Index
This is an advanced topic, it may be helpful to read our Game Hacking Guide first as cheats, anti-cheats, and anti-cheat evasion all cover similar topics.
Obfscura - the ‘F’ is silent.
Obfscura is our in-house PE packer, mutator, and virtualizer.
Lets break down each part.
Packing
By leveraging the latest compression algorithms and our in-house reflective PE loader it is possible to reduce the PE size while destroying a lot of the original PE information. This completely hides the original PE from all on disk scanners and most in memory scanners.
Mutation
Due to anti-cheats frequently employing not only checksum/hash checks, but also looking for signatures of known cheats, it is necessary for code to be unique every time it is executed.
The following describes the core of Obfscura functionality:
- Load a given PE.
- Decompile and analyze all the functions, code paths, data, and attributes of a PE.
- Use a our in-house mutation engine powered by the iced disassembler and assembler to mutate every single assembly instruction.
- Recompile the entire program.
The output of this process is something akin to other more well-known mutators such VMProtect and Themida.
The breakthrough - due to not relying on high level tooling which leverages the extremely heavy LLVM we are able to mutate multi-gigabyte PE files in just seconds. Allowing for on-the-fly mutation on every download from the Warp website.
Virtualization
All conventional reverse engineering tooling relies on a safe assumption - all desktop CPUs execute the exact same standard set of assembly instructions commonly known as x86-64.
Virtualization breaks this assumption.
Code virtualization involves creating a Virtual Machine (aka VM) that uses a different architechture and/or set of (often randomized) assembly instructions.
The Warp Bypass
Traditional cheats
Detecting the presence of a hypervisor is trivial even from usermode (aka ring 3) by simply executing an assembly instruction that will cause a VM Exit and checking if it executed as fast as it would on real hardware.
To get around this issue Warp abuses the Microsoft Windows’ Hyper-V hypervisor.