opening it, I can tell you many vulnerabilities it has. You could easily detour ExitProcess on ring0 or ring3 around the actual function. I'm not sure what the actual antihack checks for, but you'll need a lot more than a check function to secure the client from memory modification.

I know I'm figuring that out.
You got any idea's ?

Edit

Updated main thread.
Added version 3 with Networking things
It will now check every 8 seconds if the dll is running yes or no.
This can be emulated tough....

Quget · Aug 31, 2011

Tested on my Neuz.exe

open up NeuzMsgProc.cpp
Look for void SkipPatch() at the end of the function
add this

Code:

#ifdef Q_PROTECT
#pragma comment(lib, "ANTIHACKDLL.lib")//Lib directory
using namespace std;
typedef void (*HackCheck)();
BOOL CallDLL()
{
   HackCheck _HackCheck;
   HINSTANCE hInstLibrary = LoadLibrary("ANTIHACKDLL.dll");

   if (hInstLibrary)
   {
	  _HackCheck = (HackCheck)GetProcAddress(hInstLibrary,"HackCheck");
      _HackCheck();
   }
   else
   {
	  ExitProcess( -1 );
   }
   return true;
}
#endif//Q_PROTECT

Then find

Code:

int APIENTRY WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow )
{

And add under {

Code:

#ifdef Q_PROTECT
	CallDLL();
#endif//Q_PROTECT

In versioncommon.h
add

Code:

#define Q_PROTECT

This will make it work on the Neuz.

Test results.

CheatEngine Speed hack wont work at all. -> Cheatengine crash
rpe packet editor wont work at all. -> Neuz.exe -> exit
wpe packet editor wont work at all. -> Neuz.exe -> exit
Infiltration wont work at all. -> Neuz.exe -> exit
Possible block Yanic mama paket editor.

ServerSided check closed-> clients closes.
ServerSided not running?-> Client wont start.

Stress test Localhost ran up to 200 clients(Console test DLL) at the same time.

/Updated main post

Improved · Aug 31, 2011

Is a source possibly coming out? It would be really educating for those planning to make their own antihack. Nice progress on it it so far. Does it check for the process? If it does, dosen't it slow the neuz load time?

usopp2 · Aug 31, 2011

I really like to have the source, because I tried long time ago to make a antihack but I failed :/. But releasing source code of a antihack can be dangerous... Maybe you can send it to dev's ?

spikensbror · Sep 1, 2011

OH and to secure the client from Yannick's packet editor you can just detour the wpa connects and put an IP check in the detour or force the server IP onto the connect.

Quget · Sep 1, 2011

spikensbror said:
OH and to secure the client from Yannick's packet editor you can just detour the wpa connects and put an IP check in the detour or force the server IP onto the connect.

Lot of packet editors should be blocked ^^ so also this one

but I'm to lazy to download.

Anyway I fixed a way to bypass the anti hack a mistake made by many people.
Killing threads.

I do get lots of support.
Spiken sugested me something.
So I will base the newer server sided one as a dll to load in the login server.

I cannot just release the source.
Since people will be able to make fake dll's with it:/
I might release it ones but not soon

version 4
Ports added in configs.
Renamed client config.
Killing threads -> closes .exe
Download:

To view the content, you need to sign in or register

Config example

Code:

127.0.0.1
13

Code:

[ip addres]
[port]

Protection rate:Blocking Noobs(maybe more):/:

BlackGiant · Sep 2, 2011

Nice project!

I've also been working on a similar project. Good Luck.

Regards
BlackGiant

Johnny · Sep 2, 2011

nice project seems better the n the c# one good luck ^^

Quget · Sep 2, 2011

Added Special Thanks

He deserves to be thanked ^^

GlaphanKing · Sep 2, 2011

Looks very organized and shows much promise. You have my support Misterkid.

btw: Kudos to whomever keeps reporting my postings.

zaidH1 · Sep 2, 2011

This looks pretty good keep it up

Quget · Sep 3, 2011

Ty.
I have to research other games too and block those hacks aswell.
Thats for when I've time.
I will compile the dll without networking tommorow.
Might also be usefull.

Forgot to mention that the server sided also checks for packet delay's if a packet gets sended too late you get dc'ed.Networking things is far from done.
Also it might be handy to know the people using this for their server.
I might have under estimate the cheaters in the flyff p-server world.(the on who use hacks other people makes)
I know real game hackers can bypass it easly

Client sided Anti hack c++

Quget

Was Misterkid, developer

spikensbror

0xC0FFEE

Quget

Was Misterkid, developer

Mootie

Not working on UnitedFlyf

spikensbror

0xC0FFEE

Quget

Was Misterkid, developer

Quget

Was Misterkid, developer

Improved

i sell platypus

usopp2

Initiate Mage

spikensbror

0xC0FFEE

Quget

Was Misterkid, developer

BlackGiant

Newbie Spellweaver

Johnny

Elite Diviner

Quget

Was Misterkid, developer

GlaphanKing

Custom Title Activated

zaidH1

Newbie Spellweaver

Quget

Was Misterkid, developer

RaGEZONE Sponsor

About RaGEZONE

Forum Statistics

RaGEZONE Partners