Hacker News Reader

Comment by Retr0id | Hacker News Reader

> Just recompile the kernel and change the functions it uses to hide the possible cheat and bypass all checks.

You can do this on macOS too, by the way. XNU is open-source.

… well, technically speaking, most of it is open source. However, some parts regarding Apple Pay, FileVault, FairPlay DRM, any iOS compatibility, it’s excised.

Right, but you can splice your recompiled version back into the original binary, complete with proprietary components. I've done this before, maybe I should write up the process.

With SIP enabled?

For my particular use case I disabled SIP and everything was fine, but workarounds should be possible.

Please do!

Is that really true?

How would one get the modified XNU past the verified-boot process? Turn off verified boot?

The overall process is documented here: https://kernelshaman.blogspot.com/2021/02/building-xnu-for-m...

Good luck booting a custom kernel with SIP enabled, and I'm pretty sure any anti-cheat will nope out immediately if SIP is disabled.

So intercept whatever mechanism it's using to detect SIP enabled status...?

You would have to somehow compromise the security coprocessors, even on Android where more of the system is open source, Play Integrity relying on this has killed pretty much all methods of tricking application code that the system is stock outside of downgrade attacks (by convincing the application the phone doesn't support newer verification methods).

We can run tasks on them that only produces valid output if the boot chains is verified.

If Apple launches an attestation API that has key material that they control on the hardware co-processor that it authenticates with Apple servers and passes the result back to the game server, then there's no mechanism to intercept it.

You do have to disable it, but you can patch the kernel to lie to userland about SIP status.

Reply on news.ycombinator.com