not_a9

The next choice will be dynamically resolving syscall IDs from NTDLL? Surely that has no issues that could possibly happen.

If you look at unknowncheats.me you’ll see a significant amount of reversing of their games

Plenty of function pointers to overwrite, presumably

For what it’s worth isn’t liquid metal actually not very good for extreme overclocking seeing as it solidifies at subzero temps?

Do you think Deadlock will not devolve into a mixture of gambling and hvh like every Valve multiplayer game that’s been relevant in the last 10 years (except Dota because hvh in dota sounds complex, so it's just gambling there)?

Fortnite avoids this by having no gambling and by making hvh infeasible FYI

> They clearly know what they are doing at Valve

Yeah, at promoting child gambling. Not sure about games

What ranks are you playing on? While a player of any rank can buy Neverlose and win and if they wanna just pwn cleans they can buy Midnight (speaking of buying P2Cs: if Faceit is apparently riddled with cheaters, where can I buy a P2C that I can pwn on Faceit with for an affordable price?), said cyber athletes will naturally gravitate towards higher ranks.

> FACEIT is riddled with cheaters

According to sources of… what? In any case it’s sure as shit less riddled with cheaters than Premier LMAO

Most likely there’ll be lots more hunting for physmem read/write vulnerabilities as well as bugs in userspace stuff like GUI whatsits that’d give code execution/memory readwrite.

Userspace bugs is where I’d look first.

How is Valve’s VACNET doing? I think you should take a look at what’s happening in Counter-Strike 2 these days to see what the true frontier of ML based anticheat looks like.

Frankly at this point I’m pretty sure John McDonald plays HvH too

Devirtualization and recompilation is unfortunately a really, really tough task even for clank assisted RE.

Unlikely most of the Denuvo cracks actually remove the virtualized code from the executable. Not feasible without extensive binary rewriter tooling (that, while being sloppable, still takes a lot of time to slop).

I don’t think most obfuscators will care about self-modifying code anyway, outside of cases like packing (…and in that case you probably won’t be rewriting the unpacker stub anyway :D). Also self modifying code breaks on targets like Windows kernel drivers, which are a big target for SOTA obfuscation these days.

Technically most malware should generally be able to rely on the syscall interface, no? As generally it doesn’t need a GUI or anything