Next Level Cheating and Leveling Up Mitigations
summary
Shows a working proof‑of‑concept dual‑mapped kernel driver that maps game pages into a cheat process so ReadProcessMemory/WriteProcessMemory are unnecessary and user‑mode anti‑cheats become blind; demo reads a notepad buffer in real time. Discloses a BattleEye sign‑extension bug that yields immediate DoS and possible RCE via oversized heap copy, and a timing side‑channel that cracks a 24‑character admin password in 17 minutes. Requires kernel load/test‑signing and shifts the arms race to kernel.
AI-written summary · about
chapters (18)
- 0:00Intro
- 2:48The Money Aspect
- 4:12What is Cheating?
- 5:35A History of Cheating
- 6:40Common Cheating Vectors
- 11:17The Current State of Cheating in Games
- 14:30Current State of Anti-Cheat
- 18:17The Future of Cheating
- 21:12Dual mapping snippet
- 26:40Attacking Anti-Cheat Software
- 27:50BE Packet structure
- 28:12Sign extension
- 29:39Exploitability
- 30:57BattlEye console timing attack
- 35:09BattlEye timing attack demo
- 36:19The Future of Anti-Cheat
- 39:01Conclusion
- 39:55Follow-up
related talks
47mNext Level Cheating and Leveling Up Mitigations
41mUnveiling the Underground World of Anti-Cheats
38mBypassing Anti-Cheats & Hacking Competitive Games
51mExploiting Hardware Glitches And Side Channels In Perfect Software
29mGame Console Security and Implications on General Computing
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
33mByepervisor: How We Broke The PS5 Hypervisor
43mUsing Undocumented CPU Behavior to See Into Kernel Mode and Break KASLR in the Process