Load block under FACEIT

[namazso]

It seems that the signer used on PawnIO gets us blocked from loading under FACEIT AC:

As for why this is, I'd assume it signed something vulnerable at some point in time.

It likely doesn't make business sense for FACEIT to develop a "block this signer EXCEPT this authentihash", so I'd rather concentrate on getting a new signer.

Short term goals

• Detect the status code in setup and provide some alternative text for the resulting warning.

Long term goals

• Now that this thing is used, get a proper unique cert to sign so that this doesn't happen
• Add version info to the driver, so that it's easier to identify in a generic way
• Expose more functionality to other kernel drivers to see or control what runs, just in case they want to care about that

EDIT: Since this issue is getting a bit of traction, just want to write here that yes, before getting hired by the anti-cheat industry ~4 years ago I worked in the cheating industry. It’s not really relevant to this issue or its cause (PawnIO is only 2 years old) and very obvious from my GitHub history, just going ahead of anyone getting surprised about this fact.

[akerckhofs]

Just wanted to confirm this, I'll reach out to FACEIT but they've held sternly on similar issues before.
@namazso could you maybe look into a crowdfunding campaign or similar to fund a uniquely signed cert? I'd be more than happy to contribute.

[namazso]

@akerckhofs I might do that if that’s how things are looking, but generally the licensing construction that incentivizes commercial users to license code from me for a fee is what’s meant to subsidize that, and there is certainly some interest on that front, so I wish to wait and see how that turns out.

[bakkealex]

FACEIT AC Team confirms that they have no intentions to whitelist PawnIO because of certificate.
Reddit: FACEIT force me to use WinRing0

PawnIO was signed using a certificate which is also used by cheat software, which is why it is blocked. It will need to be signed with a legit certificate for it to be allowed.

[namazso]

Makes sense, cheats have been bundling vulnerable drivers for forever, and it’s understandable they rather block entire opus info than individual authentihashes. The plans are unchanged, for now (and past 2 years) this is fine while hw compatibility is figured out, and in the meantime I’m working on an unshared one I control to a reasonable degree.

[namazso]

Quick update: This might get solved faster than initially expected, so I’ll start working on the long term goals as my free time allows

[nickdnk]

Quick update: This might get solved faster than initially expected, so I’ll start working on the long term goals as my free time allows

Hey. Please let us know if there is a financial issue here with regard to getting a signed driver. I know nothing about this process, but I'm sure many people would be willing to donate a little to solve this problem, especially if you cross-post this in relevant places (reddit and/or the fancontrol github). Currently, I have to choose between playing Faceit and not having my fans roleplay jet-engine, which absolutely sucks. Faceit have confirmed they will not ever allow the current solution to load; see https://www.reddit.com/r/FACEITcom/comments/1nke0dn/comment/nexgc2w/.

Edit: Didn't see that last part was already posted.

[namazso]

@nickdnk Thank you, but that isn’t the problem. While OV certs can be easily obtained by individuals (such as the one you can already notice on any binaries I post) with a passport and like $400 spare, EV certs need you to be an LLC or equivalent. I’m aiming to partner up with an existing LLC, and if that falls through, I’d start an LLC myself in some cheaper jurisdiction (locally it'd cost me about $11k). But in both cases, it’s more about waiting and paperwork than money, so for now I can only recommend patience. If it ends up with me being out of some money I’ll do crowdfunding, but it is not a blocker for now.