Lemdro.id

-1 points

9 months ago

Are you certain it has kernelt level anti cheat? Because it’s working on Linux which it absolutely would not be doing if it had kernel anti cheat

report

[ - ]

Tattorack@lemmy.world

5 points

9 months ago

That’s because the anti cheat is running in a fake kernel with Proton. Developers have ways of detecting when the kernel isn’t real… Sometimes… But the Helldivers devs don’t seem to mind for now.

report

[ - ]

-3 points

9 months ago

I don’t know where the hell you got that information but that’s not how proton works. There is no “fake kernel” it’s not a virtual machine or an emulator it’s just a translation layer that translates Windows syscalls into linux syscalls

report

[ - ]

okamiueru@lemmy.world

7 points

9 months ago

The syscall translations that would go to the nt kernel, can be seen as a “fake kernel”, no?

Wine has a process that works as a substitute for the Windows NT Kernel. How that works in detail, which calls are abstracted with an internal model, and which are mapped on to Linux kernel calls, is a bit silly to get hung up on, no?

I think it’s perfectly fine to call that concept a “fake kernel”. I don’t know what you’d need in order to qualify more?

just a translation layer that translates Windows syscalls into linux syscalls

“Just”?. No. It also has an internal model. Which system calls end up as Linux syscalls, and how, is not a stateless translation. The NT kernel is modeled. And although you are right in your straw man argument that it isn’t a “virtual machine”, or an “emulator”. Neither of those are a requirement for the concept of a “fake kernel” either. Seems a bit rude to go so balls out hard against it, as you did.

report

[ - ]

0 points

9 months ago

None of the things needed for a true kernel level anti cheat are in a translation layer, some of them just can’t be. It’s why games with actual kernel level anti cheat have never worked in proton and never will. Historically the only way to play those games is either be on windows or use a vfio virtual machine (which also probably won’t work even with tons of vm hiding techniques depends on just how sensitive the ac is). Wine/proton simply can’t translate the upper parts of the nt kernel needed for it.

report

[ - ]

okamiueru@lemmy.world

3 points

9 months ago

It’s why games with actual kernel level anti cheat have never worked in proton and never will

Some games that use EAC, BattlEye and GameGuard, work fine in proton. Afaik, whatever these do and are abstracted to, or is offhanded to some linux native process, it’s still all running in userspace. I’m sure this relies on individual game developers playing along with it, and not 100% “proton emulating the nt kernel” in order to “fool them”. Is this the point you’re arguing? That it won’t be possible by a purely proton/wine translation layer?

If you know details on how exactly this works, or want to point to some resource on this, I’d be happy to read more about it.

My guess is that there is nothing technically impossible about fooling a rootkit by faking whatever syscalls from the game, but that it becomes a impossible task to maintain, as the AC developers can make minor changes that would require a lot of hard work to “emulate”. I’d love to learn more, but it was hard to find good resources on this.

report

[ - ]

2 points

9 months ago

EAC has an explicit linux support that valve worked on them with, it’s not full kernel AC. same with battleye and GG those are not full kernel root anti cheat implementations. I can’t point at any specific documents unfortunately but the wine/proton irc channels are public and lurking let’s you learn a lot as they talk through issues with games and anticheat.

In order for linux to support kernel level AC a module for the Linux kernel would be needed. And i doubt Linus will ever allow that lol

report

Show more comments

[ - ]

Tattorack@lemmy.world

2 points

9 months ago

Yes, and part of these make the anti cheat believe it’s running in a kernal.

report

[ - ]