Syntax for search in XOR'd memory region?

[dejj]

I have implemented searching in XOR'd memory regions.
XOR'd memory is a simple cheat prevention technique. I am currently testing the feature.
Which syntax do you prefer?

I propose the prefix caret (^), with 1 or 2 arguments.

#define XOR_LONGDOC "usage: ^ n [m]\n" \
                "Takes the value of the previous round (a^x) and the current round (b^x)\n" \
                "If m is given, match all values where (a^x^b^x)==(n^m)\n" \
                "Otherwise match all values where (a^x^b^x)==n\n" \
                "You can use this if memory has been xor'd and you know both clear values."

Pro: caret matches the C-operator.
Con: caret is a deadkey and needs to be pressed twice.

Pro: prefix operator (^ x y) makes arguments easier to parse.
Con: infix operator (x ^ y) is more commonly used.

[12345ieee]

Do you have a link explaining this XOR "anti-cheat" technique? I'd like to read about it, then evaluate if adding it.

[dejj]

Thanks for looking into this :)

link explaining this XOR "anti-cheat" technique

It's just obfuscation. I doubt anybody considers it worth a write-up. Prevents nothing more than scanning for plain values with scanmem and CheatEngine.
I've seen this obfuscation used in Unity games. I used the xor-scan for "The Captain" yesterday. (It was no time for caution.)

Find my draft implementation in the following PR: #424

[gringus]

This specific technique is described at https://www.gamecheetah.org/blog/bypassing-xor-encryption-game-guardian/ (look for XOR encryption in mobile games). Keep in mind this relies on static encryption key which probably does not change during the course of the game.
I tried to use it in Heroes of Might and Magic VI and it turns out they use slightly different implementation there: encrypted value and encryption key are stored as 2 consecutive int32 values and they change on every real value change.
Both above implementations can be tackled with changed/not changed searches, but process is long, boring and prone to errors. Having dedicated XOR searches significantly speeds up the process, makes it more targeted and much more reliable.