/dev/null: Anti-Cheat Kernel Driver - League of Legends

link管理

链接快照平台

输入网页链接，自动生成快照
标签化管理网页链接

相关文章推荐

爱看球的香菜 · PHP-Redis扩展安装 error: ...· 2 年前 ·

腹黑的烈酒 · booststrap的sortable: ...· 2 年前 ·

耍酷的铁板烧 · SpeechSynthesis ...· 2 年前 ·

玩足球的大蒜 · 获取和设置tinyMCE 4编辑器的内容 ...· 2 年前 ·

爱旅游的小虾米 · 万字干货 | 一文助你了解机器学习 | ...· 3 年前 ·

</noscript><div id="___gatsby"><div style="outline:none" tabindex="-1" id="gatsby-focus-wrapper"><header id="riotbar-header" class="style__Header-nag7bg-0 tpmsP"/><div class="style__Main-nag7bg-1 bILiti"><div class="style__StyledArticleWrapper-i7k9d9-1 eTDXXK"><div class="style__Wrapper-dwc27z-0 style__ResponsiveWrapper-dwc27z-12 lfWcmy djZpUF style__Section-i7k9d9-0-SectionArticleHeader imCzRh type-article_header first-section" data-testid="hero"><div class="style__WrapperInner-dwc27z-1 bQCquN"><div data-testid="hero:background-image" class="style__BackgroundImage-dwc27z-2 fipjrm"><img src="https://images.contentstack.io/v3/assets/blt731acb42bb3d1659/bltfedf0b5b67128a58/5e3101be031402023fafef81/Anti_Cheat_Kernel_Banner.jpg" style="object-fit:cover" alt="" class="style__NoScriptImg-g183su-0 style__Img-g183su-1 cipsic dBitJH"/><noscript><img src="https://images.contentstack.io/v3/assets/blt731acb42bb3d1659/bltfedf0b5b67128a58/5e3101be031402023fafef81/Anti_Cheat_Kernel_Banner.jpg" style="object-fit:cover" alt="" class="style__NoScriptImg-g183su-0 cipsic"/></noscript></div><div class="style__Content-dwc27z-3 jgZHaH"><div class="style__Overview-dwc27z-4 fLNLou"><div data-testid="hero:media" class="style__Media-dwc27z-5 hROuYs"><img src="https://images.contentstack.io/v3/assets/blt731acb42bb3d1659/bltfedf0b5b67128a58/5e3101be031402023fafef81/Anti_Cheat_Kernel_Banner.jpg" style="object-fit:cover" alt="" class="style__NoScriptImg-g183su-0 style__Img-g183su-1 cipsic dBitJH"/><noscript><img src="https://images.contentstack.io/v3/assets/blt731acb42bb3d1659/bltfedf0b5b67128a58/5e3101be031402023fafef81/Anti_Cheat_Kernel_Banner.jpg" style="object-fit:cover" alt="" class="style__NoScriptImg-g183su-0 cipsic"/></noscript></div><div class="style__Details-dwc27z-6 fkkUgN"><a name="Dev" slug="dev" class="style__MobileCategory-dwc27z-9 CyDXE" href="/en-us/news/dev/">Dev</a><div data-testid="hero:title" class="style__Title-dwc27z-7 bpCRuC">/dev/null: Anti-Cheat Kernel Driver</div><p data-testid="hero:description" class="style__Blurb-dwc27z-8 hhsgcq">We’re protecting some of Riot’s upcoming games with new anti-cheat systems.</p></div><div class="style__Container-sc-1c9bc3r-0 kklxxj style__StyledHexOutline-dwc27z-10 bAvWUu"><canvas class="style__Canvas-sc-1c9bc3r-1 hsvRhV"/></div></div><div class="style__Wrapper-sc-1i05riq-0 style__ResponsiveWrapper-sc-1i05riq-8 gpaspH fBMrVs style__Meta-dwc27z-11 byRHdQ"><time datetime="2020-02-03T18:00:00.000Z" class="style__Time-sc-10dp7mx-0 kJsMQd style__Date-sc-1i05riq-1 bTeDQt" data-testid="hero:meta:date"/><div class="style__Info-sc-1i05riq-2 hOyndg contains-category"><a name="Dev" slug="dev" class="style__Category-sc-1i05riq-3 eDSITP" data-testid="hero:meta:category" href="/en-us/news/dev/">Dev</a><span class="style__Author-sc-1i05riq-4 cGDbTB"><span data-testid="hero:meta:authors-string" class="style__AuthorLabel-sc-1i05riq-5 cahMIG">Author</span><span data-testid="hero:meta:authors-list" class="style__AuthorList-sc-1i05riq-6 lhDQAQ">mirageofpenguins</span></span></div><div class="style__Wrapper-sc-1wyuot3-0 fISwSO style__ShareBar-sc-1i05riq-7 dBMLAT"><ul class="style__List-sc-1wyuot3-1 bezFay"><li data-type="popup" class="style__Item-sc-1wyuot3-2 wqHZW icon-vk"><button class="style__Button-sc-1wyuot3-3 hpIdVI button" aria-label="Share on VK" data-testid="hero:meta:sharebar:button-icon-vk"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 192 113.9"><path class="st0" d="M187.6 7.6c1.3-4.5 0-7.6-6.3-7.6h-21c-5.4 0-7.8 2.8-9.1 6 0 0-10.6 26.1-25.8 42.8-4.9 4.9-7 6.4-9.7 6.4-1.3 0-3.3-1.5-3.3-6V7.6c0-5.4-1.5-7.6-6-7.6h-33C70.1 0 68 2.5 68 4.8c0 5.1 7.5 6.3 8.4 20.4v30.9c0 6.7-1.2 7.9-3.9 7.9-7 0-24.4-26.1-34.6-56-2.1-5.5-4-7.9-9.4-7.9h-21C1.5.1.3 2.9.3 6.1c0 5.5 7 33.1 33.1 69.5 17.4 24.9 41.8 38.3 64 38.3 13.3 0 15-3 15-8.1V86.9c0-6 1.2-7.2 5.5-7.2 3.1 0 8.4 1.5 20.8 13.5 14.2 14.2 16.6 20.7 24.6 20.7h21c6 0 9-3 7.2-8.8-1.9-5.8-8.7-14.4-17.7-24.6-4.9-5.8-12.3-12-14.4-15.1-3.1-4-2.2-5.8 0-9.3 0-.2 25.6-36.2 28.2-48.5z"/></svg></button></li><li data-type="popup" class="style__Item-sc-1wyuot3-2 wqHZW icon-fb"><button class="style__Button-sc-1wyuot3-3 hpIdVI button" aria-label="Share on Facebook" data-testid="hero:meta:sharebar:button-icon-fb"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 8.86 17.16"><path class="st0" d="M2.62 17.16v-.31-7.52-.1H.11C0 9.24 0 9.24 0 9.13V6.31c0-.09.03-.11.11-.11h2.51v-.09c0-.78 0-1.56.01-2.34.01-.63.13-1.24.4-1.81C3.4 1.2 3.99.64 4.78.32 5.31.09 5.87-.01 6.44 0c.65.01 1.31.04 1.96.06.12 0 .24.03.36.03.07 0 .09.03.09.1v2.54c0 .08-.02.1-.1.1-.5 0-.99-.01-1.49 0-.22.01-.45.04-.67.09-.43.09-.68.37-.76.8-.04.16-.06.34-.06.51-.01.64 0 1.27 0 1.91v.07h2.86c.12 0 .12 0 .11.11-.06.5-.13 1-.2 1.5l-.15 1.26c-.02.16-.02.16-.18.16H5.77V17.16H2.62z"/></svg></button></li><li data-type="popup" class="style__Item-sc-1wyuot3-2 wqHZW icon-tw"><button class="style__Button-sc-1wyuot3-3 hpIdVI button" aria-label="Share on Twitter" data-testid="hero:meta:sharebar:button-icon-tw"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 250 203.18"><path class="st0" d="M78.62 203.18c94.34 0 145.94-78.16 145.94-145.94 0-2.22-.05-4.43-.15-6.63A104.404 104.404 0 00250 24.05c-9.19 4.08-19.08 6.83-29.46 8.07 10.59-6.35 18.72-16.4 22.55-28.37a102.668 102.668 0 01-32.57 12.45C201.17 6.24 187.84 0 173.09 0c-28.33 0-51.3 22.97-51.3 51.29 0 4.03.45 7.94 1.33 11.69C80.5 60.84 42.69 40.43 17.4 9.39a51.123 51.123 0 00-6.95 25.78c0 17.8 9.06 33.5 22.82 42.69a50.874 50.874 0 01-23.23-6.42c-.01.21-.01.43-.01.65 0 24.84 17.68 45.58 41.15 50.28-4.31 1.17-8.84 1.8-13.52 1.8-3.3 0-6.52-.33-9.64-.93 6.53 20.38 25.46 35.21 47.92 35.62-17.56 13.76-39.67 21.96-63.7 21.96-4.14 0-8.22-.24-12.24-.71 22.7 14.58 49.65 23.07 78.62 23.07"/></svg></button></li><li data-type="new-window" class="style__Item-sc-1wyuot3-2 wqHZW icon-rd"><button class="style__Button-sc-1wyuot3-3 hpIdVI button" aria-label="Share on Reddit" data-testid="hero:meta:sharebar:button-icon-rd"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 24 20"><path class="st0" d="M24 9.78c0-1.46-1.19-2.65-2.66-2.65-.71 0-1.36.29-1.84.75-1.81-1.19-4.26-1.95-6.97-2.05l1.48-4.67 4.02.94c0 .02-.01.04-.01.06 0 1.19.98 2.16 2.17 2.16 1.2 0 2.17-.97 2.17-2.16C22.37.97 21.4 0 20.2 0c-.92 0-1.7.57-2.02 1.38L13.85.37a.364.364 0 00-.44.25l-1.65 5.21c-2.84.03-5.41.8-7.3 2.02a2.62 2.62 0 00-1.8-.71A2.642 2.642 0 000 9.78c0 .97.53 1.81 1.32 2.27-.05.28-.09.57-.09.86 0 3.91 4.81 7.09 10.72 7.09 5.91 0 10.72-3.18 10.72-7.09 0-.27-.03-.54-.08-.81.84-.45 1.41-1.32 1.41-2.32zM6.78 11.59a1.581 1.581 0 013.16 0c0 .87-.71 1.57-1.58 1.57s-1.58-.7-1.58-1.57zm9.06 4.67c-.8.79-2.05 1.18-3.82 1.18h-.01H12c-1.78 0-3.03-.39-3.82-1.18a.374.374 0 010-.52c.15-.14.38-.14.53 0 .65.65 1.73.96 3.3.96h.02c1.57 0 2.65-.31 3.3-.96.14-.15.38-.14.53 0 .12.14.12.38-.02.52zm-.19-3.09c-.87 0-1.58-.71-1.58-1.57a1.581 1.581 0 013.16 0c0 .86-.71 1.57-1.58 1.57z"/></svg></button></li><li data-type="popup" class="style__Item-sc-1wyuot3-2 wqHZW icon-line"><button class="style__Button-sc-1wyuot3-3 hpIdVI button" aria-label="Share on Line" data-testid="hero:meta:sharebar:button-icon-line"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 217 206.8"><path class="st0" d="M108.5 0C48.7 0 0 39.5 0 88c0 43.5 38.6 80 90.7 86.9 3.5.8 8.3 2.3 9.6 5.3 1.1 2.7.7 7 .3 9.8 0 0-1.3 7.7-1.5 9.3-.5 2.7-2.2 10.7 9.4 5.8 11.6-4.9 62.5-36.8 85.2-63C209.5 125 217 107.5 217 88c0-48.5-48.7-88-108.5-88zM70.2 114c0 1.2-.9 2.1-2.1 2.1H37.7c-.6 0-1.1-.2-1.5-.6-.4-.4-.6-.9-.6-1.5V66.7c0-1.2.9-2.1 2.1-2.1h7.6c1.2 0 2.1.9 2.1 2.1v37.5h20.7c1.2 0 2.1 1 2.1 2.2v7.6zm18.4 0c0 1.2-.9 2.1-2.1 2.1h-7.6c-1.2 0-2.1-.9-2.1-2.1V66.7c0-1.2.9-2.1 2.1-2.1h7.6c1.1 0 2.1.9 2.1 2.1V114zm52.1-47.3v47.1c0 1.2-.9 2.1-2.1 2.1H131c-.1 0-.3-.1-.5-.1h-.5l-.1-.1c-.2-.1-.4-.3-.5-.5l-21.7-29.3V114c0 1.2-.9 2.1-2.1 2.1H98c-1.2 0-2.1-.9-2.1-2.1V66.9c0-1.2.9-2.1 2.1-2.1H106.4c0 .1.1.1.1.1h.1c0 .1.1.1.1.1h.1l.1.1h.1l.1.1.1.1c.1.1.2.1.2.2l21.7 29.3V66.7c0-1.2.9-2.1 2.1-2.1h7.6c1.2 0 2.1.9 1.9 2.1zm42.3 7.6c0 1.2-.9 2.1-2.1 2.1l-20.7.1v8h20.7c1.2 0 2.1.9 2.1 2.1v7.6c0 1.2-.9 2.1-2.1 2.1h-20.7v8h20.7c1.2 0 2.1.9 2.1 2.1v7.6c0 1.2-.9 2.1-2.1 2.1h-30.4c-.6 0-1.1-.2-1.5-.6-.4-.4-.6-.9-.6-1.5V66.7c0-.6.2-1.1.6-1.5.4-.4.9-.6 1.5-.6h30.4c1.2 0 2.1.9 2.1 2.1v7.6z"/></svg></button></li><li data-type="clipboard" class="style__Item-sc-1wyuot3-2 wqHZW icon-lk"><button class="style__Button-sc-1wyuot3-3 hpIdVI button" aria-label="Copy Link" data-testid="hero:meta:sharebar:button-icon-lk"><svg xmlns="http://www.w3.org/2000/svg" viewbox="0 0 19 19"><path class="st0" d="M9.02 14.32c-.22-.06-.43-.15-.64-.24l-1.76 1.76c-.95.95-2.5.95-3.46 0-.95-.95-.95-2.5 0-3.46l3.46-3.46c.44-.44 1.02-.67 1.6-.7.27-.01.54.02.81.09.38.11.75.31 1.05.61.21.21.35.46.47.71.07-.06.15-.11.21-.17l1.6-1.6a4.28 4.28 0 00-.55-.66c-.41-.41-.86-.72-1.35-.95-.28-.14-.56-.24-.85-.32-1.11-.3-2.31-.19-3.37.31-.4.19-.78.44-1.12.74-.08.07-.16.14-.23.21l-3.46 3.46a4.895 4.895 0 000 6.92 4.895 4.895 0 006.92 0l3.28-3.28c-.85.24-1.76.26-2.61.03z"/><path class="st0" d="M17.57 1.43a4.895 4.895 0 00-6.92 0L7.54 4.54c.79-.19 1.63-.2 2.42.02.26.07.5.17.75.28l1.67-1.67c.95-.95 2.5-.95 3.46 0 .95.95.95 2.5 0 3.46l-3.46 3.46c-.44.45-1.02.67-1.6.7-.27.01-.54-.02-.81-.1-.38-.11-.75-.31-1.05-.61-.26-.27-.44-.6-.55-.93-.06.05-.13.09-.19.15l-1.65 1.65c.19.3.4.59.66.86.41.41.86.72 1.35.95a4.915 4.915 0 004.21 0c.4-.19.78-.44 1.12-.74.08-.07.16-.13.23-.21l3.46-3.46a4.886 4.886 0 00.01-6.92z"/></svg></button><span class="style__CopiedMessage-sc-1wyuot3-4 fUdegz message">Copied to clipboard</span></li></ul></div></div></div></div></div><div class="style__ResponsiveWrapper-yc5gg7-0 kpjNnV style__Section-i7k9d9-0-SectionArticleHtml jEPNOH type-article_html"><div class="style__Wrapper-sc-1wsvmz4-0 eEkUyE"><p><em>Disclaimer: This post is kinda tech-heavy and concerns anti-cheat tooling that won’t be exclusive to League of Legends. Other games (like Project A) will be protected by the referenced upgrade before LoL is.</em></p> <p>In a partnered study lasting approximately 8 years and backed by $20 million in federal funding, leading scientists managed to chronologically place the invention of cheating somewhere between 3.5 billion BCE and November 20th, 1985. While its precise origin remains indeterminate, one reality has become accepted as established fact: Cheaters gonna cheat.</p> <p>Over the last two decades, the development of cheats and the technology to prevent them have escalated from the honorable fight for control of game client memory into methods that attempt to modify the underlying operating system—or even the hardware—of a cheater’s machine. These techniques can compromise an anti-cheat’s ability to retrieve good data, and that effect is compounded if that anti-cheat has to run in user-mode.<br/></p> <h2><strong>What is user-mode?</strong></h2> <p>It describes a privilege level within an operating system, specifically the most restrictive tier software can run at. Your web browser, your legitimate copy of WinRAR, and your favorite games all run in user-mode. Within it, an application cannot directly “see outside” of itself, and instead, code must generally rely on OS’ native APIs to read or write memory not within its own process. Or to wrap that up in a semi-intelligible metaphor: We (in user-mode) have to ask the kitchen (Microsoft Windows) what’s been added to our beef goulash (League of Legends).<em/></p> <p style="text-align: center;"><em/><em><em>If you’ve ever heard some stable genius hit you with a “lol my cheat is ring 0 undetected,” this is what they were referring to right before they were banned.</em></em></p> <p><br/>In the last few years, cheat developers have started to leverage vulnerabilities or corrupt Windows’ signing verification to run their applications (or portions of them) at the kernel level. The problem here arises from the fact that <strong>code executing in kernel-mode can hook the very system calls we would rely on to retrieve our data, modifying the results to appear legitimate in a way we might have difficulty detecting.</strong> We’ve even seen specialized hardware utilizing DMA<sup>1</sup> to read and process system memory—a vector that, done perfectly, could be undetectable<sup>2</sup> from user-mode.</p> <p>Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk. <strong>So, an abundance of cheats currently run at a higher privilege level than our anti-cheat does</strong>. To put that in the terms of our immaculate kitchen analogy: When we ask the head chef if our goulash ingredients are actually farm-to-table, some random dude in a toque convinces restaurant management that he’s “got this,” and then replies to our request with a “sure my guy, dig in.”</p> <p><em><sup>1 </sup>DMA here refers to “Direct Memory Access,” a method by which a piece of hardware could, as you’ve probably suspected, directly access memory, windows API not required. Some of the more mature cheating communities <a href="https://blog.esea.net/esea-hardware-cheats/">have used it</a> to rebroadcast memory to a separate computer for later processing and ESP.</em></p> <p><em><sup>2</sup> We straight hired the guy that developed the technique to detect it.</em><br/></p> <h2><strong>Why are you telling me this?</strong></h2> <p>Well historically, your favorite anti-cheat team has been forced to play this game from the user-level, effectively giving cheaters a much-needed, twelve-stroke handicap. We haven’t needed both arms yet, primarily because we have the advantage of steady paychecks and the lack of strict bedtimes at our immediate disposal. But as much as we might like the idea of an ever-escalating appsec war with teenagers, we’re now entering a <a href="https://www.youtube.com/watch?v=h4FGqymg4k4&amp;t=1876s">multi-game universe</a> where linear time and sleep deficits will make this particular strategy untenable.</p> <p>This is why <strong>some of Riot’s future titles will be protected by a kernel driver</strong>.</p>