Metin2 AntiCheat ClientSide Source

[Ionut Barbescu]

AntiCheat Plugin ClientSide​

A client-sided anti-cheat developed during a freelance project to "plug-in" to a proprietary client for a private server. Includes memory integrity checks, thread execution restrictions, hook detection, memory honeypots, and more.
​

*Memory Integrity Check​

Gathers a collection of memory pages initially within the game's module (anticheat::cheat_monitor::init) and generates a CRC32 hash based on the memory contents of each page (calc_vpt_hashes) - each validated every cycle (anticheat::cheat_monitor::check_pages).

*Thread Blocking​

Hooks RtlUserThreadStart and checks if the designated address of execution for the thread is within the correct memory bounds. In this case, it is called "image-only execution", where only threads within the primary image (and some other excluded images such as ucrtbased.dll) are allowed to have threads run. If a thread is running outside of these bounds then it is detected as malicious inside an invalid execution space. This also prevents debuggers from attaching the process since RtlUserThreadStart is executed before DbgUiRemoteBreakIn is called which executes outside of the secure boundaries.

*Memory Honeypots​

Memory honeypots are created within the init routine, where memory pages aren't yet accessed, but when they are (which they shouldn't be), it is detected. Prevents "cheat" scanners.

*Anti-Debugging​

Checks the PEB directly (instead of using IsDebuggerPresent, which can be easily looked up) for the value of the BeingDebugged flag as well as the value of NtGlobalFlag. Prone to just directly modifying the BeingDebugged flag to bypass this check though. DbgUiRemoteBreakIn is blocked because debug threads can't be executed in the process (DebugActiveProcess executes a thread within the process, but our process has memory bounds checking, simplified when thread scanning is mentioned.)

TBA: Arbitrary Vectored Exception Handling Detection

*Protected Functions​

Similar in concept to a memory integrity check, but specifically detects if Winsock routines designated as "protected" are hooked/modified, preventing user-mode packet modification and reading by software such as WPE Pro and rPE.

*Process Scanner​

Scans each process based on the contents (process name, window name) and unique memory signature.

*Module Scanner​

Scans the loaded modules in the process for any with blacklisted names.

TBA: Signature scanning

DOWNLOAD

To view the content, you need to Sign In or Register.

​

For OnForum.Net with ​

 

[udvozlegy]

Thanks for sharing that! I'm looking for the best solutions

 

[Bohemian]

Wow, thanks for making it available, that's what I was looking for

 

[imanol]

AntiCheat Plugin ClientSide​

A client-sided anti-cheat developed during a freelance project to "plug-in" to a proprietary client for a private server. Includes memory integrity checks, thread execution restrictions, hook detection, memory honeypots, and more.
​

*Memory Integrity Check​

Gathers a collection of memory pages initially within the game's module (anticheat::cheat_monitor::init) and generates a CRC32 hash based on the memory contents of each page (calc_vpt_hashes) - each validated every cycle (anticheat::cheat_monitor::check_pages).

*Thread Blocking​

Hooks RtlUserThreadStart and checks if the designated address of execution for the thread is within the correct memory bounds. In this case, it is called "image-only execution", where only threads within the primary image (and some other excluded images such as ucrtbased.dll) are allowed to have threads run. If a thread is running outside of these bounds then it is detected as malicious inside an invalid execution space. This also prevents debuggers from attaching the process since RtlUserThreadStart is executed before DbgUiRemoteBreakIn is called which executes outside of the secure boundaries.

*Memory Honeypots​

Memory honeypots are created within the init routine, where memory pages aren't yet accessed, but when they are (which they shouldn't be), it is detected. Prevents "cheat" scanners.

*Anti-Debugging​

Checks the PEB directly (instead of using IsDebuggerPresent, which can be easily looked up) for the value of the BeingDebugged flag as well as the value of NtGlobalFlag. Prone to just directly modifying the BeingDebugged flag to bypass this check though. DbgUiRemoteBreakIn is blocked because debug threads can't be executed in the process (DebugActiveProcess executes a thread within the process, but our process has memory bounds checking, simplified when thread scanning is mentioned.)

TBA: Arbitrary Vectored Exception Handling Detection

*Protected Functions​

Similar in concept to a memory integrity check, but specifically detects if Winsock routines designated as "protected" are hooked/modified, preventing user-mode packet modification and reading by software such as WPE Pro and rPE.

*Process Scanner​

Scans each process based on the contents (process name, window name) and unique memory signature.

*Module Scanner​

Scans the loaded modules in the process for any with blacklisted names.

TBA: Signature scanning

DOWNLOAD

*** Hidden text: cannot be quoted. ***

​

For OnForum.Net with ​

thanks for share i will try it

 

[.Moon]

thanks for share i will try it

 

[wish3r]

Ok, let's try soon. Thank you! Anti cheat test

 

[thiagosaliba]

fuck fuck fuck fuck fuck metrics shits

 

[BaalaaN]

Thank you brother, I will use it for studies!

 

[jeffzkie69]

AntiCheat Plugin ClientSide​

A client-sided anti-cheat developed during a freelance project to "plug-in" to a proprietary client for a private server. Includes memory integrity checks, thread execution restrictions, hook detection, memory honeypots, and more.
​

*Memory Integrity Check​

Gathers a collection of memory pages initially within the game's module (anticheat::cheat_monitor::init) and generates a CRC32 hash based on the memory contents of each page (calc_vpt_hashes) - each validated every cycle (anticheat::cheat_monitor::check_pages).

*Thread Blocking​

Hooks RtlUserThreadStart and checks if the designated address of execution for the thread is within the correct memory bounds. In this case, it is called "image-only execution", where only threads within the primary image (and some other excluded images such as ucrtbased.dll) are allowed to have threads run. If a thread is running outside of these bounds then it is detected as malicious inside an invalid execution space. This also prevents debuggers from attaching the process since RtlUserThreadStart is executed before DbgUiRemoteBreakIn is called which executes outside of the secure boundaries.

*Memory Honeypots​

Memory honeypots are created within the init routine, where memory pages aren't yet accessed, but when they are (which they shouldn't be), it is detected. Prevents "cheat" scanners.

*Anti-Debugging​

Checks the PEB directly (instead of using IsDebuggerPresent, which can be easily looked up) for the value of the BeingDebugged flag as well as the value of NtGlobalFlag. Prone to just directly modifying the BeingDebugged flag to bypass this check though. DbgUiRemoteBreakIn is blocked because debug threads can't be executed in the process (DebugActiveProcess executes a thread within the process, but our process has memory bounds checking, simplified when thread scanning is mentioned.)

TBA: Arbitrary Vectored Exception Handling Detection

*Protected Functions​

Similar in concept to a memory integrity check, but specifically detects if Winsock routines designated as "protected" are hooked/modified, preventing user-mode packet modification and reading by software such as WPE Pro and rPE.

*Process Scanner​

Scans each process based on the contents (process name, window name) and unique memory signature.

*Module Scanner​

Scans the loaded modules in the process for any with blacklisted names.

TBA: Signature scanning

DOWNLOAD

*** Hidden text: cannot be quoted. ***

​

For OnForum.Net with ​

thank you so much i will try this....

 

[eg0ix]

Thank you for sharing, I hope it works!

 

[enixtr]

Thanks for sharing, I need to see if it works.

 

[TheGosr]

thanks for share i will try it

 

[מֹושִׁיעַ משה]

Thank you for sharing, I hope it works. Has anyone tested it yet?

 

[מֹושִׁיעַ משה]

Thank you for sharing, I hope it works. Has anyone tested it yet?

.
.
.
I noticed it's for credit, so thank you, I don't want it.

 

[kerekesmark23]

AntiCheat Plugin ClientSide​

A client-sided anti-cheat developed during a freelance project to "plug-in" to a proprietary client for a private server. Includes memory integrity checks, thread execution restrictions, hook detection, memory honeypots, and more.
​

*Memory Integrity Check​

Gathers a collection of memory pages initially within the game's module (anticheat::cheat_monitor::init) and generates a CRC32 hash based on the memory contents of each page (calc_vpt_hashes) - each validated every cycle (anticheat::cheat_monitor::check_pages).

*Thread Blocking​

Hooks RtlUserThreadStart and checks if the designated address of execution for the thread is within the correct memory bounds. In this case, it is called "image-only execution", where only threads within the primary image (and some other excluded images such as ucrtbased.dll) are allowed to have threads run. If a thread is running outside of these bounds then it is detected as malicious inside an invalid execution space. This also prevents debuggers from attaching the process since RtlUserThreadStart is executed before DbgUiRemoteBreakIn is called which executes outside of the secure boundaries.

*Memory Honeypots​

Memory honeypots are created within the init routine, where memory pages aren't yet accessed, but when they are (which they shouldn't be), it is detected. Prevents "cheat" scanners.

*Anti-Debugging​

Checks the PEB directly (instead of using IsDebuggerPresent, which can be easily looked up) for the value of the BeingDebugged flag as well as the value of NtGlobalFlag. Prone to just directly modifying the BeingDebugged flag to bypass this check though. DbgUiRemoteBreakIn is blocked because debug threads can't be executed in the process (DebugActiveProcess executes a thread within the process, but our process has memory bounds checking, simplified when thread scanning is mentioned.)

TBA: Arbitrary Vectored Exception Handling Detection

*Protected Functions​

Similar in concept to a memory integrity check, but specifically detects if Winsock routines designated as "protected" are hooked/modified, preventing user-mode packet modification and reading by software such as WPE Pro and rPE.

*Process Scanner​

Scans each process based on the contents (process name, window name) and unique memory signature.

*Module Scanner​

Scans the loaded modules in the process for any with blacklisted names.

TBA: Signature scanning

DOWNLOAD

*** Hidden text: cannot be quoted. ***

​

For OnForum.Net with ​

Thank you noticed it's for credit, so thank you, I don't want it

 

[ferdiyaman]

thank you bro

 

[ixo.]

thanks for share i will try it

 

[Dexolusss]

ty

 

[Security]

ty

 

[Enec024]

thx