<story><title>Valve bans 40k Dota 2 accounts using honeypot patch</title><url>https://www.dota2.com/newsentry/3677788723152833273</url></story><parent_chain><item><author>4gotunameagain</author><text>&amp;gt; This patch created a honeypot: a section of data inside the game client that would never be read during normal gameplay, but that could
 be read by these exploits. Each of the accounts banned today read from this &amp;quot;secret&amp;quot; area in the client, giving us extremely high confidence that every ban was well-deserved.&lt;p&gt;Any speculation as to how this worked on a lower level ?</text></item></parent_chain><comment><author>HHad3</author><text>(Wrote anti-cheat software in the past.)&lt;p&gt;There are multiple ways to detect this. Hardware breakpoints were already mentioned, but they only work per thread, so if one is sniffing on your memory from another process or the kernel then these won&amp;#x27;t help.&lt;p&gt;The most stealthy and evil way I found was to allocate a page but never actually use it.&lt;p&gt;Windows lazily allocates physical memory for fresh memory pages when they are first used.&lt;p&gt;The detection is to periodically poll the page map from your process and check your canary pages via NtQueryVirtualMemory. If your unused page suddenly is backed by some physical memory then something happened to read from it! Bonus-points for putting such canary pages into places previously used for real game data.&lt;p&gt;This method is not foolproof: Anti-virus programs can read memory of all programs (but don&amp;#x27;t, Overwatch e.g. does not like this and crashes randomly due to this exact protection method). A bug in the program could also read from the page accidentally (e.g. out-of-bounds array read). But it&amp;#x27;s a &amp;#x2F;very&amp;#x2F; good indicator that something is wrong when other cheat detection mechanisms also trigger.&lt;p&gt;Once you know how this works it&amp;#x27;s pretty easy to defeat unfortunately: Read the page map first, then avoid reading pages that have no backing physical memory, because those contain no useful data at best and are canary pages at worst.</text></comment>
<story><title>Valve bans 40k Dota 2 accounts using honeypot patch</title><url>https://www.dota2.com/newsentry/3677788723152833273</url></story><parent_chain><item><author>4gotunameagain</author><text>&amp;gt; This patch created a honeypot: a section of data inside the game client that would never be read during normal gameplay, but that could
 be read by these exploits. Each of the accounts banned today read from this &amp;quot;secret&amp;quot; area in the client, giving us extremely high confidence that every ban was well-deserved.&lt;p&gt;Any speculation as to how this worked on a lower level ?</text></item></parent_chain><comment><author>tobyhinloopen</author><text>I imagined the secret area contained fake details about the game, like adding an invisible fake street to a map. If the client refers to the fake street or any location within it, you can be certain the details about that fake street were obtained using cheats.&lt;p&gt;This trick is used to catch cheaters on minecraft, by spawning in fake diamond blocks that would only be visible to specific cheats (xray). If a user suddenly were to dig to these blocks, you can be reasonably certain there&amp;#x27;s something fishy going on.&lt;p&gt;Other way to think about it, is adding an invisible field to a contact form that is only hidden through CSS</text></comment>