---
# System prepended metadata

title: 2020/08/10

---

# 2020/08/10

## Participants

- Adrian
- Buck
- Giang
- Nick
- Karl
- Matthias
- Tim
- John

## Notes

- We'll need a lawyer who looks into the specifics of the contract. 
    - So nobody can run away with it
    - We need to research how the shares work. 
- Whoever will end up doing it, will also setup the company and shares. 
    - America or Norway? 
    - Adrian will look into it
    - Contracting or being part of the company? 
    - US LLC and let everyone shares. 
    - Contracting is always possible (It's just a different type of tax form). 
- First game to protect: See @Adrians presentation
    - Module system
        - Game/Engine specific detections
    - RPC based architecture: Code is still on the client -> can be reverse engineered
- Networking: KM or UM? 
    - KM: 
        - May be critical
        - We need a library that is 100% safe (using WinSock). 
        - [Supported by Microsoft](https://docs.microsoft.com/en-us/windows-hardware/drivers/network/introduction-to-winsock-kernel). 
        - Makes tampering with it a little harder. 
        - [Example](https://github.com/hsluoyz/wskudp/blob/master/wsktcp/wsktcp.c)
        - **Only send requests to the server when the driver is loaded.**
    - UM:
        - Safer?
        - Can be obfuscated
- Costs / Legal stuff: 
    - To set up the entire LLC is shouldn't cost more than a few hundreds. 
    - We don't want to have one person in control. 
    - People who invest get a bonus. Investors will get 100% of their investments out of the profit but after that it's getting split. 
- Kernel streaming: 
    - 1 mb space in .text that gets overwritten? 
    - Problem: 
        - Public image. Kernel driver is already a huge issue for people. 
        - Microsoft probably wouldn't like it. 
    - Encrypt certain parts of the code and transfer the key. 
        - Only an issue if Microsoft finds out. 
        - As long as we pass WHQL it's fine. 
- Streaming alternative: Have different drivers. 
- Encrypting: 
    - Even if an employee goes rogue there's no way to exploit it. 
- Prevention vs Detection: 
    - Prevention allows you to do much harsher detections. 
    - Legit applications cannot be interact with the process anymore. 
    - **Focus on prevention**
        - Obfuscation: Ask for private versions
        - Virtualization: Hurts the performance of the games. 
        - Strip symbols: Simple renaming and remapping (.NET)
            - 1-2 days effort
        - Violate assumptions tools make: 
            - Call doesn't always return to the next instruction
        - Prevent automatic sdk generation
    - **Obfuscation can be advertised.**
    - Should be built by us. Can be built once and then used for everything after that. Features are optional. 
    - Custom llvm version that has the obfuscation. 
- Obfuscation: 
    - Some obfuscation that shouldn't hurt performance too much but make things annoying for RE for when we have the time to do it:
        - Simple constant mutation
        - Control flow (very annoying to deobfuscate if done right)
        - Violate common assumptions
            - Go below rsp (safe in UM)
            - make CALL not always return to next instruction
            - general stack fuckery
            - turn ret into jump
            - replace with sub + deref and so on, swap rsp with another register
        - custom abi: 
            - buffer on the stack with the return address
            - randomized and obfuscated
                - rsp - 0x20 = return address of function A
                - rsp - 0x10 = return address of function B
- Hypervisor: 
    - Maybe in the future
    - Intel and AMD support
    - We probably need to hire some experts. 

- Monorepo
- Ban system: 
    - EAC: 
        - They mess with your head. 
        - They let you play with detected stuff. 
        - Allows them to: 
            - detect the cheat and the users -> determine threats
            - gather data
            - dump cheat
    - Public image
        - Live statistics on the website (flexing statistics) -> only when big
        - Ask game developers first. 
        - If somebody is complaining on reddit -> refer to the statistics
    - Based on the reports: Accelerate it

- Next steps: 
    - Adrian: Setup client/driver template
    - Kernel driver will probably be in C
    - Multirepo: 
        - Client
        - Server
        - Frontend