Cheat Engine Modifier Detection Solutions

In the process of game security confrontation, there are a number of cheats whose implementation is based on modifying game memory modules, and such cheats usually use “Memory Modification Cheats”.

According to JikGuard game security statistics, among the many security risks faced by games, modifiers account for as much as 16%. With such a high percentage, the seriousness of the damage caused by modifiers can be seen.
There are various types of modifiers, and they can be found in different systems. For example, GameGuardian modifier for Android, iMemEditor modifier for iOS, and Cheat Engine modifier for PC. In this article, we will focus on the principles and solutions of Cheat Engine modifiers.

Cheat Engine (CE for short) is a powerful game memory modifier. It can be used to scan the game's memory and perform modification, locking and other operations. It also comes with debugger, disassembler, assembler, shifter, system checker and other functions.
Memory scanning is one of the most important functions of Cheat Engine. The principle of its realization is to locate the memory of the game through repeated searches, and after confirming the memory address, it will perform editing, locking and other operations to realize a series of cheats functions.

For example, by locating the blood level of the operable characters in the game and locking the memory, you can realize the “invincibility cheat”, and by modifying the attack power of the characters in the game, you can realize the “killing cheat”, etc. The Cheat Engine modifier scans the memory to make sure that the characters have the right level of blood level.
In addition to memory modification, Cheat Engine also comes with a speed hack function, which can be used to change the speed of the game through the Hook game-related functions to realize the global acceleration/deceleration function.
Cheat Engine comes with a “Cheat Table” function, which can export/import stored memory addresses, Lua scripts, and code locations in a .CT file. Cheat users can share/download the cheats in the Cheat Engine community, which lowers the threshold of using the cheats, but also makes the cheats even more prevalent. This lowers the threshold of use and makes cheating more widespread.

In addition, Cheat Engine has the following detection difficulties:

■ The trend of high-dimensional cheating is significant. JikGuard found that some cheating users use Cheat Engine to modify mobile games running in PC emulators and sell their cheats. This kind of high-dimensional cheating bypasses traditional detection methods, making it more difficult to detect and investigate.

■ Complexity of the cheating situation, compared with the mobile terminal, the permissions of the PC terminal are more open, and the Cheat Engine can debug and analyze the game and hide itself by combining with other tools.

JikGuard has developed a customized strategy to deal with the problems faced by game modifiers. The solution has been applied to a number of popular games and has proved to be an excellent protection tool.
 

Anti-Memory Modification

In response to the risk of memory modification faced by games, JikGuard has developed a behavioral detection solution that accurately identifies the behavior of memory modification and kills all kinds of modifier cheats and their variants, providing effective protection.
 

Active identification of malicious modules

Unlike other security products on the market, which require the acquisition of samples to combat cheats, JikGuard's exclusive “active identification of malicious module mechanism” can actively identify suspicious modules in the game, and with the online combat function to achieve proactive defense, significantly shortening the cheats detection cycle.
 

Anti-Speed Hack Function

Adopting more underlying detection means and tested by a large number of real machines, and will immediately flashback the game once it detects a speedhack situation.