Patchi/fyi

Love the cat-and-mouse of game hacking. Had most DLL injection covered, but FakeVEH not yet fully. Now caught via a DR0 hardware breakpoint on LdrpVectorHandlerList, guarded by a watchdog that re-arms the DRs. Manual mapping was already detected anyways :D patchi.fyi/blog/peregrine-fa…

My macOS anti-cheat is coming together. With the APIs of a Security Extension, I have a stable way (no kernel extension) to monitor cheating TTPs and report them securely to a backend. I built it game-agnostic, so it works everywhere. Finally a solid anti-cheat for macOS :D

Tested it against my WIP macOS anti-cheat. Raw svc syscalls, hand-built MIG messages, zero library calls doesn't matter. Endpoint Security hooks sit in the kernel MACF layer. task_for_pid is caught regardless of how you call it. The tools are there ACs just aren't using them:

Started working on a macOS anti-cheat built on Apple's Endpoint Security framework. System Extension that blocks memory editors, cheat tools, debugger attachment, DYLD injection; all from user-space. No kernel extension needed. Very promising so far.

Continued working on my proof-of-concept anticheat. These are the events visible to an anticheat when you use default DLL injection; pretty obvious, I'd say :) github.com/PatchRequest/Pere…

Just added self-clone to my Mythic agent: spawn new proc + spoofed PPID while original stays alive and running as backup github.com/PatchRequest/Kass…

Just implemented self-deletion in my Mythic agent while the process keeps running smoothly. Big thanks to @MalDevAcademy for the inspiration 🔥 github.com/PatchRequest/Kass…

Basic, but I guess effective enough to catch some script kiddies. I added a blacklist of words that should not appear in any running process. I think some cheaters actually get caught in the wild by this lol github.com/PatchRequest/Pere…

I wanted to consume some ETW providers, but it turned out I needed to be a PPL. So thats a side quest I worked on for now. Not sure how useful this is for protecting the game, but the protection for my own usermode part should be useful for the anti-cheat github.com/PatchRequest/Pere…

This is a better screenshot:

This is how the default settings of the @GuidedHacking injector currently appear in my anti-cheat. You can clearly see the sequence: WriteProcessMemory → DLL image load → new thread inside the newly loaded DLL. github.com/PatchRequest/Pere…