> kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? At least for Vanguard specifically, nope you'll get pinged if you try th

> kernel-debugger (kdb + USB debug cable) is enough to work-around anything in Ring 0? At least for Vanguard specifically, nope you'll get pinged if you try that naively; mainly because Vanguard looks for funky USB devices (among other things) Now the way to approach it is to spoof USB hardware IDs and data streams, so you can then use approaches like what you've described, and some even use that to inject HID/mouse movement back into the host PC. Basically allows cheats with nothing more than a micro-controller and a second PC, but it is still more detectable/cat-and-mouse than PCIe DMA devices + second PCs (and video muxing/overlay devices to put the ESP/whatever over the existing "clean" host PC's output) Also if you're running Windows 11, Vanguard requires TPM 2.0 + Secure Boot which makes some things a lot more painful