0

How does one find out if a game uses KernelMode anti cheat or UserMode?

For example the Game Black Desert Online uses Xigncode.

If i google a bit about Xigncode i immediately find out that:

"Xigncode uses a driver called xhunter1.sys. to protect" -> KernelMode

What Tools and Steps are used by the people to determine this?

2

There is not a single Anti Cheat(AC) I am aware of that is kernel mode without using ObRegisterCallbacks to block access to the process. In fact a good number of the AC drivers I've looked at are nothing more than these callbacks and, sometimes, kernel pattern scans. Nearly every kernel mode AC will also have an IOCTL pipe that's pretty obvious (e.g \Device\AcName). No kernel AC is going to hide themselves, using a tool like Driver List should also be obvious. Many will also use DbgLog in DriverEntry which you can see with DebugView using kernel capture. They will also almost universally be signed with a certificate matching the AC name. I guess the best answer to this is just to use generic tools to look through loaded drivers, it's typically very obvious if an AC driver is loaded.

  • 1
    That "IOCTL pipe" is called a device object, by the way ;) – 0xC0000022L Dec 5 at 15:00
0

Not my area, but maybe this is useful until someone who knows more about it comes along. The easiest way I can think of is using the driverquery command to list loaded drivers. It should stand out based on the description. You could also reverse the engine to see how it works, which is probably harder than it sounds. If for example you can determine that it injects a DLL into the game process (the tools to verify this could possibly flag the anti-cheat), you can dump the DLL with something like ProcessHacker and look for DeviceIoControl in the export table. This would be a clear giveaway of driver comms.

You might find some useful info on the topic at:

https://www.unknowncheats.me

https://guidedhacking.com

  • You probably mean in the import table. And that could easily be foiled by looking up the function dynamically. Besides, an NT native API exists which could also be used in its stead (and in fact underlies the Win32 DeviceIoControl function). – 0xC0000022L Dec 6 at 8:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.