BattlEye now say they're working with Valve to support Steam Play

Nice to read that. I'm not into multiplayer games, certainly into the type of games where this is needed, but still very cool and I hope that this will get more users to switch to Linux.

I was wondering though, to my knowledge (I'm not at home in this domain) this kind of anti-cheat software mostly ensure that no one tampered with the game files, related libraries and game state in memory . If one wanted to cheat on Linux, wouldn't it be far easier to keep the game, libraries and Steam (Play) related files as is, but directly target the GPU drivers (kernel modules, mesa etc) and tinker there to lets say make things transparent in a game? Is there even a chance to detect something like this with anti-cheat software?


Last edited by jens on 11 May 2019 at 12:34 pm UTC

if it becomes real, take my money, finally the devs will be motivated for Linux

Quoting: jensNice to read that. I'm not into multiplayer games, certainly into the type of games where this is needed, but still very cool and I hope that this will get more users to switch to Linux.

I was wondering though, to my knowledge (I'm not at home in this domain) this kind of anti-cheat software mostly ensure that no one tampered with the game files, related libraries and game state in memory . If one wanted to cheat on Linux, wouldn't it be far easier to keep the game, libraries and Steam (Play) related files as is, but directly target the GPU drivers (kernel modules, mesa etc) and tinker there to lets say make things transparent in a game? Is there even a chance to detect something like this with anti-cheat software?

I think that a good question to ask as well is how different it is from Windows situation? It's still possible to disassemble any DLL or EXE file, modify it, recompile it, and here goes your cheating solution.

So how BattlEye and EAC can prevent that, do they require everyone to sign every file? If so, why not doing so on Linux as well? I mean, although restrictive, I would be fine with "if you want to play this game online, you need your official distributions drivers".

Quoting: CreakI think that a good question to ask as well is how different it is from Windows situation? It's still possible to disassemble any DLL or EXE file, modify it, recompile it, and here goes your cheating solution.

Yes, I guess on Windows it is kind of doable to have a list of all drivers with their dll's and corresponding checksums, signatures or similar. But on Linux it is much more common to have a different kernel, and even more common to run e.g. Mesa from source. (Nvidia driver won't have that issue, but restrict Anti-Cheat to NVidia wouldn't be a cool thing)

Quoting: CreakSo how BattlEye and EAC can prevent that, do they require everyone to sign every file? If so, why not doing so on Linux as well? I mean, although restrictive, I would be fine with "if you want to play this game online, you need your official distributions drivers".

Yes, this could be a consequence. But dunno if this is how this kind of software is supposed to work.


Last edited by jens on 11 May 2019 at 1:44 pm UTC

Quoting: Guest

Quoting: Creak

Quoting: jensNice to read that. I'm not into multiplayer games, certainly into the type of games where this is needed, but still very cool and I hope that this will get more users to switch to Linux.

I was wondering though, to my knowledge (I'm not at home in this domain) this kind of anti-cheat software mostly ensure that no one tampered with the game files, related libraries and game state in memory . If one wanted to cheat on Linux, wouldn't it be far easier to keep the game, libraries and Steam (Play) related files as is, but directly target the GPU drivers (kernel modules, mesa etc) and tinker there to lets say make things transparent in a game? Is there even a chance to detect something like this with anti-cheat software?

I think that a good question to ask as well is how different it is from Windows situation? It's still possible to disassemble any DLL or EXE file, modify it, recompile it, and here goes your cheating solution.

So how BattlEye and EAC can prevent that, do they require everyone to sign every file? If so, why not doing so on Linux as well? I mean, although restrictive, I would be fine with "if you want to play this game online, you need your official distributions drivers".

That would rule me out entirely from playing anything. The official drivers for my distribution are from source, and often with a custom patch set. Driver updates even on Windows are beyond the control of the anti-cheat, so any kind of signing there is just pointless really, not to mention far more intrusive into a system than is acceptable for any level of security.

On Windows drivers are already signed as part of the shipping process, see https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing As far as I remember all libraries from Microsoft are also signed by Microsoft itself.
The Linux kernel supports this too for kernel modules, but no idea if desktop oriented distributions are using this. But even if it is used, this would not cover Mesa and friends.

But as stated, I'm no expert in this area, don't know how relevant this is.


Last edited by jens on 11 May 2019 at 2:46 pm UTC

Quoting: jensNice to read that. I'm not into multiplayer games, certainly into the type of games where this is needed, but still very cool and I hope that this will get more users to switch to Linux.

I was wondering though, to my knowledge (I'm not at home in this domain) this kind of anti-cheat software mostly ensure that no one tampered with the game files, related libraries and game state in memory . If one wanted to cheat on Linux, wouldn't it be far easier to keep the game, libraries and Steam (Play) related files as is, but directly target the GPU drivers (kernel modules, mesa etc) and tinker there to lets say make things transparent in a game? Is there even a chance to detect something like this with anti-cheat software?

On Linux you can override symbols with LD_PRELOAD and your own library so it's possible to modify a e.g. a driver without actually patching and recompiling it. I assume Windows have something similar, so just checksums for the driver is pointless. You need to detect this kind of behavior too.

Fun article on the subject:
http://haxelion.eu/article/LD_NOT_PRELOADED_FOR_REAL/

On thing might be for the game/anticheat to do off screen rendering tests and compare to some predefined output. If the tests are substantially different (transparent textures or wireframes for example) you're probably up to no good.

(No idea if anticheats on Linux use any of this stuff, just some idle musings...)

Quoting: whizse

Quoting: jensNice to read that. I'm not into multiplayer games, certainly into the type of games where this is needed, but still very cool and I hope that this will get more users to switch to Linux.

I was wondering though, to my knowledge (I'm not at home in this domain) this kind of anti-cheat software mostly ensure that no one tampered with the game files, related libraries and game state in memory . If one wanted to cheat on Linux, wouldn't it be far easier to keep the game, libraries and Steam (Play) related files as is, but directly target the GPU drivers (kernel modules, mesa etc) and tinker there to lets say make things transparent in a game? Is there even a chance to detect something like this with anti-cheat software?

On Linux you can override symbols with LD_PRELOAD and your own library so it's possible to modify a e.g. a driver without actually patching and recompiling it. I assume Windows have something similar, so just checksums for the driver is pointless. You need to detect this kind of behavior too.

Fun article on the subject:
http://haxelion.eu/article/LD_NOT_PRELOADED_FOR_REAL/

On thing might be for the game/anticheat to do off screen rendering tests and compare to some predefined output. If the tests are substantially different (transparent textures or wireframes for example) you're probably up to no good.

(No idea if anticheats on Linux use any of this stuff, just some idle musings...)

Ah, nice thinking, indeed some kind of build-in E2E tests sounds like a completely different, but more likely feasible approach.

PS: Thanks for the link!


Last edited by jens on 11 May 2019 at 5:36 pm UTC

I hope your fears are pointless - after all, battleye and EAC are already have a linux-version and i never heard of it requiring a specific kind of driver or kernel - so i doubt the proton-supported version will require it. ^^

Quoting: jensOn Windows drivers are already signed as part of the shipping process, see https://docs.microsoft.com/en-us/windows-hardware/drivers/install/driver-signing As far as I remember all libraries from Microsoft are also signed by Microsoft itself.
The Linux kernel supports this too for kernel modules, but no idea if desktop oriented distributions are using this. But even if it is used, this would not cover Mesa and friends.

But as stated, I'm no expert in this area, don't know how relevant this is.

I doubt that anticheats programs relies on drivers/libraries signatures/checksums. In fact, many cheats works by modifying the memory of the running program from a privileged program that runs in parallel, so the ac software definitely do something more than just "check for know files" (probably they do something similar to an AV heuristic).

Quoting: EhvisI wouldn't be surprised if they *only* support steam games in Proton and not generic wine.

Well its not really an issue as the patches proton are sent upstream so no reason why wine wont just run out the box like proton but yeah if you have an issue it wont be supported. Why i guess brings people on to I dont use steam because DRM etc etc personally I admire the mindset it's just not one i share.


Last edited by Whitewolfe80 on 11 May 2019 at 6:37 pm UTC