Why is this AI slop here? The "author" deleted his twitter account and added the disclaimer at the top of this post that it's all written by AI and he's not an actual "programmer or reverse engineer". The fact that…
An interpreter for a machine language is usually just called an emulator.
I'm pretty sure it's just a small mistake in the article on the exact syscall used to query the token information. Checked a kernel from November 2024 vs a current one and from I can tell, this used to be the actual…
SRW lock uses the WaitOnAddress primitives nowadays, not keyed events.
> The anti-tamper codes, if any tampering is detected will crash on undefined/unallocated regions. That's basically the whole point of any anti-tamper product. I just think you picked a terrible example of a feature…
> those global variables... What about them? In a 500 loc app there is no practical difference and there's only ~20 of them with clear purpose. > Use std::string <...> or std::list <...> remove all the malloc, etc >…
The actual code in the repo definitely compiles to less than 10k. The rest is bloat from linking CRT statically.
> Are they able to load a .so/dylib file during runtime and just call a method on it as long as they know the name of the method? Yes, usually that's the entire point of an .so/.dylib/.dll - to load it and call it's…
Showing a 5000$ bounty example of "enumerating all apps" sounds a bit disingenuous when this is more of a "check if this exact app by bundle name was installed not through store. I also don't think that this deserves to…
> Also, it would be silly to bottleneck your protocol implementation benchmark on encryption that would be shared amongst implementations because that does not highlight your overhead advantages It would be great if…
You're missing the fact that there is basically no bug here. All this does is: * Store data in a database. * Kill AV software provided you have admin privileges. The latter might be remediated by MS down the line, but…
Because this has no actual value for anyone and MS would (did?) ignore him.
> WDYM? The root cause is "you passed ownership to stack-based memory to the kernel and didn't ensure it's valid when it called you back", why would "consent of lower frames" matter here? There is no "called back" in…
> The problem boils down to usage of stack memory after the memory is given to somebody else. While this isn't incorrect in this case the problem seems to be caused by stack unwinding without the consent of lower frames…
> You can do DMA cheating if that’s a non-negotiable for you but it is far more expensive. Cheap DMA cards go for couple hundred dollars which isn't all that much. Although unlike what most people tend to believe, the…
> That seems like something that would be solvable with location-style differential privacy. Report a number of plausible locations to the client small enough that it can efficiently anticipate them all, but large…
> Maybe because everyone else in "security" and DRM does it, so they figured this is how it's done and they should do it too? What DRM uses kernel drivers? And how do you plan to prevent malware from usermode?
it was the game itself that got exploited, not the anti-cheat that is a "rootkit".
> In x64 compilers The default is omission. If you have a Windows machine, in all likelihood almost no 64 bit code running on it has frame pointers. > OR is there some magic in the pdata section that makes it work even…
If you're talking about the blog, it's an open source Zola theme https://github.com/not-matthias/apollo (the original site https://secret.club which it's based on/inspired by is closed source though)
> No anticheat, kernel mode or not, has come even close to that. The situation has remained mostly unchanged for at least a decade now. While the situation has mostly "unchanged" from the perspective of the end-user,…
> Do you want to know how popular systems are actually built, from the inside, or do you want carefully groomed triumphal announcements of new, perfectly-formed features? IMO both this and "announcements of new,…
Sorry, I probably didn't phrase it very clearly. I don't think there is anything wrong with needing some external help for that, but the combination of their choices is IMO a bit bizarre: * SQLite which I mostly see as…
So to recap their timeline: * Instead of an actual database use a JSON file. * Write a blog post about how that didn't scale. * Instead of an actual database hand-roll something else. * Write a blog post about how that…
> More like UAF ? Also, you can't. That was the idea. But it seems a bad one, according to you and user rom1v. Well in your code if you bft_free OWN with outstanding REFs, nothing happens and the bft_free on last REF…
Why is this AI slop here? The "author" deleted his twitter account and added the disclaimer at the top of this post that it's all written by AI and he's not an actual "programmer or reverse engineer". The fact that…
An interpreter for a machine language is usually just called an emulator.
I'm pretty sure it's just a small mistake in the article on the exact syscall used to query the token information. Checked a kernel from November 2024 vs a current one and from I can tell, this used to be the actual…
SRW lock uses the WaitOnAddress primitives nowadays, not keyed events.
> The anti-tamper codes, if any tampering is detected will crash on undefined/unallocated regions. That's basically the whole point of any anti-tamper product. I just think you picked a terrible example of a feature…
> those global variables... What about them? In a 500 loc app there is no practical difference and there's only ~20 of them with clear purpose. > Use std::string <...> or std::list <...> remove all the malloc, etc >…
The actual code in the repo definitely compiles to less than 10k. The rest is bloat from linking CRT statically.
> Are they able to load a .so/dylib file during runtime and just call a method on it as long as they know the name of the method? Yes, usually that's the entire point of an .so/.dylib/.dll - to load it and call it's…
Showing a 5000$ bounty example of "enumerating all apps" sounds a bit disingenuous when this is more of a "check if this exact app by bundle name was installed not through store. I also don't think that this deserves to…
> Also, it would be silly to bottleneck your protocol implementation benchmark on encryption that would be shared amongst implementations because that does not highlight your overhead advantages It would be great if…
You're missing the fact that there is basically no bug here. All this does is: * Store data in a database. * Kill AV software provided you have admin privileges. The latter might be remediated by MS down the line, but…
Because this has no actual value for anyone and MS would (did?) ignore him.
> WDYM? The root cause is "you passed ownership to stack-based memory to the kernel and didn't ensure it's valid when it called you back", why would "consent of lower frames" matter here? There is no "called back" in…
> The problem boils down to usage of stack memory after the memory is given to somebody else. While this isn't incorrect in this case the problem seems to be caused by stack unwinding without the consent of lower frames…
> You can do DMA cheating if that’s a non-negotiable for you but it is far more expensive. Cheap DMA cards go for couple hundred dollars which isn't all that much. Although unlike what most people tend to believe, the…
> That seems like something that would be solvable with location-style differential privacy. Report a number of plausible locations to the client small enough that it can efficiently anticipate them all, but large…
> Maybe because everyone else in "security" and DRM does it, so they figured this is how it's done and they should do it too? What DRM uses kernel drivers? And how do you plan to prevent malware from usermode?
it was the game itself that got exploited, not the anti-cheat that is a "rootkit".
> In x64 compilers The default is omission. If you have a Windows machine, in all likelihood almost no 64 bit code running on it has frame pointers. > OR is there some magic in the pdata section that makes it work even…
If you're talking about the blog, it's an open source Zola theme https://github.com/not-matthias/apollo (the original site https://secret.club which it's based on/inspired by is closed source though)
> No anticheat, kernel mode or not, has come even close to that. The situation has remained mostly unchanged for at least a decade now. While the situation has mostly "unchanged" from the perspective of the end-user,…
> Do you want to know how popular systems are actually built, from the inside, or do you want carefully groomed triumphal announcements of new, perfectly-formed features? IMO both this and "announcements of new,…
Sorry, I probably didn't phrase it very clearly. I don't think there is anything wrong with needing some external help for that, but the combination of their choices is IMO a bit bizarre: * SQLite which I mostly see as…
So to recap their timeline: * Instead of an actual database use a JSON file. * Write a blog post about how that didn't scale. * Instead of an actual database hand-roll something else. * Write a blog post about how that…
> More like UAF ? Also, you can't. That was the idea. But it seems a bad one, according to you and user rom1v. Well in your code if you bft_free OWN with outstanding REFs, nothing happens and the bft_free on last REF…