Pentesting | Red Teaming Game Hacking | Anti Cheat
Deutschland
Joined July 2019
- Tweets178
- Following418
- Followers262
- Likes315
My macOS anti-cheat is coming together. With the APIs of a Security Extension, I have a stable way (no kernel extension) to monitor cheating TTPs and report them securely to a backend. I built it game-agnostic, so it works everywhere. Finally a solid anti-cheat for macOS :D
Patchi/fyi retweeted
Make your payload "sleep" to look like any real Windows activity.
BusyWork is a Rust library that swaps each pause for randomized real work - hashing, file enumeration, registry queries, DNS lookups - drawn from 76 tasks across seven categories with ±30% jitter on every parameter.
No two "pauses" produce the same API sequence, and no timing primitives survive in the compiled binary.
A post by Daniel (@PatchRequest)
Source: patchi.fyi/blog/busywork-sle…
#redteam #blueteam
Just a horse game or malware? A friend got invited to a private Star Stable Online server, via a Tor onion site serving an exe and a .hors file. Down the rabbit hole: NSIS installers, AES-256-GCM encrypted packages, DLL proxying, ECDSA-signed profiles:
patchi.fyi/blog/horse-empire…
That's exactly what I used for my Windows agent, my gaming PC is filled with C2 implants now lol
github.com/PatchRequest/Kass…
In my case, I gave it access to a Mythic instance and Playwright for browser testing, so it could verify all features with real execution, pretty fun to watch :D
Did something similar a few days ago with grok:
github.com/PatchRequest/Brow…
You are trolling, right? In your own screenshot it says "break behavioral pattern matching by ... anti-cheat systems" or do we just ignore 90% of the sentence and look at two words? O.o
It does not claim to just bypass all of anticheat but break one potential component?!
the repo and i never claimed to bypass AC.
The repo says:
evade behavioral pattern matching
the claim of
It states evasion of anti-cheat systems
was made up by @daaximus
so calling it a buzzword repo because it does not have a feature it never had claimed to have is just weird
The repo never promised to hide any calls or prevent telemetry, but it helps to break behavioral pattern matching and that’s what it does. When the AC does not use it, obviously it cannot interfere with it, lol.
So it just does what it claims to do, how is this engagement bait?
The concept of BusyWork is nothing new and not an invention by me, but a proven idea in MalDev. Here it is mentioned in a redsiege talk:
redsiege.com/wp-content/uplo…
or here another talk (slide 153)
conference.hitb.org/hitbsecc…
Having lots of non-cheat API calls mixed in makes it harder to confidently flag it as a cheat. Overall, it makes both static and dynamic analysis more difficult.
I am not a complete noob in the field: github.com/PatchRequest/Pere…
I know ACs will still see the handle, but usually there's no ban just for that, there are valid use cases, like Discord using handles for its in-game overlay. An analyst or mechanism will look at what the program actually did. 1/2
I know, not the strongest argument, but when building my learning anti-cheat, I had the feeling it made it harder to automatically categorise something confidently as a cheat::
github.com/PatchRequest/Pere…
an example how to do this can be seen in my mythic agent:
github.com/PatchRequest/Kass…
i break patterns in stuff like reflective loading or up/downloading with busywork here
it breaks the patterns ACs look for.
Normal cheat:
handle > ReadProcessMemory
With my repo:
500 WinAPI calls > handle > 500 WinAPI calls (one of which is ReadProcessMemory)
Still detectable? Sure. But way harder to flag with certainty when it could be a weird gaming app.
A few month back a colleague published a Mythic C2 profile with tailscale: github.com/Yeeb1/mythic_tail…
an example implementation can be seen here:
github.com/PatchRequest/Kass…
Sure Busywork is not a new concept:
redsiege.com/wp-content/uplo…
Slides 18-22 and 35 - 36 even with a falcon example :)
here is even more: conference.hitb.org/hitbsecc…
Slide 153
and even some academic work on the topic:
arxiv.org/pdf/2506.02660
EDR has the attention span of a toddler. If it doesn't see the exact pattern it was trained on (sleep, allocate, inject, sleep), it just moves on. Anything else between your calls and it forgets you exist. So I built a library that does exactly that
patchi.fyi/blog/busywork-sle…
New Rust lib drop🦀 Got tired of rewriting userland unhooking and direct/indirect syscalls from scratch for every project. So I built a lib that makes it dead simple: unhook a single syscall, rehook afterwards, or go fully indirect/direct with Halo’s Gate
patchi.fyi/blog/callghost-di…
Updated my DLL proxy framework. It now clones the metadata and signature from the original onto the proxy. Properties show the same company, description, and signer, so sideloading is harder to spot. Looks just like the real thing, just a hash mismatch :)
patchi.fyi/blog/dll-proxy-me…
If you're interested in a readable anti-cheat, I have an open-source one: github.com/PatchRequest/Pere…
It has no backend, just a local GUI client, since it's not for production, but sending data to the backend isn't the hard part. Usually you just send all events there for analysis