anti-cheat game security

[slinky2004]

i frequently play a game called gunbound and it has this anti-cheat software that they make you run in order to play, its called nprotect eng.nprotect.com and its all built into the game and stuff. one day i tried to open my favorite task manager, procexp while playing the game and gunbound flipped out and crashed. apparently this thing didnt like my task manager. i looked into it a little more and discovered that this game is not listed in my processes at all. how is it running if there's no process? the windows task manager shows an application, but its somehow hiding the actual process. is it spoffing this somehow? also, how does software like this know what applications to block? does it monitor what dll's my processes are accessing somehow?

[nihil]

What makes you think it is the game?

Does it happen every time?

What else are you running?................Firewall, Antivirus etc...............

Have you got the latest version/patches of the game and the latest procexp?

Have you tried launching procexp FIRST then starting the game..........

Do you get any messages/logs when it crashes?

EDIT:

Take a look at this.............it isn't "anti cheat" software

http://www.pestpatrol.com/pestinfo/n/nprotect.asp

[Relyt]

Nice catch Nihil and a Happy New Year!

I particularly liked this part:

The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

cheers

[bigog5390]

actually in gunbound nprotect is an anti cheat program that acts alot like a trojan it hides itself somehow and is linked to the actual gunbound game process and when one ends the other also terminates. nProtects major function is to keep people from using memory scanners to give themselves "money". the only reason this is a problem for the people in charge is that it is possible (and many people do) to spend actual money on avatars (colthing) and if you can just give yourself money it is kind of like stealing. acctualy trying to find a way around nProtect is quiet a challenge, most people can't do it. nProtect blocks all sorts of programs so i wouldn't be suprised if it blocked your program. nProtect finds "cheat programs" by injecting a dll into every running program and waits for it to try and accsses gunbound. some ceat programs are very common and are shut down even if it han't accssesed gunbound. if nProtect can't shutdown a program it shuts itself and gunbound down instead.

if you whant to know more about getting around nProtect go to http://www.gamerzplanet.net/forums/
and into any of the gunbound sublinks

[slinky2004]

ok, but how does it hide the game process? procexp(before nprotect crashed it) was actually showing a process called gunbound.gme and it was running a process under it called gameguard.des, but for some reason the windows task manager doesnt show that, is it spoofing that somehow?

[nihil]

The Windows Task Manager doesn't show a lot of things that are running..............stuff running under svchost for example.

EDIT : Get WinPatrol from BillP Studios. That displays services, processes and all.

[slinky2004]

thanks. ill try it but i bet nprotect will block it

[nihil]

I suspect that gameguard is the culprit.

Try opening procexp and WinPatrol FIRST. Then open up the game. I must admit I am a little surprised that procexp triggers it, as it is hardly a cracking tool

[Phonedog911]

yeah, i think its a little bit overkill, but w/e. i tried running procexp and winpatrol before starting the game and procexp causes it to hang. the process doesnt show up in winpatrol tho, nprotect doesnt do anything if winpatrol is up. the actual processes that procexp was showing(before everything hangs) are called gunbound.gme and gameguard.des. i still dont understand how they hide that from the task managers(except for procexp). you can get the game for free at www.gunbound.net if you wanna try it out

[nihil]

I think that I will give it a miss

I run Process Guard from DiamondCS. A very good security product.

Gunbound actually requires you to uninstall it, so it won't stop their pathetically lame security system. Yes that's right.............compromise your computer security

I am sure I am going to do that

nProtects major function is to keep people from using memory scanners to give themselves "money". the only reason this is a problem for the people in charge is that it is possible (and many people do) to spend actual money on avatars (colthing) and if you can just give yourself money it is kind of like stealing.

That I do not understand.................it is an online game with your account on the server?

I did see that people would load "gunbots" or "aimbots" to enhance their performance. That would be to the detriment of people who paid? and that the protection program is supposed to stop that.

Not for me....................there are plenty of other games around.