Protecting EXE!

[EOS 60D]

Hello Folks,

I am running a COPVPServer and i really ****** of the botters in my server.
I would like to know more about EnigmaProtector because i protected my conquer.exe lately and it can be replace by another so in that case they can use there hacks again.. I would like to know how do you link your Conquer.Exe to your Server(exe). Just like ClassicCo if you replace there exe you cant log on..

Help much appreciated ..

[pro4never]

One of the methods I've heard thrown around involves the following steps.

A: A launcher which checks the md5hash of your client and launches a silent proxy (so you can check on things from server side)

B: When connecting to account server, the server checks if you're also on the silent proxy. If so it checks the running processes and other things to ensure you're running a legit client and no known hack programs.


There's still plenty of ways to bypass it but if you code everything properly then you'll have a fairly secure setup.

Also.. if you want to bother with a bit of reverse engineering then you could overwrite the encryption in the client with your own. Makes for a ton of work if anyone wants to try to hack on yoru server.

[Super Aids]

Originally Posted by pro4never

One of the methods I've heard thrown around involves the following steps.

A: A launcher which checks the md5hash of your client and launches a silent proxy (so you can check on things from server side)

B: When connecting to account server, the server checks if you're also on the silent proxy. If so it checks the running processes and other things to ensure you're running a legit client and no known hack programs.


There's still plenty of ways to bypass it but if you code everything properly then you'll have a fairly secure setup.

Also.. if you want to bother with a bit of reverse engineering then you could overwrite the encryption in the client with your own. Makes for a ton of work if anyone wants to try to hack on yoru server.

The problem with a silent proxy is that if it's not done in either a native language or pretty good obfuscated then it would be easy to bypass.

[_DreadNought_]

lol.

Loaded module checks, spell encryption change & add a layer of encryption to packets.

Ping packets to confirm your AntiCheat is online, if you're creative something I designed last night can actually check if a proxy is in the works with just one packet.

Use something like Themida to protect your anticheat.

As for client modification if your anticheat is solid, you can just chuck that into there and do Server <--> AntiCheat verification


@Pro4Never

Process checks? O.o, why? What if they have a proxy process running thats for a different server.. false positive

[CptSky]

The most I've done for blocking cheaters was to inject a DLL which was rewriting all assembly around common known places like wall jump, PM message, etc. So... at the end, edited or not, the executable was useless.

I was changing the cryptographer keys (both COSAC & CORC5). I was changing the WDF hash method. I was changing two constants which are sent to the server, but mostly unknown as they're useless... One was used by the injected DLL to determine if the client was mine, the second was edited by the client to indicate to the MsgServer that the DLL was injected.

Mhm. Else, there were a lot of server-side verification for like revive hack, wall jump, long jump, speed hack, auto-click, etc. All those verifications were direct botjail when detected.

Worked well enough to block most cheats. It wasn't a problem on my servers...

[go for it]

Originally Posted by CptSky

The most I've done for blocking cheaters was to inject a DLL which was rewriting all assembly around common known places like wall jump, PM message, etc. So... at the end, edited or not, the executable was useless.

I was changing the cryptographer keys (both COSAC & CORC5). I was changing the WDF hash method. I was changing two constants which are sent to the server, but mostly unknown as they're useless... One was used by the injected DLL to determine if the client was mine, the second was edited by the client to indicate to the MsgServer that the DLL was injected.

Mhm. Else, there were a lot of server-side verification for like revive hack, wall jump, long jump, speed hack, auto-click, etc. All those verifications were direct botjail when detected.

Worked well enough to block most cheats. It wasn't a problem on my servers...

AMEN