hi this is my first post here, nice community
I'm currently trying to make an anticheat program for a game. basically what I have done is just placing hooks in some winAPI functions.
I'm not very experienced with a lot of things, but I have no inconvenient in developing it slowly, because by the way I will be learning anyway. What I would like to know, is if anybody can tell me about what the topic's title says, and it is about how to prevent a hack program from patching my memory or the game's memory. Consider this, my anticheat program will be injected into the game as a module, for example "myanticheat.dll". from there I want to prevent any hack program from patching in the game's code and data sections.
I really don't know if this has to do with sections access permissions or if it has to do with memory read/writing permissions, I really don't have much idea, but I would like if anybody can tell me a bit about all this. I would really appreciate it, since as you see I am dedicating some time to this program.

nya ("http://www.woodmann.com/forum/showthread.php?14987-Defeating-Memory-Breakpoints&p=93671&highlight=#post93671")

This is good for protecting the image. But for games the game memory being patched is usually in the heap or allocated memory.

I am also writing an anticheat for a friend's game that is being hacked excessively. So far I think the only way to consistently prevent Read/WriteProcessMemory from working is to code a driver. It's a tough problem, if anyone has any suggestions I would be open to them.

Private memory(R|E, heap etc) can be protected ^.

You can always change memory. For example from the kernel.



Block manipulation the process handle(NtOpenProcess/NtDuplicateObject and lower).

Against scrap no way .. if no other scrap.

Discussed on rk:

looks like you are trying to prevent some external programs from having access to the game's process. In that case you can try to hook LdrLoadDll, or if you already have a driver you can block other processes from using some low level functions over your game (kernelmode hook?).
http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/Executable%20Images/LdrLoadDll.html
I don't have a driver, I don't want to use that atm. I would prefer to make this in usermode for now.
As I saw that always hackers manage to load a dll and make it invisible, I would like to establish a detection that will tell me if anything has modified the memory, code section, for example game.exe.

EDIT (google translation):


I was taking a look to a lot of information but I just want to implement some idea very direct to deal with this problem.
http://en.wikipedia.org/wiki/Memory_protection
http://en.wikipedia.org/wiki/Critical_section
http://en.wikipedia.org/wiki/Memory_segmentation
http://en.wikipedia.org/wiki/Self-modifying_code
http://technet.microsoft.com/en-us/library/cc700810.aspx
http://stackoverflow.com/questions/3444052/can-i-write-protect-every-page-in-the-address-space-of-a-linux-process
http://msdn.microsoft.com/en-us/library/windows/desktop/aa366785(v=vs.85).aspx
http://msdn.microsoft.com/en-us/library/windows/hardware/gg487353.aspx
http://computervirus.uw.hu/ch12lev1sec6.html
http://www.cs.gmu.edu/~xjiang/pubs/DSN07.pdf
http://static.usenix.org/event/sec09/tech/full_papers/hund.pdf

if cheaters/hackers can load a dll to your game, they will attempt to patch game's memory from that DLL. most of the cases, they try to patch the anticheats' anti-patch detections, so they will be never detected by the anticheat program.
Said anticheat is injected in the game's process, it is now a module in that process (anticheat.dll).

at the moment, I don't care if they can use a dll loader or whatever, I assume they have just loaded the dll and will attempt to patch in the process.

from ring3, you know a way to detect this or prevent this?

for example using virtualprotect, I can hook virtualprotect to prevent them from using it, what else?

Driver is useless. Kernel manipulates pointers, not handles for eg.


Verify the checksum ?


The patch is not necessary.


You can prevent modify the attributes(UM only). As was said in the beginning.

You can prevent patching of the game executable with excessive amounts of checksums. This I already have. The problem is the game memory being modified with programs that use WriteProcessMemory/ReadProcessMemory. So far, the only way to prevent this (that I can see) is to use a driver. So I wouldn't say driver is "useless".

checksums of what? functions? blocks of code? can you show me an example of what you have? I mean not your entire project, just tell me how can I do that.
http://en.wikipedia.org/wiki/Checksum
I saw something like this before, applied for files on disk. For example, using crc32 algo to get a hash out of a file on disk, then you check if the file is the correct before opening the program (a .txt file,, whatever).
you think I can apply crc in functions code in memory? or perhaps blocks of code in memory?

And getting to memory modification again, if the hack program uses read/write process memory, but if you prevent them from using VirtualProtect by hooking it?.

And regarding your previous answer, you mean to use VP to set page protection level?
http://msdn.microsoft.com/en-us/library/windows/desktop/aa366786(v=vs.85).aspx

http://msdn.microsoft.com/en-us/library/sf9b18xk.aspx
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0491c/Caccache.html
http://stackoverflow.com/questions/6252812/what-does-the-aw-flag-in-the-section-attribute-mean
http://en.wikipedia.org/wiki/Page_attribute_table
http://www.delorie.com/djgpp/doc/dpmi/api/310507.html

rendari
The checksum is only possible for the code. The data can not be protected. See IDP eg. Intercept control is based on the data. The code remains unchanged.

Paradigm

Sections of code(also relocs & IAT).


No. Syscall(Int 0x2e eg) can call directly. R|E map is protected from being overwritten.

The best method of protection - virtualization and morphing.

Hello Paradigm,

Ideally you want to do checksums of the code at runtime. You can do this by getting a pointer to a function at runtime, and checksumming the memory at runtime, and then comparing it to an embedded 'correct' checksum. You will need to compensate for relocations if your application was compiled with 'Randomized Base Address' option in Visual Studio.

@Indy: I realize that the data cannot be protected with checksums. This is why I am looking for suggestions on how to protect it otherwise. Like I said before, all I have come up with is using a driver to block access to the process. I do not understand what you mean with this:



Could you please clarify?

-rendari

Rendari what kind of checksum can it be? crc?

virtualization of code is easily patched in the 'jmp to vm' place?, someone told me.

Indy, so my best chance is this (R|E map)?
http://www.woodmann.com/forum/showthread.php?14987-Defeating-Memory-Breakpoints&p=93671&highlight=#post93671

because virtualization and morphing, I'm not thinking of that right now

So all is useless. Any other protection is primitive

Indy you lack answer to rendari