khalla/sacred_k
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Anti-cheat checks removed

Browse Source 
All mirror checks are skipped by code patches (the game's own "not the local
hero" paths, or straight past the check), the level trap in Think and
VerifyHeroMirror are off, the cheater flag is never set (stream checks,
loadHero, character selection). The VirtualProtect mirror refresh is gone; it
never refreshed the second mirror, a separate heap block, which killed the
hero again.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
khallaandClaude Opus 5.5 committed 2026-10-25 11:36:42 +01:00
1 parent b452558122
commit 34cacefcfc
2 files changed
+92 -108
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/anticheat.md
+50 -25
View File
@@ -1,10 +1,11 @@
# Anti-cheat off
# Anti-cheat removed
## Request (2026-10-25)
The Gladiator (Character03, level 106) "randomly exploded" fighting an
underleveled dragon on Silber. The user: the cheater detection is not
necessary, remove it.
necessary, remove it. After a second explosion: "i want all that weird
cheater detection code gone".
## Measured
@@ -13,23 +14,25 @@ one tick, with the game logging `cheat statBonus 0/3`, `cheat SkillLevel 0..7`,
`Hase!` and `cObjectManager::destroy: tried to delete local hero #1!`; the hero
came back with 1199 health and died to the next hit.
- The game mirrors the local hero's fields on a protected page (pointers
`0x182cddc`, second copy `0x182cde0`): +0 hero +0x3b4, +4 hero +0x3ee (gold),
+8 hero +0x3fe (u16), xor-ed with the hero's key byte (+0x38) repeated four
times (the second copy: key << 1); +0xc a raw copy of hero +0x3b0..+0x49d
(attributes, skill levels). Writer: `0x603d9c` and other places after
legitimate changes, all starting with `VirtualProtect(page, 0x1000,
PAGE_READWRITE)` and ending with `0x201`.
- The game mirrors the local hero's fields (pointers `0x182cddc`, on a
protected page, and `0x182cde0`, a separate heap block: `HeapAlloc` 0x1000
at `0x816541`): +0 hero +0x3b4, +4 hero +0x3ee (gold), +8 hero +0x3fe (u16),
xor-ed with the hero's key byte (+0x38) repeated four times (the second
copy: key << 1); +0xc a raw copy of hero +0x3b0..+0x49d (attributes, skill
levels). Writer: `0x603d9c` and about 30 inline copies after legitimate
changes, all starting with `VirtualProtect(page, 0x1000, PAGE_READWRITE)`
and ending with `0x201`.
- Checks: `cCreature::Think` about once in 101 ticks (`rand() % 101 == 10`,
`0x5389b5`), `VerifyHeroMirror` `0x5905f0` (callers `0x57fc71`,
`0x580001`, `0x580331`, `0x61ce22`), inline copies at `0x4659f6`,
`0x564c6f`, `0x57e09c`, `0x585bd0`, `0x619d33`, and a trap in Think
(`0x5385a6`: a creature whose level exceeds its experience by more than 3
gets fields raised behind the mirror's back). A mismatch resets the field
(attributes 1, skill levels 0); any mismatch, or no hero at all, kills the
hero ("*** Cheater detected! ***", health 0, action dying) and sets the
cheater flag `0x182cdd0`, saved in the hero file (record +0xf3, `0x604409`)
and read back by loadHero (`0x6066eb`).
(`0x5385a6`: a hero whose level exceeds its experience's by more than 3
gets +0x3b4 / +0x3ee / +0x3fe raised behind the mirrors' back). A mismatch
resets the field (attributes 1, skill levels 0); any mismatch, or no hero at
all, kills the hero ("*** Cheater detected! ***", health 0, action dying)
and sets the cheater flag `0x182cdd0`, saved in the hero file (record +0xf3,
`0x604409`) and read back by loadHero (`0x6066eb`) and the character
selection (`0x70da99`, from the record's mark +0x3ef).
- Stream checks in the quest manager's hero data (`0x465980`): a marker
`0xfea4fea4` (`0x467782`) and three stored values compared with the hero
(`0x46a60b`, `0x46a64e`, `0x46a696`).
@@ -37,15 +40,37 @@ came back with 1199 health and died to the next hit.
(changes outside the game's mirror writers, e.g. the shared hero loaded into
another world).
## Mod (`src/mods/anticheat.cpp`)
## History
- `VirtualProtect` hook: when the mirror page is made writable, the mirror is
rewritten from the current hero first. Checks then compare the hero with
itself; writers overwrite it as before. The game's control flow is
unchanged (skipping the inline checks would not be safe: code after some of
them uses registers they set).
- Patches: the stream checks' jumps past the punishment are unconditional;
loadHero never sets the cheater flag (a flagged character is clean after its
next save).
- First mod (confirmed): a `VirtualProtect` hook rewrote the mirror from the
hero whenever a check opened its page, so checks compared the hero with
itself.
- The hero exploded again (`Hase!` twice, no `cheat statBonus` / `SkillLevel`
line): the hook refreshed the second mirror only if it lay on the protected
page, so never; the checks compare its three xor-ed fields after the first
mirror (e.g. `0x585f83`) without a log line. Refreshing both fixed it (user:
"i no longer explode").
- Then the checks were removed entirely (below), the hook is gone.
Confirmed by the user 2026-10-25 (attributes fine, no more exploding).
## Mod (`src/mods/anticheat.cpp`): checks removed
Every check is skipped by a code patch (`re::ReplaceAll`): no field is reset,
no hero killed, the cheater flag never set.
| Check | Patch |
|---|---|
| Think trap `0x5385a6` | `0x5385ca` `jle` -> `jmp` |
| Think, 1 tick in 101 (`0x5389be`) | `0x5389b8` `jne` -> `jmp` |
| `0x564c6f`, `0x57e09c`, `0x585bd0` | the "not the local hero" `jne` before each (`0x564c50`, `0x57e07d`, `0x585bb0`) -> `jmp`: the game's own path past the check |
| quest manager hero data `0x4659f6` | `0x4659dc` `jmp 0x46606b` (the code there writes esi / edi before reading them; the stream keeps its clean marker 0xfeedf00d) |
| `0x619d33` | `mov ebp, [esp+0x34]; jmp 0x61a2de`, the registers as the check leaves them (edi already 0x88e874) |
| `VerifyHeroMirror` `0x5905f0` (callers test al) | `mov al, 1; ret` |
| stream checks `0x467782`, `0x46a60b`, `0x46a64e`, `0x46a696` | jumps past the punishment unconditional |
| loadHero `0x6066eb` | writes 0 to the cheater flag |
| character selection `0x70da8c` | `setne cl` -> `xor cl, cl` |
All field resets (`mov [reg+0x3b4], 1` ...) lie inside these checks; all
writes of the flag `0x182cdd0` (`0x465ebe`, `0x538e53`, `0x56508a`,
`0x57e528`, `0x57fcfd`, `0x58008d`, `0x5803bd`, `0x586090`, `0x61a17e`,
`0x61ceac`) are their punishments. The mirror writers stay: they only fill
the now unread mirrors.
src/mods/anticheat.cpp
+42 -83
View File
@@ -1,31 +1,23 @@
// The game's anti-cheat is off (request of 2026-10-25, after the Gladiator
// "randomly exploded" fighting a dragon on Silber).
// The game's anti-cheat is gone (requests of 2026-10-25: the Gladiator
// "randomly exploded" fighting a dragon on Silber; then "i want all that weird
// cheater detection code gone"). docs/anticheat.md.
//
// Measured: the game keeps a mirror of the local hero's attribute / skill
// fields on a protected page (pointers 0x182cddc and 0x182cde0, see
// RefreshMirror). Checks compare the hero with it - cCreature::Think about once
// in 101 ticks (0x5389be), VerifyHeroMirror 0x5905f0 (4 callers) and inline
// copies at 0x4659f6, 0x564c6f, 0x57e09c, 0x585bd0, 0x619d33 - reset every
// mismatching field (attributes to 1, skill levels to 0), and on any mismatch
// kill the hero ("*** Cheater detected! *** Hase!") and set the cheater flag
// 0x182cdd0, saved in the hero file (record +0xf3). The log showed the hero at
// full health dying with every skill level mismatching: the mirror was stale
// (any change the game does not route through its own mirror writers, e.g.
// loading the shared hero into another world, leaves it behind).
// Measured: the game keeps two xor-ed mirrors of the local hero's attribute /
// skill / gold fields (0x182cddc on a protected page, 0x182cde0 a heap block),
// written after every legitimate change. Checks compare the hero with them,
// reset every mismatching field (attributes to 1, skill levels to 0) and on
// any mismatch kill the hero ("*** Cheater detected! *** Hase!") and set the
// cheater flag 0x182cdd0, which the hero file keeps. Any change the game does
// not route through its mirror writers (e.g. loading the shared hero into
// another world) made the checks fire.
//
// The mod: every check and every mirror writer starts with
// VirtualProtect(mirror, 0x1000, PAGE_READWRITE); at that moment the mirror is
// refreshed from the hero, so checks compare the hero with itself and writers
// overwrite it as before. The stream checks of the quest manager's hero data
// (a cheat marker 0xfea4fea4 and three stored values) never punish, and loading
// a hero file no longer sets the cheater flag.
#include <windows.h>
// The mod: every check is skipped through the game's own path for "not the
// local hero" (or straight to the code after the check, with the registers that
// code reads), so no field is reset and no hero killed; the cheater flag is
// never set. The mirror writers stay (they only fill the unused mirrors).
#include <cstdint>
#include <cstring>
#include "game/engine/objects.h"
#include "re/hook.h"
#include "re/log.h"
#include "re/patch.h"
@@ -33,77 +25,44 @@
namespace mods::anticheat {
namespace {
// Mirror layout (writer 0x603d9c): +0 hero +0x3b4, +4 hero +0x3ee (gold),
// +8 hero +0x3fe (u16), each xor-ed with the hero's key byte (+0x38) repeated
// four times; +0xc a copy of hero +0x3b0..+0x49d. The second mirror uses the
// key shifted left by one.
constexpr uintptr_t kMirrorPointer = 0x0182cddc;
constexpr uintptr_t kSecondMirrorPointer = 0x0182cde0;
constexpr size_t kHeroKey = 0x38;
constexpr size_t kField0 = 0x3b4;
constexpr size_t kGold = 0x3ee;
constexpr size_t kField2 = 0x3fe; // u16
constexpr size_t kCopyStart = 0x3b0;
constexpr size_t kCopySize = 0x3b * 4 + 2; // rep movsd 0x3b + movsw
constexpr size_t kMirrorCopy = 0xc;
constexpr size_t kPageSize = 0x1000;
uint32_t U32(const uint8_t* p) {
uint32_t v;
std::memcpy(&v, p, 4);
return v;
}
void WriteMirror(uint8_t* mirror, const uint8_t* hero, uint32_t key) {
const uint32_t values[3] = {U32(hero + kField0) ^ key, U32(hero + kGold) ^ key,
(U32(hero + kField2) & 0xffff) ^ key};
std::memcpy(mirror, values, sizeof values);
std::memcpy(mirror + kMirrorCopy, hero + kCopyStart, kCopySize);
}
// The page is writable when this runs (inside VirtualProtect below).
void RefreshMirror(uint8_t* page) {
const auto* hero = static_cast<const uint8_t*>(game::GetPlayerHero());
if (!hero) {
return;
}
const uint32_t keyByte = hero[kHeroKey];
const uint32_t key = keyByte | keyByte << 8 | keyByte << 16 | keyByte << 24;
WriteMirror(page, hero, key);
auto* second = *reinterpret_cast<uint8_t**>(kSecondMirrorPointer);
if (second >= page && second + kMirrorCopy + kCopySize <= page + kPageSize) {
WriteMirror(second, hero, key << 1);
}
}
constexpr re::CodeReplacement kNoStreamPunishment[] = {
// cheat marker 0xfea4fea4 read: `jne` past the punishment -> `jmp`
constexpr re::CodeReplacement kNoAntiCheat[] = {
// cCreature::Think: the trap for a level more than 3 above the experience's
// (raises fields behind the mirrors' back): `jle` past it -> `jmp`
{0x005385ca, {0x0f, 0x8e, 0xd8, 0x03, 0x00, 0x00}, {0xe9, 0xd9, 0x03, 0x00, 0x00, 0x90}, 6},
// cCreature::Think: the check in 1 of 101 ticks: `jne` past it -> `jmp`
{0x005389b8, {0x0f, 0x85, 0x0d, 0x06, 0x00, 0x00}, {0xe9, 0x0e, 0x06, 0x00, 0x00, 0x90}, 6},
// inline checks behind "is this the local hero": `jne` past them -> `jmp`
{0x00564c50, {0x0f, 0x85, 0x89, 0x05, 0x00, 0x00}, {0xe9, 0x8a, 0x05, 0x00, 0x00, 0x90}, 6},
{0x0057e07d, {0x0f, 0x85, 0xd8, 0x05, 0x00, 0x00}, {0xe9, 0xd9, 0x05, 0x00, 0x00, 0x90}, 6},
{0x00585bb0, {0x0f, 0x85, 0x55, 0x06, 0x00, 0x00}, {0xe9, 0x56, 0x06, 0x00, 0x00, 0x90}, 6},
// the quest manager's hero data writer: past the check to 0x46606b (it
// writes registers before reading them; the stream keeps its clean marker)
{0x004659dc, {0x8b, 0x0d, 0xc0, 0x3b, 0xad, 0x00}, {0xe9, 0x8a, 0x06, 0x00, 0x00, 0x90}, 6},
// 0x619d33: past the check to 0x61a2de with ebp as the check leaves it
// (`mov ebp, [esp+0x34]`; edi already holds 0x88e874)
{0x00619d33, {0x8b, 0x0d, 0xdc, 0xcd, 0x82, 0x01}, {0x8b, 0x6c, 0x24, 0x34, 0x90, 0x90}, 6},
{0x00619d39, {0x8d, 0x44, 0x24, 0x14, 0x50}, {0xe9, 0xa0, 0x05, 0x00, 0x00}, 5},
// VerifyHeroMirror (0x5905f0, plain ret, 4 callers test al): `mov al, 1; ret`
{0x005905f0, {0x51, 0x8b, 0x0d}, {0xb0, 0x01, 0xc3}, 3},
// stream checks of the quest manager's hero data: the cheat marker
// 0xfea4fea4 read (`jne` past the punishment -> `jmp`) and three stored
// values compared with the hero (`je` -> `jmp`)
{0x00467782, {0x0f, 0x85, 0xbd, 0x01, 0x00, 0x00}, {0xe9, 0xbe, 0x01, 0x00, 0x00, 0x90}, 6},
// stored values compared with the hero: `je` past the punishment -> `jmp`
{0x0046a60b, {0x74, 0x18}, {0xeb, 0x18}, 2},
{0x0046a64e, {0x74, 0x18}, {0xeb, 0x18}, 2},
{0x0046a696, {0x74, 0x18}, {0xeb, 0x18}, 2},
// loadHero: the hero file's cheater flag (`mov byte [0x182cdd0], 1` -> 0)
{0x006066eb, {0xc6, 0x05, 0xd0, 0xcd, 0x82, 0x01, 0x01}, {0xc6, 0x05, 0xd0, 0xcd, 0x82, 0x01, 0x00}, 7},
// character selection: the flag from the hero record's mark (+0x3ef):
// `setne cl` -> `xor cl, cl`
{0x0070da8c, {0x0f, 0x95, 0xc1}, {0x32, 0xc9, 0x90}, 3},
};
void Startup() {
const int failed = re::ReplaceAll(kNoStreamPunishment);
re::Log("anticheat: off (%d patches failed)", failed);
const int failed = re::ReplaceAll(kNoAntiCheat);
re::Log("anticheat: removed (%d patches failed)", failed);
}
RE_STARTUP(AntiCheatStartup, Startup);
} // namespace
} // namespace mods::anticheat
BOOL WINAPI VirtualProtectMirrorFresh(LPVOID address, SIZE_T size, DWORD protect, PDWORD old);
RE_HOOK_API(VirtualProtect, VirtualProtectMirrorFresh);
BOOL WINAPI VirtualProtectMirrorFresh(LPVOID address, SIZE_T size, DWORD protect, PDWORD old) {
const BOOL result = VirtualProtectMirrorFresh_original(address, size, protect, old);
auto* mirror = *reinterpret_cast<uint8_t**>(mods::anticheat::kMirrorPointer);
if (result && protect == PAGE_READWRITE && mirror && address == mirror) {
mods::anticheat::RefreshMirror(mirror);
}
return result;
}