AC #4 LNK8.fe11 [Trainer]

[Sora]

Hey , since new updates i became unable to run the game while Process Hacker is running

i don't really get it , why would you disallow such a program from running in background

i mean it's so useful and helpful , you shouldn't be blocking it from running with the game

Process Hacker :

A free, powerful, multi-purpose tool that helps you monitor system resources,

debug software and detect malware.

[toxicsmoke11]

probably cause you can edit proxy_sa.exe process with it.

[Towncivilian]

Yep, since Process Hacker is a tool used by cheaters and hackers you will have to discontinue use of it if you want to play MTA.

[mickdermack]

Are you serious? Anyone who has the ability to cheat using Process Hacker also is able to write a program in a language of their choice that does exactly what Process Hacker is able to do or just modify Process Hacker's source so it passes AC unnoticed. Process Hacker is not a tool making cheating easy (in contrast to CheatEngine and similar programs, or trainers specifically made for GTA:SA).

In my opinion this has just introduced an inconvenience for users using Process Hacker for legitimate purposes, e.g. as a great replacement for the Windows Task Manager. ("He's a cheater! How else could he trigger AC #4?" "WTF? I just opened my task manager...").

Blocking Process Hacker with AC #4 is a bit of an overkill. An SD disabled by default would be OK with me, but Process Hacker is definitely not a trainer.

... "A tool used by cheaters and hackers" ...

Why not block Windows Explorer, since even more cheaters and hackers use it?

If you mean "A tool primarily used by cheaters and hackers", that's not true. I'd say it's used by people who got a bit of technical knowledge and want a tool that can do things the Windows Task Manager can't (list sockets, give more control over services, ...).

Yes, you could edit proxy_sa.exe with ProcessHacker. Not exactly straightforward procedure, and one couldn't do much without either crashing the game or triggering some AC check, but it worked, until the introduction of SD #26, where it entirely ceased going unnoticed.

[Towncivilian]

If Process Hacker triggered some anticheat measure in a Steam game, would you still continue to use it?

What is the benefit of Process Hacker vs. Process Monitor?

[Sora]

I'm not using it for cheating or anything related

i use it for detecting malwares and and such things and mickdermack said all what i needed to say , thank you!

..

Why don't you just leave it running but if it modified the game or something the player would be kicked out the game ?

[Blokker_1999]

And how do you suggest we detect if the game gets modified outside of MTA? If there was an easy way to do that than we did not have to ban any piece of software, we would just detect that.

Since PH allows you yo edit the memory, just like you can with Cheat Engine, should we start to allow CE as well? It may not be as user friendly at the start, but I'm certain that people who know where to find there memory addressess to edit would be able to do so in both PH and CE.

If you really need this level of resource monitoring while you should be having fun playing a game i would recommend using process explorer while playing game and swapping out for ph when not playing the game.

[mickdermack]

If Process Hacker triggered some anticheat measure in a Steam game, would you still continue to use it?

Process Hacker will never trigger an anticheat measure in a Steam game using VAC 2. VAC 2 only bans for cheating.

There was one case where having Process Hacker open while playing DotA 2 would get one's account suspended for a month for use of an external tool, but that was reported and fixed.

(Not to be seen as a real argument, but: If they don't see it as a serious threat, why should we?)

What is the benefit of Process Hacker vs. Process Monitor?

Assuming you just confused Process Explorer and Process Monitor.

One advantage of Process Hacker over Process Explorer is, that it is being actively developed. Also, Process Hacker is expandable using plugins, got a feature called "Terminator" which can really help for ending hung processes (or processes trying to prevent itself from being closed), it has some more options for highlighting processes, it lets you search the name of a process on the internet, or send a file to 3 different online virus scanners from the context menu, it provides control over services and notifies you if a service gets created or deleted, it provides a list of all open sockets/connections and is, in my opinion, more pleasant to look at.

Were that enough benefits?

And how do you suggest we detect if the game gets modified outside of MTA? If there was an easy way to do that than we did not have to ban any piece of software, we would just detect that.

You already have at least two types of countermeasures in place, one of which got quite hard to bypass with the introduction of SD #26. The other one I thought of, VF #...(8 I guess?) (Code integrity checks), is hard to bypass with Process Hacker, too. And probably at least one more preventing modification of game data.

Since PH allows you yo edit the memory, just like you can with Cheat Engine, should we start to allow CE as well?

No. One of CheatEngine's main functionalities is searching for values in memory and/or modifying them.

Process Hacker doesn't have the searching part and many other things Cheat Engine does have, because the idea is a different one.

Also, editing memory is mostly prevented through the component that triggers SD #26 if it's stopped.

It may not be as user friendly at the start, but I'm certain that people who know where to find there memory addressess to edit would be able to do so in both PH and CE.

Again, editing memory, especially memory that is changing is hard to do with Process Hacker. No experiments performed, but I suspect that Process Hacker writes the entire region of memory, not just the things that changed, and that doesn't go very well in rapidly changing memory areas, where after clicking Write, the program will most likely spontaneously crash. Assuming someone managed to bypass SD #26 using Process Hacker (which would be most likely very hard to do), areas watched by the aforementioned VF #something are not easy to edit either, since getting timing right while switching between programs isn't that easy (a bit more so in window mode, but still, someone changing MTA code in-memory has to have a good bit of knowledge in x86 Assembly, and is very likely able to avoid using Process Hacker by either using some less-known alternative or writing a program of their own).

Just another question: Do you know anyone using Process Hacker for cheating in MTA and succeeding?

[solidsnake]

Use any AV for detecting malware no excuses! & Process explorer for monitoring

[Woovie]

It doesn't matter if it is _hard_ to edit memory. If it can, we don't allow it. Also, there wasn't a need to bump this topic. As I see it, our answer has been given.