Repository navigation
Classes & Namespaces
Overall, the project's class design is relatively simple. It features several classes representing unique functionalities, with a couple classes making use of inheritance. Most classes are marked with the final keyword to prevent further inheritance. The following is a list of classes with brief descriptions, and any noteworthy details.
The class which contains objects that are essential for functionality of the project's goals, such as Detections, Preventions, and NetClient. Also conducts pre-initialize checks to ensure the system environment is aligned with anti-cheat security settings. Creating an object of this type will start up all anti-cheat functionalities.
Represents an error state during anti-cheat initialization. Catching an exception of this type during AntiCheat object creation implies that something went wrong during the AntiCheat object's startup, and that the program cannot safely continue execution.
Functional unit that handles monitoring and flagging of suspicious activities. Considered one of the most important classes in regards to the program's goals. Contains an Integrity object which is created in the constructor, along with a Services object, and a VirtualMachine object. The class constructor registers DLL notification callbacks along with automatically starting monitoring activities.
Functional unit that deals with the prevention of suspicious activities. Includes program re-mapping with SEC_NO_CHANGE, preventing multiple instances of the program from being created, enabling process mitigations, preventing user APC injection, randomizing the anti-cheat module's name, and unloading any loaded blacklisted drivers. Considered one of the most important classes in regards to the program's goals.
Functional unit that deals with detecting and/or stopping various types of debugging, including traditional Windows debugging (software & hardware), VEH debugging, and kernel debugging. Also contains routines to prevent threads from being debugged. When debugging attempts are detected, the EvidenceLocker class object is used to flag the end-user. During object creation, a debug monitoring thread is created, which checks for the presence of debuggers every second.
Set of routines called during each debug monitor loop. Routines must have a bool return type with no arguments in order to be properly usable (each function is stored in vector<function<bool()>> DetectionFunctionList in the AntiDebug parent class - the project uses C++ 14, newer versions may support more flexibility for function lists in terms of variable arguments).
Uses hashing of loaded modules to detect runtime modifications/patches to sections in memory. Additionally, contains routines to check if a module on disc differs from the loaded module, as a supporting feature.
Deals with flagging users via the NetClient object and reporting them to the central server. Uses a queue-based system which stops duplicate flags from being sent.
Creates 'protected' memory on the heap which cannot have its page permissions modified using traditional methods, such as VirtualProtect. Uses the method found at RemapProtectedClass to store variables at a memory location which cannot be written to, making it useful for storing program settings that should not be modified at runtime. In the context of this program, the Settings singleton instance is stored within a ProtectedMemory instance, making it un-writable.
Generic logging mechanism which writes to both file and console, and includes a severity and timestamp alongside a message. Log files written to are not encrypted by default and can be considered 'dangerous' or 'revealing' in production environments.
Singleton design class which represents the program's desired settings. Can only be changed during compile time, and is stored within the ProtectedMemory class to prevent memory writes, as this can potentially disable certain protections at runtime.
Generic SHA256 algorithm to assist with integrity hashing.
Set of static helper functions to assist with string operations and comparisons.
Deals with keeping track of the system's environment, including loaded drivers, and checks on configurations, such as driver signature enforcement, secure boot, and debug mode. Also has routines for device enumeration, checking specific build/versioning, and hypervisor checks.
Interface for logging game events to an endpoint, for the purposes of separate telemetry. Game events can include player deaths, jumping, headshots, crouching, etc.
Utility class for easily reading fields from a byte array.
Utility class for easily writing fields to a byte array.
CURL wrapper class to create and send GET/POST HTTP requests.
Manages network connection with the central anti-cheat server and deals with sending/receiving network messages. Used for sending detection flags and handling connection heartbeats.
Simple code virtualization class which uses virtual registers and stack to assist with code obfuscation. Virtualization supports function calls, making it more difficult to analyze/reverse the program when used.
Represents an error instance when using the VirtualMachine class. Catching an exception of this type implies virtual machine execution did not succeed.
Compile time string encryption utility class, making use of the constexpr keyword. Used for readable, in-place string obfuscation. Supports the std::string object type. Strings encrypted at compile time must be decrypted at runtime before being used.
Compile time wide string encryption utility class, making use of the constexpr keyword. Used for readable, in-place string obfuscation. Supports the std::wstring object type. Strings encrypted at compile time must be decrypted at runtime before being used.
Stores information related to the current process image (sections, PEB, etc), along with helper routines related to processes. Some routines in this class are used to gather information about other running processes.
Creates and manages C++ threads (std::thread), and contains static routines to check if a thread is running or suspended.
The following is the list of namespaces from the project. These were made namespaces instead of classes due to a lack of variables/data members; they contain only functions that don't rely on states.
Contains a set of functions to assist with checking code signing certificates & catalogs associated with files.
Contains the anti-cheat server endpoint information, along with dispatch routine to launch anti-cheat functions + shutdown when finished. This namespace may be removed in future versions, as the AntiCheat class is already being used as the main interface.
Functions which create & show the start-up splash screen. Contains the file name of the splash screen image to show.
Contains the Opcodes, and Builder namespaces.
Contains two enumerations, representing "client to server" and "server to client" packet opcodes. Packet opcodes define a specific packet structure & meaning.
Wrapper functions for creating ready-to-send packets, which always returns a PacketWriter* object. Each "client to server" opcode gets its own builder function, and each variable field of a packet should get its own parameter in its respective builder function.
Routines which assist with gathering open handles on the system: handles to our current process from other running processes might be the sign of suspicious activity. Also contains a simple whitelist feature, to avoid flagging when specific processes open handles to our process.