feat: add baseline anti-cheat protection for issue #2

Closes #2

Payouts:
- EVM: 0xe744f6791a685b0A0cC316ED44375B69361c837F
- SOL: 8BsByR6rPqxDPku6dYtdoiSk6bdgE9YETbLQF2RGSw1C

PoA-Signature: poa_6c8f67fc40a11300

Author: rbxict

.gitignore

@@ -0,0 +1,2 @@
+__pycache__/
+*.py[cod]

AntiCheat.cpp

@@ -4,6 +4,7 @@
 
 #include <windows.h>
 #include <tlhelp32.h>
+#include <intrin.h>
 #include <iostream>
 #include <fstream>
 #include <vector>
@@ -134,7 +135,7 @@ int main() {
     if (JAVELIN_EXPECTED_CRC32 != 0u) {
         if (!checkSelfIntegrity(JAVELIN_EXPECTED_CRC32)) {
             std::cerr << kTag << "Integrity check failed (CRC mismatch). Exiting.\n";
-            return 0xCRC; // custom code (note: non-standard, may be truncated)
+            return 0x1CC; // non-zero error code for failed integrity checks
         }
     }
 

README.md

@@ -1 +1,44 @@
-# py-workedtask
+# py-workedtask
+
+Minimal anti-cheat guards for the Javelin project.
+
+## Included protections
+
+- `AntiCheat.cpp`: debugger detection plus suspicious process scanning for the native client.
+- `anti_cheat.py`: debugger detection plus suspicious process scanning for the Python monitor.
+
+Known suspicious tools currently blocked in both paths:
+
+- `cheatengine.exe`
+- `ollydbg.exe`
+- `x64dbg.exe`
+- `httpdebuggerui.exe`
+- `ida.exe`
+- `ida64.exe`
+- `scylla.exe`
+- `processhacker.exe`
+
+## Run the Python monitor
+
+```powershell
+python anti_cheat.py
+```
+
+Exit codes:
+
+- `0x6B` when a debugger is detected
+- `0x6C` when a suspicious process is detected
+
+## Test the Python monitor
+
+```powershell
+python -m unittest discover -s . -p "test_*.py" -v
+```
+
+## Build the C++ client
+
+Example with MSVC:
+
+```powershell
+cl /EHsc AntiCheat.cpp
+```

anti_cheat.py

@@ -0,0 +1,91 @@
+#!/usr/bin/env python3
+
+import ctypes
+import subprocess
+import sys
+from typing import Iterable, Optional
+
+TAG = "[Javelin AntiCheat]"
+DEBUGGER_EXIT_CODE = 0x6B
+SUSPICIOUS_PROCESS_EXIT_CODE = 0x6C
+SUSPICIOUS_PROCESSES = {
+    "cheatengine.exe",
+    "ollydbg.exe",
+    "x64dbg.exe",
+    "httpdebuggerui.exe",
+    "ida.exe",
+    "ida64.exe",
+    "scylla.exe",
+    "processhacker.exe",
+}
+
+
+def is_windows() -> bool:
+    return sys.platform.startswith("win")
+
+
+def debugger_attached(kernel32=None) -> bool:
+    if not is_windows():
+        return False
+
+    kernel32 = kernel32 or ctypes.windll.kernel32
+    return bool(kernel32.IsDebuggerPresent())
+
+
+def list_process_names(tasklist_output: Optional[str] = None) -> list[str]:
+    if not is_windows():
+        return []
+
+    if tasklist_output is None:
+        result = subprocess.run(
+            ["tasklist", "/fo", "csv", "/nh"],
+            capture_output=True,
+            check=True,
+            text=True,
+        )
+        tasklist_output = result.stdout
+
+    names: list[str] = []
+    for raw_line in tasklist_output.splitlines():
+        line = raw_line.strip()
+        if not line:
+            continue
+        if line.startswith('"'):
+            line = line[1:]
+        name = line.split('","', 1)[0].strip('"').lower()
+        if name:
+            names.append(name)
+    return names
+
+
+def suspicious_process_found(
+    process_names: Optional[Iterable[str]] = None,
+) -> Optional[str]:
+    if process_names is None:
+        process_names = list_process_names()
+
+    for name in process_names:
+        lowered = name.lower()
+        if lowered in SUSPICIOUS_PROCESSES:
+            return lowered
+    return None
+
+
+def run_checks() -> int:
+    print(f"{TAG} starting checks...")
+
+    if debugger_attached():
+        print(f"{TAG} Debugger detected. Exiting.")
+        return DEBUGGER_EXIT_CODE
+
+    bad_process = suspicious_process_found()
+    if bad_process:
+        print(f"{TAG} Suspicious process detected: {bad_process}. Exiting.")
+        return SUSPICIOUS_PROCESS_EXIT_CODE
+
+    print(f"{TAG} All clear. Continue.")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(run_checks())

tests/__init__.py

@@ -0,0 +1 @@
+

tests/test_anti_cheat.py

@@ -0,0 +1,70 @@
+import subprocess
+import unittest
+from unittest import mock
+
+import anti_cheat
+
+
+class AntiCheatTests(unittest.TestCase):
+    def test_list_process_names_parses_tasklist_csv(self) -> None:
+        sample = '"explorer.exe","1234","Console","1","11,000 K"\n"x64dbg.exe","999","Console","1","4,096 K"\n'
+        with mock.patch.object(anti_cheat, "is_windows", return_value=True):
+            self.assertEqual(
+                anti_cheat.list_process_names(sample),
+                ["explorer.exe", "x64dbg.exe"],
+            )
+
+    def test_list_process_names_returns_empty_off_windows(self) -> None:
+        with mock.patch.object(anti_cheat, "is_windows", return_value=False):
+            self.assertEqual(anti_cheat.list_process_names(""), [])
+
+    def test_debugger_attached_uses_kernel32_on_windows(self) -> None:
+        kernel32 = mock.Mock()
+        kernel32.IsDebuggerPresent.return_value = 1
+        with mock.patch.object(anti_cheat, "is_windows", return_value=True):
+            self.assertTrue(anti_cheat.debugger_attached(kernel32=kernel32))
+
+    def test_debugger_attached_is_false_off_windows(self) -> None:
+        kernel32 = mock.Mock()
+        kernel32.IsDebuggerPresent.return_value = 1
+        with mock.patch.object(anti_cheat, "is_windows", return_value=False):
+            self.assertFalse(anti_cheat.debugger_attached(kernel32=kernel32))
+
+    def test_suspicious_process_found_detects_known_tool(self) -> None:
+        found = anti_cheat.suspicious_process_found(["explorer.exe", "CheatEngine.exe"])
+        self.assertEqual(found, "cheatengine.exe")
+
+    def test_suspicious_process_found_returns_none_when_clean(self) -> None:
+        self.assertIsNone(anti_cheat.suspicious_process_found(["explorer.exe", "python.exe"]))
+
+    def test_run_checks_returns_debugger_exit_code(self) -> None:
+        with mock.patch.object(anti_cheat, "debugger_attached", return_value=True):
+            self.assertEqual(anti_cheat.run_checks(), anti_cheat.DEBUGGER_EXIT_CODE)
+
+    def test_run_checks_returns_suspicious_process_exit_code(self) -> None:
+        with mock.patch.object(anti_cheat, "debugger_attached", return_value=False):
+            with mock.patch.object(
+                anti_cheat,
+                "suspicious_process_found",
+                return_value="x64dbg.exe",
+            ):
+                self.assertEqual(
+                    anti_cheat.run_checks(),
+                    anti_cheat.SUSPICIOUS_PROCESS_EXIT_CODE,
+                )
+
+    def test_run_checks_returns_success_when_clean(self) -> None:
+        with mock.patch.object(anti_cheat, "debugger_attached", return_value=False):
+            with mock.patch.object(anti_cheat, "suspicious_process_found", return_value=None):
+                self.assertEqual(anti_cheat.run_checks(), 0)
+
+    def test_tasklist_command_failure_propagates(self) -> None:
+        with mock.patch.object(anti_cheat, "is_windows", return_value=True):
+            with mock.patch("anti_cheat.subprocess.run") as run:
+                run.side_effect = subprocess.CalledProcessError(1, "tasklist")
+                with self.assertRaises(subprocess.CalledProcessError):
+                    anti_cheat.list_process_names()
+
+
+if __name__ == "__main__":
+    unittest.main()