REVERSE ENGINEERING CALL OF DUTY ANTI-CHEAT

Summary from the TLDR InfoSec newsletter

An in-depth look at the user-mode Treyarch Anti-Cheat (TAC) system used in Call of Duty Black Ops Cold War. The system uses Arxan as an obfuscation/protection tool which includes features such as runtime executable decryption, continuous executable checksum monitoring, Jmp and entry point obfuscation, and pointer encryption. Layered on top of this is TAC, which features various anti-cheat systems like network monitoring, API hook detection, debug register detection, anti-debugging capabilities, visuals detection, and custom syscall encryption, among others, and terminates the process on detection.