Jire / Charlatano

Proves JVM cheats are viable on native games, and demonstrates the longevity against anti-cheat signature detection systems
GNU Affero General Public License v3.0
676 stars 204 forks source link

Junk Code #443

Open melman99 opened 7 years ago

melman99 commented 7 years ago

Can i add junk code to whole code to make it more hard to detect? Or it doesn't matter. If i make mistake , soz english not my native language ;/

BBY203 commented 7 years ago

Well, as java programs don't have a specific signature, I don't think that'd help to make it more undetectable. But thinking about it, Abendigo was also java based but it got detected. So if you still wanna do it then do it. And also you can try to change variable names, class names etc. and maybe switch codes' lines back and forth too.

tamal777 commented 7 years ago

Java can be undetected only for now but about Abendigo. only @Jire can ans why Abendigo was detected.

melman99 commented 7 years ago

@BBY203 Thank you very much. I will do what u said . @tamal777 Also thank you for information about Abendigo being detected.

melman99 commented 7 years ago

Btw it's Still UD ?

Jire commented 7 years ago

The only signature to concern yourself with Charlatano is the bytecode signature, which is the same on every run. Modifying the bytecode through obfuscation or "junk code" breaks the bytecode signature, leaving it undetected -- as Abendigo still is once obfuscated or modified enough.

I had a lot more knowledge when making Charlatano so it is quite a lot harder to define a signature compared to Abendigo which is probably why VAC is taking so long. Charlatano was made specifically in a way that allows the JVM to perform JIT compilation all over the place, which gives the code "automatic" polymorphism. Over 14 months undetected is unheard of for even many paid cheats, and Charlatano is still trucking along fine; I'm very curious to find out when it will be detected.

melman99 commented 7 years ago

Dear @Jire Jire but i should put junk code in every kts/kt file or in some specific folders? If in specific folders so to which one's?

tamal777 commented 7 years ago

@Jire So if I put juke codes in Charlatano and only I will be using will it be undetected for a long long time? I'm noob at programming can you tell me where to put junk codes?

tamal777 commented 7 years ago

@Jire Please help

BBY203 commented 7 years ago

Just search on the internet a little bit. You should decompile the .jar, edit one class by adding a random comment. Recompile and bam new bytecode signature. Or you can edit the classes of the source code and rebuild from it without decompiling.

Jire commented 7 years ago

@BBY203 The bytecode signature is on a by-class basis, you still have to worry about the rest of the classes.

tamal777 commented 7 years ago

okkk thanks

p410n3 commented 7 years ago

Best way to change the bytecode sig is to remove all files in /scripts that you dont need and then resolve the reference errors. IMO

Floraly commented 7 years ago

VAC picks multiple pieces from the code inside Memory. And if some specific patterns matches. Bam VAC Ban. VAC2 wouldn't be Triggered if you change binary on every run!

4103chan commented 7 years ago

But JIT compiling is why the sigs will differ. It is plymorphed just as Jire said. l2read

Floraly commented 6 years ago

Valve needs skilled Java Developer for this. And this hard task cost them real money!

0-x-2-2 commented 6 years ago

just fucking run a java obfuscator on it

freaky1337 commented 6 years ago

@0-x-2-2 Which obfuscator do you recommend?