Come detectare un cheat in Jar [SS Lessons]

Summary

This video tutorial outlines three fundamental methods to detect cheating in Java applications, specifically focusing on .jar files. The first method involves identifying a generative Hook file in the Temp directory. The second method leverages the use of Journal Trace to track file creation and deletion. The third method employs Win Prefet to monitor the processes associated with the Java executables. The presenter emphasizes the importance of these techniques for detecting cheats, even when traces are deleted, and provides practical demonstrations using tools like System Informer and Process Hacker.

Takeaways

• 🔎 The video explains three basic methods to detect cheats in a .jar file, excluding mods which were covered in a previous video.
• 📂 The first method involves detecting the creation of a generative Hook file in the Temp folder, which can indicate the use of a clicker cheat.
• 🚫 A limitation of the first method is that the generative Hook file can be easily deleted by a player, removing evidence of cheating.
• 🗒️ The second method suggests using the Journal directly instead of the Temp folder for more reliable detection of the generative Hook file.
• 📅 The video demonstrates using Journal Trace to show the creation time of the generative Hook file, providing a timestamp for the detection.
• 🛠️ Tools like System Informer or Process Hacker can be used to filter and detect the execution of a .jar file, such as a cheat.
• 🔍 Filtering by specific strings related to .jar files can help identify the execution of cheats, as shown in the video with 'DCC' and 'Punto Jar'.
• 💡 The third method involves using WinDbg or Process Explorer to view the processes and identify the Java executable that opened the suspected cheat file.
• 🗃️ By examining the process tree, one can determine if a Java executable was opened, which could indicate the use of a .jar file cheat.
• 🔄 The video mentions that even if traces are cleaned, the process of the Java executable can still reveal the use of a cheat.
• 👀 The importance of understanding these detection methods is emphasized for those who need to identify and address cheating in .jar files.

Q & A

What is the main topic of the video?

The video is about how to detect a cheat in a .jar file using three different methods.

Why does the speaker decide not to discuss 'Mods' in this video?

The speaker has already dedicated a separate video to discussing 'Mods', so it is not covered in this video.

What is the first method for detecting a cheat in a .jar file mentioned in the video?

The first method involves detecting the creation of a generative Hook file in the Temp folder.

What is a potential issue with the first detection method mentioned?

A potential issue is that if a player deletes the generative Hook file, there would be no evidence left to prove that a cheat was used.

What is the second method for detection that the speaker suggests?

The second method involves using the Journal directly to check for the creation of the generative Hook file.

How does the speaker describe the chronological order of events in the Journal tool?

The speaker mentions that the Journal tool, like other tools, is not capable of putting various events in the right chronological order due to the speed at which they happen.

What is the third method for detecting a cheat in a .jar file discussed in the video?

The third method involves using WinDbg or Process Hacker to filter for specific strings related to the .jar file and check the processes that were executed.

What is the speaker's opinion on the reliability of the first detection method?

The speaker believes the first method is not reliable enough because the evidence (the generative Hook file) can be easily deleted by the player.

What tool does the speaker suggest using to show the creation and deletion of the generative Hook file?

The speaker suggests using a tool like Journal Trace to visually represent the creation and deletion of the file.

How does the speaker explain the use of System Informer or Process Hacker for the third detection method?

The speaker explains that these tools can be used to filter for specific strings and processes, such as 'DCC' or 'DCOM Launcher', to detect the execution of a cheat .jar file.

What is the speaker's advice on finding the full path of a cheat .jar file when using the third method?

The speaker advises to take the full path from the process information and go to the folder to find the cheat .jar file, which might be on the desktop or another directory.