3 ms·

Couldn't secureboot disable the kernel anticheat then? Microsoft has verified your kernel and drivers for you.

• mccorrinall 4y ago
  No. A cheat developer could still just sign a driver like every other developer and load a hypervisor. Then hook everything you want and youre gucci. Another option: there are a lot of vulnerable drivers, such as intels LAN driver, or capcoms. Of course those are blacklisted and anti cheats usually don’t let you start the game when those are loaded, but you can use exploitable those to load your own driver, and then unload the vulnerable driver. Other things you can do: DMA stuff, uefi payloads and more. You will never be able to prevent cheating on user owned hardware which sits under their desk.
  • google234123 4y ago
    Except that all those things you listed are detectable or leave traces and can get you banned on most good anti cheats (EAC or the one that valorant uses)
    • mccorrinall 4y ago
      Not true.
    • donkarma 4y ago
      a properly implemented hypervisor cannot be detected outside of vague timing attacks which can be mitigated
      • google234123 4y ago
        > a properly implemented hypervisor Very hard to do. There so many instructions that can be used to expose a HV. For VM hypervisors, MSRs aren't usually properly populated and all the junk that is exposed through WMI