3 ms·

Can you elaborate? I know there’s hypervisor-detection, but surely any kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? Mayb

• ace2358 3y ago
  I think the have a pci-e card on the computer playing the game. The card sends hardware level debugging information (memory dma) to another computer. This second computer is connected to the first computer by usb, to spoof a HID (mouse, keyboard, controller etc). It reads the data from the pci card on the first computer and sends inputs via usb. Done right, and it can’t be detected via software. Behaviour analysis still works for aim hacks. Now days I think there are even devices that will tap the hdmi stream and use the video data to calculate inputs and the send the input via usb/hid/controller. This works on console I think!
• girvo 3y ago
  > kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? At least for Vanguard specifically, nope you'll get pinged if you try that naively; mainly because Vanguard looks for funky USB devices (among other things) Now the way to approach it is to spoof USB hardware IDs and data streams, so you can then use approaches like what you've described, and some even use that to inject HID/mouse movement back into the host PC. Basically allows cheats with nothing more than a micro-controller and a second PC, but it is still more detectable/cat-and-mouse than PCIe DMA devices + second PCs (and video muxing/overlay devices to put the ESP/whatever over the existing "clean" host PC's output) Also if you're running Windows 11, Vanguard requires TPM 2.0 + Secure Boot which makes some things a lot more painful