├── README.md ├── uDebugDetector ├── README.md └── DebuggerDetector.cs ├── uSpeedHackDetector ├── README.md └── SpeedHackDetector.cs ├── debugdetector ├── README.md └── Program.cs ├── .gitattributes └── speedhackdetector ├── README.md └── Program.cs /README.md: -------------------------------------------------------------------------------- 1 | These unity scripts are about anti-speedhack and anti-debug. 2 | 3 | 这些unity 脚本是非常初级的反加速和反调试脚本，看上去简单但是总是有效，注意和加密配合哦。 4 | -------------------------------------------------------------------------------- /uDebugDetector/README.md: -------------------------------------------------------------------------------- 1 | uDebugDetector checks four flags of process to determine whether a debugger is attached on the process.It can detect different debugger including managed debugger.This can be used in any unity3d game. 2 | 3 | uDebugDetector通过检查四个标志位来检测程序本身是否正在被调试。 4 | -------------------------------------------------------------------------------- /uSpeedHackDetector/README.md: -------------------------------------------------------------------------------- 1 | uSpeedHackDetector calculates self time lapse and the system time laose in a period.Detector compares two values and determine whether an accelerator exists and influence the game. 2 | 3 | uSpeedHackDetector通过计算应用程序自身的时间流逝速度和系统外部时钟的流逝速度来检测是否被加速，在这个基础上以后还可以由服务器提供时间戳来进行更加准确的测量。 4 | -------------------------------------------------------------------------------- /debugdetector/README.md: -------------------------------------------------------------------------------- 1 | debugdetector checks four flags of process to determine whether a debugger is attached on the process.It can detect different debugger including managed debugger.This can be used in any C# program.For unity game,please see uDebugDetector. 2 | 3 | debugdetector通过检查四个标志位来检测程序本身是否正在被调试。可被用于大部分C#程序，对于Unity游戏需要使用uDebugDetector。 4 | -------------------------------------------------------------------------------- /.gitattributes: -------------------------------------------------------------------------------- 1 | # Auto detect text files and perform LF normalization 2 | * text=auto 3 | 4 | # Custom for Visual Studio 5 | *.cs diff=csharp 6 | 7 | # Standard to msysgit 8 | *.doc diff=astextplain 9 | *.DOC diff=astextplain 10 | *.docx diff=astextplain 11 | *.DOCX diff=astextplain 12 | *.dot diff=astextplain 13 | *.DOT diff=astextplain 14 | *.pdf diff=astextplain 15 | *.PDF diff=astextplain 16 | *.rtf diff=astextplain 17 | *.RTF diff=astextplain 18 | -------------------------------------------------------------------------------- /speedhackdetector/README.md: -------------------------------------------------------------------------------- 1 | SpeedHackDetector calculates self time lapse and the system time laose in a period.Detector compares two values and determine whether an accelerator exists and influence the game. 2 | This script can be used in any C# application,if you want to apply it into unity game,please see uSpeedHackDetector 3 | 4 | SpeedHackDetector通过计算应用程序自身的时间流逝速度和系统外部时钟的流逝速度来检测是否被加速，在这个基础上以后还可以由服务器提供时间戳来进行更加准确的测量。 5 | 6 | 这个脚本可以用于任何C#程序，如果要放入unity的话可以去看uSpeedHackDetector. 7 | -------------------------------------------------------------------------------- /debugdetector/Program.cs: -------------------------------------------------------------------------------- 1 | using System; 2 | using System.Collections.Generic; 3 | using System.Linq; 4 | using System.Text; 5 | using System.Threading.Tasks; 6 | using System.Diagnostics; 7 | using System.ComponentModel; 8 | using System.Runtime.InteropServices; 9 | using System.Threading; 10 | 11 | namespace debugdetector 12 | { 13 | class Mydetector 14 | { 15 | [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 16 | static extern bool CheckRemoteDebuggerPresent(IntPtr hProcess, ref bool isDebuggerPresent); 17 | void Start() 18 | { 19 | //method 1: blacklist(sometimes evil thing is not only debugger) 20 | Process[] localByName = Process.GetProcessesByName("OLLYDBG"); 21 | if (localByName != null && localByName.Length>0) 22 | { 23 | Console.Write("We are being fucked!!Ollydbg is so good\n"); 24 | 25 | } 26 | 27 | //method 2: don't attach me (even you are a good debugger) 28 | bool isDebuggerPresent = false; 29 | CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent); 30 | if (isDebuggerPresent) 31 | { 32 | Console.WriteLine("Debugger Attached: " + isDebuggerPresent+"\n"); 33 | Console.ReadLine(); 34 | } 35 | //method 3: it is what I said in 2 (this is for .net debugger XD) 36 | if (System.Diagnostics.Debugger.IsAttached) 37 | { 38 | Console.Write("We are being fucked by .net debugger!!\n"); 39 | } 40 | 41 | } 42 | 43 | static void Main(string[] args) 44 | { 45 | Thread.Sleep(10000); 46 | Mydetector mydetector = new Mydetector(); 47 | mydetector.Start(); 48 | Console.ReadLine(); 49 | } 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /speedhackdetector/Program.cs: -------------------------------------------------------------------------------- 1 | /* 2 | * 3 | */ 4 | using System; 5 | using System.Collections.Generic; 6 | using System.Linq; 7 | using System.Text; 8 | //using System.Threading.Tasks; 9 | using System.Threading; 10 | 11 | namespace speedhackdetector 12 | { 13 | class speedDetector 14 | { 15 | private const int THRESHOLD = 5000000; 16 | private long ticksOnStart = 0; 17 | private long ticksOnStartVulnerable = 0; 18 | private int errorsCount=0; 19 | private const int maxFalsePositives = 3; 20 | public void Start() 21 | { 22 | errorsCount = 0; 23 | ticksOnStart = DateTime.UtcNow.Ticks; 24 | ticksOnStartVulnerable = Environment.TickCount * TimeSpan.TicksPerMillisecond; 25 | Timer t = new Timer(OnTimer, null, 0, 2000); 26 | } 27 | private void OnTimer(Object o) 28 | { 29 | long ticks = 0; 30 | long ticksVulnerable = 0; 31 | 32 | 33 | ticks = DateTime.UtcNow.Ticks; 34 | ticksVulnerable = Environment.TickCount * TimeSpan.TicksPerMillisecond; 35 | 36 | // Console.WriteLine(ticksVulnerable - ticksOnStartVulnerable); 37 | //Console.WriteLine(ticks - ticksOnStart); 38 | if (Math.Abs((ticksVulnerable - ticksOnStartVulnerable) - (ticks - ticksOnStart)) > THRESHOLD) 39 | { 40 | errorsCount++; 41 | if (errorsCount > maxFalsePositives) 42 | { 43 | Console.WriteLine("Sry Baby,bad things happened!"); 44 | } 45 | } 46 | ticksOnStart = DateTime.UtcNow.Ticks; 47 | ticksOnStartVulnerable = Environment.TickCount * TimeSpan.TicksPerMillisecond; 48 | } 49 | static void Main(string[] args) 50 | { 51 | speedDetector myspeedDetector = new speedDetector(); 52 | myspeedDetector.Start(); 53 | //Console.WriteLine("Pass maybe?"); 54 | //Console.ReadLine(); 55 | } 56 | } 57 | } 58 | -------------------------------------------------------------------------------- /uSpeedHackDetector/SpeedHackDetector.cs: -------------------------------------------------------------------------------- 1 | using UnityEngine; 2 | using System; 3 | using System.Collections.Generic; 4 | using System.Linq; 5 | using System.Text; 6 | using System.Threading; 7 | using System.Collections; 8 | 9 | public class SpeedHackDetector : MonoBehaviour { 10 | private const int THRESHOLD = 1000000; 11 | private long ticksOnStart = 0; 12 | private long ticksOnStartVulnerable = 0; 13 | private int errorsCount = 0; 14 | private const int maxFalsePositives = 3; 15 | //private bool SpeedHackFlag = true; 16 | private int frameCount=0; 17 | private bool Dflag = false; 18 | private long ticks; 19 | private long ticksVulnerable; 20 | private long Result; 21 | // Use this for initialization 22 | void Start () { 23 | errorsCount = 0; 24 | ticksOnStart = DateTime.UtcNow.Ticks; 25 | ticksOnStartVulnerable = Environment.TickCount * TimeSpan.TicksPerMillisecond; 26 | frameCount = 0; 27 | Dflag = false; 28 | Result = 0; 29 | //SpeedHackFlag = true; 30 | } 31 | 32 | // Update is called once per frame 33 | void Update () { 34 | frameCount += 1; 35 | if (frameCount >=60) 36 | { 37 | OnTimer(); 38 | frameCount = 0; 39 | } 40 | } 41 | 42 | private void OnTimer() 43 | { 44 | ticks = DateTime.UtcNow.Ticks; 45 | ticksVulnerable = Environment.TickCount * TimeSpan.TicksPerMillisecond; 46 | Result=Math.Abs((ticksVulnerable - ticksOnStartVulnerable) - (ticks - ticksOnStart)); 47 | // Console.WriteLine(ticksVulnerable - ticksOnStartVulnerable); 48 | //Console.WriteLine(ticks - ticksOnStart); 49 | if (Result > THRESHOLD) 50 | { 51 | errorsCount++; 52 | if (errorsCount > maxFalsePositives) 53 | { 54 | Detected(); 55 | } 56 | //errorsCount = 0; 57 | } 58 | ticksOnStart = DateTime.UtcNow.Ticks; 59 | ticksOnStartVulnerable = Environment.TickCount * TimeSpan.TicksPerMillisecond; 60 | } 61 | 62 | private void Detected() 63 | { 64 | Debug.Log("Sry Baby,bad things happened!"); 65 | Dflag = true; 66 | } 67 | 68 | void OnGUI() 69 | { 70 | 71 | GUI.TextField(new Rect(Screen.width / 2 , Screen.height / 2 - 50, 100, 30), ticksOnStart.ToString()); 72 | GUI.TextField(new Rect(Screen.width / 2, Screen.height / 2, 100, 30), ticksOnStartVulnerable.ToString()); 73 | GUI.TextField(new Rect(Screen.width / 2 , Screen.height / 2 + 50, 100, 30), Result.ToString()); 74 | if(Dflag==true) 75 | { 76 | GUI.TextField(new Rect(Screen.width / 2 , Screen.height / 2 +100, 100, 30), "Hacked"); 77 | } 78 | } 79 | } 80 | -------------------------------------------------------------------------------- /uDebugDetector/DebuggerDetector.cs: -------------------------------------------------------------------------------- 1 | using UnityEngine; 2 | using System.Collections; 3 | using System; 4 | using System.Collections.Generic; 5 | using System.Linq; 6 | using System.Text; 7 | using System.Diagnostics; 8 | using System.ComponentModel; 9 | using System.Runtime.InteropServices; 10 | using System.Threading; 11 | 12 | public class DebuggerDetector : MonoBehaviour { 13 | 14 | 15 | [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 16 | private static extern bool CheckRemoteDebuggerPresent(IntPtr hProcess, ref bool isDebuggerPresent); 17 | [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)] 18 | private static extern bool IsDebuggerPresent(); 19 | [DllImport("kernel32.dll", SetLastError = true)] 20 | private static extern IntPtr GetCurrentThread(); 21 | [DllImport("ntdll.dll", SetLastError = true)] 22 | private static extern int NtSetInformationThread(IntPtr threadHandle, int threadInformationClass, IntPtr threadInformation, int threadInformationLength); 23 | [DllImport("ntdll.dll", SetLastError = true)] 24 | static extern int NtQueryInformationProcess(IntPtr processHandle, int processInformationClass, IntPtr processInformation, uint processInformationLength,IntPtr returnLength); 25 | 26 | private bool Dflag; 27 | private IntPtr NoDebugInherit = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(UInt32))); 28 | private long status; 29 | private long status2; 30 | private IntPtr hDebugObject = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(IntPtr))); 31 | 32 | void Start () { 33 | Dflag = false; 34 | } 35 | 36 | // Update is called once per frame 37 | void Update () { 38 | //method 1: 39 | NtSetInformationThread(GetCurrentThread(), 0x11, IntPtr.Zero, 0); 40 | //UnityEngine.Debug.Log(); 41 | //UnityEngine.Debug.Log(GetCurrentThread().ToString()); 42 | 43 | //method 2: don't attach me (even you are a good debugger) 44 | bool isDebuggerPresent = false; 45 | CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isDebuggerPresent); 46 | 47 | if (isDebuggerPresent || IsDebuggerPresent()) 48 | { 49 | //Console.WriteLine("Debugger Attached: " + isDebuggerPresent + "\n"); 50 | //Console.ReadLine(); 51 | Dflag = true; 52 | } 53 | //method 3: it is what I said in 2 (this is for .net debugger XD) 54 | if (System.Diagnostics.Debugger.IsAttached) 55 | { 56 | //Console.Write("We are being fucked by .net debugger!!\n"); 57 | Dflag = true; 58 | } 59 | //method4: 60 | status = NtQueryInformationProcess(Process.GetCurrentProcess().Handle, 0x1f, NoDebugInherit, 4, IntPtr.Zero); 61 | if (((uint)Marshal.PtrToStructure(NoDebugInherit, typeof(uint)))==0) 62 | { 63 | Dflag = true; 64 | } 65 | //UnityEngine.Debug.Log(status.ToString()); 66 | //UnityEngine.Debug.Log(NoDebugInherit.ToString()); 67 | status2 = NtQueryInformationProcess(Process.GetCurrentProcess().Handle, 0x1e, hDebugObject, 4, IntPtr.Zero); 68 | if(status2==0) 69 | { 70 | Dflag = true; 71 | } 72 | //UnityEngine.Debug.Log(status.ToString()); 73 | //UnityEngine.Debug.Log(hDebugObject.ToString()); 74 | 75 | } 76 | void OnGUI() 77 | { 78 | GUI.TextField(new Rect(Screen.width / 2, Screen.height / 2-100, 150, 30), status.ToString()); 79 | GUI.TextField(new Rect(Screen.width / 2, Screen.height / 2 - 50, 150, 30), status2.ToString()); 80 | GUI.TextField(new Rect(Screen.width / 2, Screen.height / 2, 150, 30), ((uint)Marshal.PtrToStructure(NoDebugInherit,typeof(uint))).ToString()); 81 | GUI.TextField(new Rect(Screen.width / 2, Screen.height / 2 + 50, 150, 30), ((IntPtr)Marshal.PtrToStructure(hDebugObject, typeof(IntPtr))).ToString()); 82 | if (Dflag == true) 83 | { 84 | GUI.TextField(new Rect(Screen.width / 2, Screen.height / 2 +100, 150, 30), "Hacked"); 85 | } 86 | } 87 | } 88 | --------------------------------------------------------------------------------