glass houses copy

TL;DR: TacoNBanana employs a LUA script called gcap that can not only view your screen, but your steam overlay and any window sitting in front of it, enabling them to read your chats. This has been utilized for years (possibly dating back to the beginning of the last HL2 iteration) to eavesdrop on personal conversations.

I know about this because Bennet Dyson showed me my own screen a few years ago as a joke. I kept it under my hat, and I acknowledge that this was a poor decision on my part; people should have known, long ago, that the owner of their community voyeurs on their personal discourse. However, I don’t expect my word alone to stand as evidence, particularly given recent turbulence. Proof is required. Scilicet:

My first attempt at working out which script was being used was to look for similar functionality. ServerGuard was my first stop.

ServerGuard is a Garry’s Mod steam administration tool similar to ULX, but with some additional features. One of these features is the ability to capture a user's screen. The purpose of this feature is to allow admins to view snapshots of the entire space in front of the game to detect overlays that may give them an advantage, however it can also be utilized to view the Steam or Discord overlay and allow conversations to be eavesdropped on in close to real time.

In order to test this, I spun up my own server running an older version of ServerGuard, as newer ones removed Steam overlay viewing over privacy concerns.

I didn’t hide anything in order to make it as noisy as possible and find as many ways  to passively detect the script as I could. It turns out that when you don’t make an effort to hide the tool’s use, it prints in console, chat, saves data to your garry’s mod configuration, and generally makes a lot of noise.

Most of these are easy to modify the source code to disable, but after digging through a dump of my RAM, I found a section of live memory with a very well labeled section of variables. This is on my test box:

https://i.imgur.com/pYKPcW4.png

ServerGuard’s presence, cleanly labeled, very distinct, and unlikely to have been scrubbed during Bennet’s efforts to obfuscate ServerGuard’s use. Through this effort, I discovered that sometime in 2016-2017, “render.Capture”, the function used to pull a user's full screen, was patched to only capture the game window if it’s not buffered with “PostRender”. This meant that the old version I had would only return a black screen.

https://i.imgur.com/6rx2jIt.png

However, I pushed on just to see if there was any evidence of use. To test, I cleaned my machine of all the local files and restarted to clear my RAM from the indicators I already found. I made sure there wasn’t any trace of it in my memory by running a fresh dump, and found two symlinks much further down the heap. I made a note to discount these if they were the only thing I could find while on TnB’s server, as they would have been false positives:

https://i.imgur.com/w7wNkAw.png

I hopped on TRP and dumped my memory:

Nothing but the false positive from earlier. I figured I’d have to dive a little deeper to find the information I was looking for. I loaded up a handy little injection to pull down all of TRP’s files (some information is redacted to avoid personal attribution, others because I don’t want to detail my exact methodology for dumping a server’s files -  however, to cover my ass: there was no unauthorized access of TnB’s box to acquire these files).

https://i.imgur.com/zD3k5VW.png

Proof that these are indeed TRP’s files:

https://i.imgur.com/ORDoVGj.png

I started searching around for anything related for ServerGuard, including render.Capture and come up with nothing. I then start manually crawling through the files I pulled down. Among the addons I find gcap:

https://i.imgur.com/t35PYUE.png

Gcap is more or less a standalone version of ServerGuard’s screencap function, whereby the user’s screen is captured, and it’s sent back to the caller via chunked, base-64 encoded binary and decoded into a pretty HTML wrapper.

https://i.imgur.com/UfLiiMx.png

To check this script out I grabbed myself a copy of gcap to port the code over to its modern implementation:

https://i.imgur.com/Bow7XPZ.png