pcileech

There is hardware that you can simply plug into your PC, which can read and write arbitrary kernel memory. I have a feeling that kernel level anticheat isn't stopping someone who really wants to cheat. See https://github.com/ufrisk/pcileech

One of the better possible implementation cases really is usb-ip over thunderbolt-net. https://www.kernel.org/doc/html/v4.19/admin-guide/thunderbol... For reference, DisplayLink DL-5xxx has been doing 4k over USB since 2014. https://en.wikipedia.org/wiki/DisplayLink#DL-5xxx_(2014) Linux has had the pieces around for a while. Usb-device-mide gadgets in Linux can be connected to a usb-ip virtual port, so you can share virtual peripherals. The rest is regular networking. Wild but USB gadget mode has been around here and there in laptops for a long long time now, but has rarely ever been used. Here's a steamdeck acting as USB printer, https://hackaday.com/2023/01/31/steamdeck-become-printer/ Getting an add-in card that can do usb-device-mode / usb-client mode can be tricky but is possible. This capability seems standard on most single-board-

Not related to this game, but this has been a thing in the counter strike community for a few years already. This is an example cheat: https://github.com/EngineOwningSoftware/pcileech-webradar And this is the base repo it was forked from that goes into way more technical details: https://github.com/ufrisk/pcileech

I never heard of such a hardware device. For those interested, it looks like the parent is talking about devices like Screamer M.2 [0] paired with software like pcileech [1]. Can probably be useful for forensics. [0]: https://shop.lambdaconcept.com/home/43-screamer-m2.html [1]: https://github.com/ufrisk/pcileech

Yes, these cards are visible to the target's OS in their default configurations, as they appear in the PCIe configuration space at a minimum. While they can initiate DMA without the need for any OS-side drivers, an application with sufficient permissions can still locate them in the configuration tree. This is already part of the cat and mouse with game hackers, as they identify some of the standard PCIe VID/DIDs and at a second level, the PCIe configuration values for these cards. Beyond this, there are also a lot of ways using performance counters to see if memory is being accessed without the access being accounted for at the CPU level - https://github.com/ufrisk/pcileech/issues/107 has some documents around these approaches.

The short description of PCILeech: [1] > PCILeech is capable of inserting a wide range of kernel > implants into the targeted kernels - allowing for easy > access to live ram and the file system via a "mounted > drive". It is also possible to remove the logon password > requirement, loading unsigned drivers, executing code and > spawn system shells. PCIleech runs on Windows and Linux [1] https://github.com/ufrisk/pcileech (edit for formatting)

It's gone way past that. Some anticheat software runs in the kernel now. They are doing crazy things like looking for PCIe devices trying to DMA game memory. https://github.com/ufrisk/pcileech/blob/master/readme.md#har...

* Unless you get an Evil Maid attack [0], like adding a physical keylogger to the keyboard bus. If the device is decrypted but on lock screen (like with TPM) there are more options, the main one is reading memory via DMA [1] on an ExpressCard slot (eg the wifi card). Also swapping out the memory to do a cold boot attack [2] is possible. [0] https://en.wikipedia.org/wiki/Evil_maid_attack [1] https://github.com/ufrisk/pcileech [2] https://en.wikipedia.org/wiki/Cold_boot_attack

You can do it via PCIe as well. [1] 1. https://github.com/ufrisk/pcileech

Debugers have been already mentioned, but antiviruses do that, as well as various cheat and anti-cheat engines. From a security perspective, reading/writing another program's memory space is well understood as a specific, risky privilege, so in all modern OSes control and prevent that if it's not "your" process or unless you're root/admin already. But a cool thing for reading/writing another program's memory space is the ability to do that through PCI without the OS being able to intervene - e.g. Ulf Frisk's PCILeech (https://github.com/ufrisk/pcileech/), here's a video demo of writing to Notepad's memory remotely https://youtu.be/5DbQr3Zo-XY?t=1440

Based on the README, it looks like it's a partial fork/mod of this upstream repo [0], which is essentially set of tooling that "uses PCIe hardware devices to read and write target system memory". So if I'm reading this right, the partial fork has changes specifically to read CS:Go data directly out of device memory to another device, which in turn processes that data and renders a web-based map of all player locations. [0] https://github.com/ufrisk/pcileech

If you're serious about preventing exfiltration, you'll do what the military does and use data diodes https://en.wikipedia.org/wiki/Unidirectional_network On a slightly tangent, people with physical access to a server can extract encryption keys from RAM by plugging into a PCI slot: https://github.com/ufrisk/pcileech