NProtect GameGuard

Infobox Software
name = nProtect GameGuard



caption =
collapsible =
author =
developer = INCA Internet Co., Ltd.
released =
latest release version =
latest release date =
latest preview version =
latest preview date =
frequently updated = yes
programming language =
operating system = Microsoft Windows
platform =
size =
language = C++
status = Active
genre = Anti-cheating
license = Proprietary
website = [http://gameguard.nprotect.com/ gameguard.nprotect.com]

nProtect GameGuard (sometimes called GG) is an anti-cheating application developed by INCA Internet. It is bundled with many multiplayer online games such as Phantasy Star Universe, MapleStory, Gunbound, , Sudden Attack, FlyFF, Ragnarok Online, Ran Online, Silkroad Online, and 9dragons to block malicious applications and common methods of cheating. nProtect GameGuard provides B2B2C security services for online game companies and portal sites and currently holds 90% of the global game security marketshareFact|date=October 2008. nProtect GameGuard possesses a database on game hacks based on security references from more than 260 game clients. More than 100 million users connect to nProtect GameGuard daily through more than 300 gamesFact|date=October 2008. Some editions of GameGuard are now bundled with INCA Internet's Tachyon anti-virus/anti-spyware library, and others with nProtect KeyCrypt, an anti-keylogger software that protects the keyboard input information. nProtect GameGuard hides the game application process, monitors the entire memory range, terminates applications defined by the game vendor and INCA Internet to be cheats, blocks certain calls to DirectX functions and Windows APIs, and auto-updates itself to change as new threats surface. nProtect GameGuard is launched via GameMon.des with a driver dump_wmimmc.sys.

ystem Requirements

Known games running GameGuard

*10003b
*2Moons (revision 1059)
*9Dragons (revision 1057)
*Albatross18
*BOTS (revision 1057)
*Cabal Online
*Cal Ripken's Real Baseball
*Counter-Strike Online
*Cronous
*CTRacer
*Dance! Online
*Dark Arena
*Dark Story
*Darkeden
*Digimon RPG
*DragonGem
*Drift City (revision 1205)
*Dungeon & Fighter
*Exteel
*FlyFFcite web|title=partner.htm|url= http://eng.nprotect.com/partner.htm|publisher = INCA Internet Co., Ltd.|format = htm|accessdate= 27 August|accessyear=2007] (EU: revision 1122)
*ExteelFifa Online 2
*Gersang
*Grand Chase
*GunBound
** GIS (revision 1226) cite web|title=partner.htm|url= http://eng.nprotect.com/partner.htm|publisher = INCA Internet Co., Ltd.|format = htm|accessdate= 27 August|accessyear=2007]
** Europe (GOA, revision 1204)
*Gunster
*
*Heat Project
*Hyper Relay
*Ijji's Luminary
*Kart n'Crazy
*Legend of Mir 3
*Lineage IIcite web|title=partner.htm|url= http://eng.nprotect.com/partner.htm|publisher = INCA Internet Co., Ltd.|format = htm|accessdate= 27 August|accessyear=2007]
*Lunia
* Mabinogi
*MapleStory
** Korean (revision 1121)
** Japanese (revision 1105)
** South East Asia (revision 1154)
** Thai (revision 1105)
** Global (revision 1196)
** Europe (revision 1195)
*Monster Hunter Frontier
*Mu Online
*NaNaiMo Online
*Navy Field
*Neo-Steam
*OZ World
*PangPang Terrible
*Pangya
*Phantasy Star Online Blue Burst (PSOBB)cite web|title=partner.htm|url= http://eng.nprotect.com/partner.htm|publisher = INCA Internet Co., Ltd.|format = htm|accessdate= 27 August|accessyear=2007]
*Phantasy Star Universe (PSU)
*Priston Talecite web|title=partner.htm|url= http://eng.nprotect.com/partner.htm|publisher = INCA Internet Co., Ltd.|format = htm|accessdate= 27 August|accessyear=2007] (English version is running X-Trap)
*Project Torque
*Ragnarok Online
*Rahan
*Rakion (revision 1140)
*Ran Online
*Red Stone
*Risk Your Life (R.Y.L. Online)
*Rohan Online
*ROSE Online (revision 1127)
*Seal Onlinecite web|title=partner.htm|url= http://eng.nprotect.com/partner.htm|publisher = INCA Internet Co., Ltd.|format = htm|accessdate= 27 August|accessyear=2007]
*Shaiya
*Shot Online
*Silkroad Online
*Soldier Front
*Sudden Attack
*Trickster
*Warrock
*Xiah online

Known blocked applications

*Logitech G-series Keyboard Profiler (Profiler is required to use G-keys and any features) This software is no longer blocked.
*Ollydbg
*Almost all VNC servers, such as RealVNC (does not block or shut down, but disables input)
*Cheat Engine - Some strings and blocks of codes are detected, up to a buffer size of 512, so the names of some things can be changed to evade detection. Usually referred to as "Undetected Cheat Engine" (UCE) when it is not detected by nProtect GameGuard.
*The Core Media Player
*WhatPulse
*Outpost Firewall Pro
*Process Explorer
*Xpadder
*WPE Pro
*Tsearch
*Steam (content delivery) - Launching game through Steam, GameGuard reports Steam as a "Game Hack" and shuts down the game)
*Motherboard Monitor - (Reason unknown) Causes the software to crash
*SpeedFan - (Reason unknown) Core2 sensors report -27 degrees Celsius, Voltage and RPM drop to 0 when game is launched
*Filezilla - (Reason unknown) Causes the software to crash
*Eclipse - Does not start while GameGuard is running; works if it is already running on GameGuard initialization
*Zboard
*NetLimiter - Detected as a game hack, even if you stop the service and kill the process
*cFosSpeed - Detected as a game hack if "Traffic Shaping" is turned on
*Freenet - Closes Freenet node without warning.
* [http://www.americansys.com/ezmacros.htm EZ Macros] - Reports as a "Game Hack"
*AutoHotkey - (Created hotkeys do not work)
*Razer - Mouse drivers (mouse buttons mapped to keys will not function, scrollwheel ceases to function)
*ATI Tray Tools
*AVG Anti-Virus - Making many of the tray tool components report error.
* [http://techsuki.net/tokyoshot-v1/ TokyoShot Screenshotter] - (Reason unknown) Making it impossible to use the mouse for captures
* [http://techsuki.net/mal-updater/ Mal Updater] - (Reason unknown) Makes the software freeze and impossible to use
*Media Player Classic - Media doesn't play correctly and ends up crashing
*a-squared Anti-Malware
* [http://www.proxifier.com/ Proxifier] , [http://www.proxycap.com/ ProxyCap] , Aventail Connect and probably any SOCKS tunelling software - current version of GameGuard in Mu Online reports as a "Game Hack".
* [http://www.e-onsoftware.com/ Vue Series Rendering Software] - (Reason unknown) Attempts to close the software without further notice, if GameGuard is unable to close it the system freezes. Results in loss of all unsaved data and currently render progress.

Issues with GameGuard

There are issues with GameGuard regarding problems with other programs. Many of the problems have been solved or are in the process of being resolved. The nProtect GameGuard FAQ page is shown below in the External Links section.

Because of its method of actuation (very similar to a rootkit), it is criticized for being extremely invasive, often without knowledge of the end user. The software installs a device driver which is difficult to uninstall; even uninstalling the game will still leave some files hidden on the system, but it stays inactive without the game. In recent versions (revision 1007 and up), GameGuard fails to halt when the game ends, so GameGuard continues to use computer resources and inject code into processes. This is often unknown to the end-user, as GameGuard masks its CPU usage by hooking Windows system querying APIs. Most anti-virus vendors currently exclude nProtect GameGuard from their detection databases due to it being commercial software, however this was initially not the case, leading to system crashes as both the Antivirus and GameGuard attempted to override each other.

Many hackers attempt to find ways to compromise GameGuard in new ways. For example, it has been said that GameGuard can still be compromised by using modified game client files, modified versions of Cheat Engine coupled with server emulation utilities. nProtect GameGuard constantly updates itself and provides new protection against the latest threats. Even though it boasts such effectiveness, in truth hackers can break or bypass GameGuard faster than it gets updated, therefore rendering the system quite useless. Especially from the number of sites out there utilizing 'bot' programs to flood the game to farm the ingame currency & rare items, which are then sold for real money. Such sites and 'bots' have been known to be up and running again, having bypassed GameGuard, within an hour of its latest update.

On some games such as MapleStory, the game itself does a hash check of the GameGuard revision currently running and will exit if it does not match the hash on the server side. This is a security measure from nProtect GameGuard to ensure that GameGuard has not been hacked and nProtect GameGuard should update to the latest version under normal circumstances.

Because of the way that GameGuard hooks into core system DLLs, it is impossible to run games protected by GameGuard under a replacement Windows API, such as Wine.

References

External links

* [http://www.gameguard.co.kr/gameguard/faq/eng/index.htm nProtect GameGuard FAQ Page]
* [http://gameguard.nprotect.com GameGuard Personal website]
* [http://eng.nprotect.com/nprotect_gameguard.htm nProtect GameGuard official website]
* [http://www.inca.co.kr/ INCA Internet official website]
* [http://www.securityfocus.com/bid/12280 Bugtraq ID: 12280 INCA nProtect Gameguard Unprivileged Arbitrary Read/Write Access Vulnerability]
* [http://www.brighthub.com/Video-Games/PC/articles/1709.aspx How To Remove nProtect Game Guard]