andro2157
commented
2 years ago Hi thank you for the constructive feedback.
-
To be honest, I didn't look much into this new encryption, but as it doesn't require any password to derivate the key, I'm not surprised that it's easy to decrypt it. When I added that message, it mainly targeted the short term with skid grabbers that can barely scrape the leveldb. DTP adds a few other levels of protection as stated on the readme: removing the leveldb database, integrity check & process protection.
-
Few things to note about DTP's self-protection.
- When DTP is running, it'll lock every file related to it (config, encrypted container, etc). The only way to edit/remove them is to kill DTP. And there's probably a way to read them, but not natively (Windows should block you from reading). This is why every user should keep DTP running in the background even when Discord is closed.
-
The last update moved some configs (related to the integrity check) to the encrypted container, to avoid their tamper.
-
DTP will try to protect itself and the Discord process using the same trick: removing the privilege to access the process for every user. However, there is a limit: any process with administrative privilege can bypass this protection and therefore can kill DTP, and read Discord's memory. To counter that the only way I see is to go to the kernel, but I feel like this a way too overkill method for a token protector... Most "anti-protection" that I saw were just pathetic attempts to get UAC and kill/remove DTP with admin privilege. I can't do much about this, user education is probably the most that can be done. And yes, I'm aware that a very targeted attack on DTP could leak the container encryption key/token (mitm/some hook maybe) / etc. But again, this is a cat and mouse game like cheaters vs anticheat devs. And from what I saw, most grabber developers are just skid who don't know much about what they're doing, so I don't know if that last point is a big concern.. (using vmp to obfuscate DTP should prevent some attacks)
Currently, I have some stuff planned to make DTP work with the latest Discord update. But the main problem currently is that I don't have the time to maintain this project. Feel free to fork DTP and add some stuff, though the code base is a bit messy lol
If you want to contact me, send me a DM on telegram: https://t.me/andro2424
ClaraCrazy
l3qso
fuck the template lol
"This will protect every users from LevelDB reading grabbers" - not at all. I already figured out how to decrypt the new encryption which is currently on canary and on some main clients. Lucky you I'm not a moron that grabs tokens. Keep messing with the leveldb if you want to keep users actually secure
A config that every program can just rewrite... really? I get development is hard but I'm sure you can do better. This "Token Protector" is super easy to bypass & destroy
While I realize that does indeed sound fairly negative, my intentions are good and I'd love to talk with you somewhere, discord or whatever platform you prefer, to make this tool better and especially actually secure people against leveldb grabs bc discord failed really hard on that one. It took me a solid 15 minutes to get that decrypted. lmk if & where you'd like to talk about this further. Discord completely ignored me when I told them (in an actual professional way unlike here) that their new code sucks ass