3 ms·

“ When you shut down Call of Duty: Warzone, the driver turns off.” is that really how drivers work?

Arnavion 5y ago
Windows drivers can be loaded and unloaded dynamically, yes. It's also possible that they're using "shut down" semantically and not literally, in that the driver is loaded but inactive while the game isn't running.
- fuj 5y ago
  Isn't this the case for every major OS? I know FreeBSD device drivers can be (un)loaded on-the-fly. Same for MacOS. I assume it's also possible in Linux(?)
  - kaladin-jasnah 5y ago
    It is. I believe you use modprobe -r kernel_module_name to unload a kernel module and modprobe kernel_module_name to load it.
  - Arnavion 5y ago
    Linux lets you disable dynamic modules. OpenBSD removed support for them some years ago.
  - astrange 5y ago
    macOS doesn't let you load kexts anymore since it's less important with drivers moving to userspace.
Sohcahtoa82 5y ago
Yes. Drivers can be loaded and unloaded at will. It's a necessity for USB devices. Heck, these days, even a GPU driver can be hot-swapped.
schmorptron 5y ago
They have to make this distinction, because Riot Games' Vanguard runs at system start, to not have cheats start before it according to the developers. I don't like the practice, but I had to install it anyways to play Valorant with friends.
- novok 5y ago
  What I don't get about this, what prevents your cheats from starting at boot too?
  - schmorptron 5y ago
    I'm not an expert, but from what I've come to understand, anti cheat is for the most part about making it as hard or inconvenient to cheat as possible. You'll never be able to stop it, but putting in hurdles for both the cheat developer and user is key to keeping it limited. The huge problem is that cheaters are very willing to go to extreme lengths of inconvenience or even risk, as in running random cheats as kernel level drivers. So anything that makes the developers have to bypass another hurdle and another component you can patch in your anti cheat "rootkit" gives you a small boost in the cat and mouse game. Your component starting at boot makes it more likely the cheat devs and cheaters will have to do the same and have a more complicated setup.
    - novok 5y ago
      I think making your cheat kernel level is a relatively minor hurdle compared to the lengths that people have been going with ML + hardware based cheats at this point. Maybe we need to stop the kernel anti-cheat just from a pure privacy perspective at this point, or make it an OS service you can implement as a user level module only, much like endpoint management and macOS. I get a feeling there is more to being in the kernel although.

Windows drivers can be loaded and unloaded dynamically, yes. It's also possible that they're using "shut down" semantically and not literally, in that the driver is loaded but inactive while the game isn't running.

fuj 5y ago
Isn't this the case for every major OS? I know FreeBSD device drivers can be (un)loaded on-the-fly. Same for MacOS. I assume it's also possible in Linux(?)
- kaladin-jasnah 5y ago
  It is. I believe you use modprobe -r kernel_module_name to unload a kernel module and modprobe kernel_module_name to load it.
- Arnavion 5y ago
  Linux lets you disable dynamic modules. OpenBSD removed support for them some years ago.
- astrange 5y ago
  macOS doesn't let you load kexts anymore since it's less important with drivers moving to userspace.

Sohcahtoa82 5y ago

Yes. Drivers can be loaded and unloaded at will. It's a necessity for USB devices. Heck, these days, even a GPU driver can be hot-swapped.

schmorptron 5y ago

They have to make this distinction, because Riot Games' Vanguard runs at system start, to not have cheats start before it according to the developers. I don't like the practice, but I had to install it anyways to play Valorant with friends.

novok 5y ago
What I don't get about this, what prevents your cheats from starting at boot too?
- schmorptron 5y ago
  I'm not an expert, but from what I've come to understand, anti cheat is for the most part about making it as hard or inconvenient to cheat as possible. You'll never be able to stop it, but putting in hurdles for both the cheat developer and user is key to keeping it limited. The huge problem is that cheaters are very willing to go to extreme lengths of inconvenience or even risk, as in running random cheats as kernel level drivers. So anything that makes the developers have to bypass another hurdle and another component you can patch in your anti cheat "rootkit" gives you a small boost in the cat and mouse game. Your component starting at boot makes it more likely the cheat devs and cheaters will have to do the same and have a more complicated setup.
  - novok 5y ago
    I think making your cheat kernel level is a relatively minor hurdle compared to the lengths that people have been going with ML + hardware based cheats at this point. Maybe we need to stop the kernel anti-cheat just from a pure privacy perspective at this point, or make it an OS service you can implement as a user level module only, much like endpoint management and macOS. I get a feeling there is more to being in the kernel although.