NProtect GameGuard
This article needs additional citations for verification. (June 2008) |
nProtect GameGuard logo | |
Developer(s) | INCA Internet Co., Ltd. |
---|---|
Operating system | Microsoft Windows |
Available in | C++ |
Type | Anti-cheating software |
License | Proprietary |
Website | gameguard.nprotect.com |
nProtect GameGuard (sometimes called GG or RonnieCordova, with a driver dump_wmimmc.sys - launched via GameMon.des) is a game anti-cheating software developed by INCA Internet. It is bundled with many multiplayer online games such as Phantasy Star Universe, MapleStory, Gunbound, GunZ: The Duel, Sudden Attack, FlyFF, Ragnarok Online and 9dragons to block certain applications and common methods of cheating. Some editions of GameGuard are now bundled with Norton's "Tachyon" anti-spyware library, and others with nProtect KeyCrypt (advertised as anti-keylogger software). KeyCrypt is used to emulate keyboard hardware to block macro programs, but is currently not capable of blocking keyloggers.[1] It hides the game application process, monitors the entire memory range, terminates applications defined by the game vendor and INCA to be cheats, blocks certain calls to DirectX functions and Windows APIs and auto-updates itself to change as new threats surface. Even with these measures, GameGuard can still be compromised by using modified game client files, modified versions of Cheat Engine coupled with server emulation utilities. On some games such as MapleStory, the game itself does a hash check of the GameGuard revision currently running and will exit if it does not match the hash on the server side.
Because of its method of actuation (similar to a rootkit), it is criticized for being too invasive. The software installs a device driver and offers no way to uninstall it; even uninstalling the game will still leave some files hidden on the system. In recent versions (revision 1007 and up), GameGuard fails to halt when the game ends, so GameGuard continues to use resources and inject code into processes. This is usually not noticeable to the end-user, as GameGuard masks its intense CPU usage by hooking Windows system querying APIs. Most anti-virus vendors exclude nProtect GameGuard from their detection databases due it being commercial software.
GameGuard is sometimes cited by users of a specific game as unusable because of numerous errors when attempting to run a game, including the infamous "Error 114," which details that the device driver dump_wmimmc.sys has failed to load, thus not allowing GameMon.des to fully initialize.
GameGuard also conflicts with Windows Vista, causing the OS to be recognized by Microsoft as not genuine. This has been fixed with a patch, but many games have not applied this patch yet. It also conflicts with the current version of Comodo Firewall Pro, causing the computer to reboot unless Defence+ in Comodo is turned off. [2]
Known games running GameGuard
- 2Moons (revision 1059)
- 9Dragons (revision 1057)
- Albatross18
- BOTS (revision 1057)
- Cabal Online
- Dance! Online
- Darkeden
- Digimon RPG
- Drift City (revision 1053)
- Exteel
- Soldier Front
- FlyFF[3] (EU: revision 1122)
- Grand Chase
- GunBound
- GIS (revision 1086) [3]
- Europe (GOA, revision 1204)
- GunZ: The Duel
- HEAT Project
- Kart n'Crazy
- Korean WarRock
- Lineage II[3]
- Lunia
- Mabinogi
- MapleStory
- Korean (revision 1121)
- Japanese (revision 1105)
- South East Asia (revision 1154)
- Thai (revision 1105)
- Global (revision 1196)
- Europe (revision 1195)
- Monster Hunter Frontier
- Mu Online
- NaNaiMo Online
- Pangya
- Phantasy Star Online Blue Burst[3]
- Phantasy Star Universe
- Priston Tale[3] (English version is running X-Trap)
- Project Torque
- Ragnarok Online
- Rakion (revision 1140)
- Ran Online
- Risk Your Life
- Rohan Online
- ROSE Online (revision 1127)
- SEAL Online Reload[3]
- Shaiya
- Silkroad Online
- Soldier Front
- Sudden Attack
- Trickster
- Xiah online
Known blocked applications
- Logitech G-series Keyboard Profiler (profiler is required to use G-keys and any features) This software is no longer blocked.
- Ollydbg
- Almost all VNC servers, such as RealVNC (does not block or shut down, but disables input)
- Cheat Engine (some strings and block of codes are detected, even buffer of a size 512, so the names of some things can be changed to evade detection. Most people called it Undetected Cheat Engine (UCE) when it is not detected by nProtect GameGuard.)
- The Core Media Player
- WhatPulse
- Outpost Firewall Pro
- Process Explorer
- Xpadder
- WPE Pro
- Tsearch
- Steam (content delivery) (Launching game through Steam, nProtect reports Steam as "Game Hack" and shuts down the program that uses nProtect)
- Motherboard Monitor (reason unknown, causes the software to crash)
- SpeedFan (reason unknown, Core2 Sensors say -27C, Volt and RPM become 0 when game is launched)
- Filezilla (reason unknown, causes the software to crash)
- Eclipse can't start, if running when starting nProtect everything is fine
- Examples of of game client modification to evade GameGuard
- Zboard
- NetLimiter (detected as a game hack, even if you stop the service and kill the process)
- cFosSpeed (detected as a game hack if you use "Traffic Shaping")
- Freenet closes Freenet node without warning.
- EZ Macros reports it as Game Hack
- AutoHotkey (created hotkeys is not working)
- Razer mouse drivers (mouse buttons mapped to keys will not function, scroolwheel ceases to function)
- ATI Tray Tools
References
- ^ "nprotect_gameguard.htm" (htm). INCA Internet Co., Ltd. Retrieved 27 August.
{{cite web}}
: Check date values in:|accessdate=
(help); Unknown parameter|accessyear=
ignored (|access-date=
suggested) (help) - ^ Comodo Forum thread "Gameguard + Comodo = Computer reboot ", begun April 23, 2008.
- ^ a b c d e f "partner.htm" (htm). INCA Internet Co., Ltd. Retrieved 27 August.
{{cite web}}
: Check date values in:|accessdate=
(help); Unknown parameter|accessyear=
ignored (|access-date=
suggested) (help)
External links
- nProtect GameGuard official website
- INCA Internet official website
- Bugtraq ID: 12280 INCA nProtect Gameguard Unprivileged Arbitrary Read/Write Access Vulnerability
- How To Remove nProtect Game Guard