1. An Introduction to Online-Game Hacks, From a Technical Perspective Zuan@chroot.org

2. EULA 3. Live Demo 4. Who am I? 2006 Cheat Engine Forum, Underground , nProtect GameGuard (rev641~12xx) MzBot 5. Who am I? , , , chr00t 2010 2013 International Future Energy Challenge Grand Prize 6. 7. 1. 8. 2. 9. - 10. 11. ) 12. ) ? ? 13. 14. AutoIt, Sikuli, ACTools 15. / 16. 17. One API to rule them all 18. SendInput() 19. UINT WINAPI SendInput( _In_ UINT nInputs, _In_ LPINPUT pInputs, _In_ int cbSize ); 20. INPUT inp[2]; inp[0].type = inp[1].type = INPUT_KEYBOARD; inp[0].ki.wScan = inp[1].ki.wScan = 0; inp[0].ki.time = inp[1].ki.time = 0; inp[0].ki.dwExtraInfo = 0; inp[1].ki.dwExtraInfo = 0; inp[0].ki.wVk = inp[1].ki.wVk = VK_RETURN; inp[0].ki.dwFlags = 0; inp[1].ki.dwFlags = KEYEVENTF_KEYUP; SendInput( 2, inp, sizeof(INPUT) ); 21. GetDC(), GetPixel(), bitblt() 22. HDC GetDC( _In_ HWND hWnd ); COLORREF GetPixel( _In_ HDC hdc, _In_ int nXPos, _In_ int nYPos ); 23. HDC hDC = GetDC( NULL ); COLORREF color = GetPixel( hDC, x, y ); 24. 25. ? ? 26. : A, B, A 9999 OS: ! ~ : 50+/-15 A = 56 A +xx 27. A A 28. 1. ? 2. ? 3. ? 29. 1) ? 2) 3) ? (CPU/ ) 30. 31. 32. rand() 33. = +rand()%5 34. xkcd 221: http://xkcd.com/221/ 35. rand() Replay 36. vs. 37. 38. API NDIS Passthrough 39. // From OdinMS 40. 41. 42. ? ? ? 43. 44. EXE 45. 46. 47. 48. (Assembly Language) 49. EAX EBX ECX EDX ESI EDI EBP ESP EIP EFLAGS 50. MOV , ( ) MOV EAX, EBX => EAX = EBX; MOV EAX, [0x005C] => EAX = *((int*)0x005C); ADD , ( ) ADD ECX, 5 => ECX += 5; ADD ECX, [x] => ECX += x; SUB, XOR, OR, AND... , 51. CMP A, B ( A B, FLAGS) CMP EAX, 5 CMP ECX, EDX JMP ( ) JMP 0x7FFE0300 JE ( , A==B, ) JE 0x00401753 JNE, JGE, JG, JL, JLE... C F P F A F Z F S F 52. if ( x == 3 ) { // ooo } else { // xxx } MOV EAX, [x] CMP EAX, 3 JNE NEXT ; ooo JMP END NEXT: ; xxx END: 53. ... :0x080 ... :0x07C ... :0x078 ... :0x074 ... :0x070 ... :0x06C ... :0x068 ... :0x064 ESP 54. PUSH ( Push ) PUSH 5 => ESP-=4; *((int*)ESP)=5; PUSH EAX => ESP-=4; *((int*)ESP)=EAX; POP ( Pop ) POP EAX => EAX=*((int*)ESP); ESP+=4; CALL ( ) CALL 0x004027A0 => PUSH EIP, JMP 0x004027A0 RET ( Return) RET => POP EIP 55. :0x080 EBP :0x07C RET :0x078 :0x074 :0x070 :0x06C :0x068 :0x064 ESP 56. 57. Intel Google 58. Intel 64 and IA-32 Architectures Software Developer's Manual 59. EXE ? 60. : IDA Pro : OllyDbg Cheat Engine 61. IDA Pro 62. OllyDbg 63. OllyDbg IDA 64. 65. Break , 66. , 67. 68. Cheat Engine 69. Player.health--; ... DEC [EBX+047C] ... ... NOP ... 70. ... DEC [EBX+047C] ... ... FF 8B 7C 04 00 00 ... ... NOP NOP NOP NOP NOP NOP ... ... 90 90 90 90 90 90 ... 71. ... DEC [EBX+047C] ... ... FF 8B 7C 04 00 00 ... ... NOP NOP NOP NOP NOP NOP ... ... 90 90 90 90 90 90 ... 72. if ( Player.ID != 1 ) { Player.health--; } ... MOV EAX, [EBX+010] CMP EAX, 1 JE END DEC [EBX+047C] END: ... 73. Code Injection 74. alloc(newmem,2048) label(returnhere) label(originalcode) label(exit) Newmem: mov EAX, [EBX+010] cmp EAX, 1 je END dec [EBX+047C] end: jmp returnhere 00426E99: jmp newmem nop returnhere: 75. ... 00426E99: DEC [EBX+047C] ... ... 00426E99: JMP Newmem ... Newmem: mov EAX, [EBX+010] cmp EAX, 1 je END dec [EBX+047C] end: jmp returnhere 76. CE Low 77. 0x00000000 0xFFFFFFFF .exe 0x00000000 0xFFFFFFFF .exe explorer.exe 0x00000000 0xFFFFFFFF ... ... 78. 1. Windows API 2. DLL Injection 79. OpenProcess() ReadProcessMemory() WriteProcessMemory() 80. DLL Injection 81. 0x00000000 0xFFFFFFFF .exe 0x00000000 0xFFFFFFFF .exe explorer.exe 0x00000000 0xFFFFFFFF ... ... .DLL 82. int main( int argc, char** argv ) int CALLBACK WinMain( HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow ) BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved ) 83. BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved ) { if ( fwdReason == DLL_PROCESS_ATTACH ) { CreateThread( ... ); } return TRUE; }; 84. 00426E99: nop nop nop ((unsigned char*)0x00426E99) = 0x90; ((unsigned char*)0x00426E9A) = 0x90; ((unsigned char*)0x00426E9B) = 0x90; 85. LPVOID WINAPI VirtualAlloc( _In_opt_ LPVOID lpAddress, _In_ SIZE_T dwSize, _In_ DWORD flAllocationType, _In_ DWORD flProtect ); unsigned char *mem = VirtualAlloc( NULL, 2048, MEM_COMMIT, PAGE_EXECUTE_READWRITE ); mem[0] = ...; 86. DLL 87. 1. Cheat Engine 2. WriteProcessMemory + CreateRemoteThread 3. Target IAT 88. 89. ? 90. (Packer) 91. PE Header .text .data .rsrc Entry Point ( ) 92. PE Header .text .data .rsrc Packer Entry Point ( ) 93. : UPX, ASPack... etc 94. Armadillo 2003 OEP OEP Anti-Debugging 95. Anti-Debugging Olly Plugin ( StrongOD) 96. ASProtect 2006 IAT Stolen Code 97. DLL : CALL printf printf: jmp xxxx DLL : CALL printf printf: jmp 10A0573C 98. : CALL FunctionA FunctionA: jmp Packer_FunctionA Packer_FunctionA: 99. Import Reconstructor 100. OEP: PUSH XXX PUSH XXX CALL XXX XOR EBX, EBX PUSH EBX MOV EDI, [GetModuleHandleA] CALL EDI ... 101. Themida/VMProtect 2008 VM 102. 103. 1. 2. 104. 105. .exe User mode (Ring 3) Kernel mode (Ring 0) ntoskrnl.exe Kernel32.dll User32.dll GDI32.dll ntdll.dll SSDT 106. Kernel32.dll OpenProcess() ReadProcessMemory() WriteProcessMemory() VirtualAlloc() CreateThread() TerminateProcess() User32.dll CreateWindow() PostMessage() SendInput() GetDC() GDI32.dll bitblt() 107. Detour Hook IAT Hook 108. ... call SendInputA ... SendInputA: jmp xxxx IAT Hook 109. Detour Hook Code Injection 110. SendInputA: push ebp mov ebp, esp ... Detour Hook SendInputA: jmp xxx ... 111. .exe User mode (Ring 3) Kernel mode (Ring 0) ntoskrnl.exe Kernel32.dll User32.dll GDI32.dll ntdll.dll SSDT Detour/IAT Hook Detour/IAT Hook 112. SSDT Hook 113. typedef void(*FuncPtr)( ); FuncPtr SSDT[xxx] = { KernelFunction1, KernelFunction2, } void onSysenter( int callID, ) { (SSDT[callID])( ); } 114. .exe User mode (Ring 3) Kernel mode (Ring 0) ntoskrnl.exe Kernel32.dll User32.dll GDI32.dll ntdll.dll SSDT SSDT Hook 115. Detour Hook in Kernel 116. .exe User mode (Ring 3) Kernel mode (Ring 0) ntoskrnl.exe Kernel32.dll User32.dll GDI32.dll ntdll.dll SSDT Detour Hook 117. Kernel Hook 118. DDK Driver Development Kit 119. 120. 121. 122. Cheat Engine, UCE Undetected Cheat Engine 123. 124. const char* var =xxx; funcA( xxx ); 125. DLL Export 126. __declspec(dllexport) void __cdecl Function1(void); 127. strings 128. , 129. ? 130. 131. 132. 1. x64 2. 133. x86 32 Windows 134. 64 Windows 135. 64-bit Vista 136. 1. 2. PatchGuard 137. 138. 139. PatchGuard 140. SSDT Ntoskrnl.exe GDT&IDT MSR 141. M$: , 142. Kaspersky :... McAfee :... 143. x64 , 144. 145. One Microsoft Way Redmond, WA 98052-7329 USA 146. 147. One Microsoft Way , 148. 149. VMWare, VirtualBox 150. 151. Intel VT-x AMD-V 152. Host OS Guest OS 153. Host OS Guest OS 154. DTDebug Ddvp 155. Cheat Engine 156. 157. 158. 159. 1. 2. 3. Paper 160. http://hitcon.org/ 161. Q & A