3 ms·

> Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operati

> Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operating system to change your firmware I don't believe Vanguard did this at all? It told users they need to update their firmware to play, it didn't touch the firmware itself. > Cheats started in user space, so anti-cheat moved into the kernel to see them. Cheats followed into the kernel, and then below it into hypervisors I think cheats moved into kernel space before anti-cheats did.

sitzkrieg 3mo ago
long beforehand naturally. the arms race is as good of an excuse as any to trample user rights though
glitchc 3mo ago
Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations in memory in a specific order, which brings me to my point: An anti-cheat mechanism can always be defeated if the cheater can access a lower order of abstraction from the mechanism. An arms race is the inevitable outcome. It's either that or competitive gaming is not viable.
- gopher_space 3mo ago
  I mean the assumption here is that administration needs to be automated. Cheating is an intermittent problem at worst on moderated servers.
- ButlerianJihad 3mo ago
  > The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.
  - jjmarr 3mo ago
    You can buy an autoclicking device or software that recognizes screen pixels of enemy avatars and instantly clicks to kill them. This works in "remote streaming" situations and is ~30% of the cheating dataset detected by Riot's kernel level anticheat: https://www.riotgames.com/en/news/vanguard-on-demand https://www.riotgames.com/en/news/vanguard-on-demand > A “pixelbot” is a computer vision cheat that injects player input for the purposes of aiming at heads or casting spells with perfect timing. Coming in “external” (hardware microcontroller) and “internal” (python script) varieties, pixelbots can be extremely impactful in VALORANT due to the low time-to-kill, sometimes just simply pulling the trigger for the cheater when an enemy enters their reticle (also known as a “triggerbot”).
    - iscoelho 3mo ago
      This isn't possible in Valorant. Their kernel module is extremely particular about input devices: 1) only allows a single mouse input device at a time 2) completely ignores virtual mouse input 3) flags "special"/"uncommon" input devices Their anti-cheat is actually much more involved and effective than most would assume.
      - Hikikomori 3mo ago
        Websites that sell DMA devices also sell devices that merge mouse usb and hdmi signals that allows you to run the cheat on another machine and let it display en ESP overlay and do aimbot. It's likely that a naive implementation of such an usb device would be detected. But can you create such a device that uses a normal mouse usb driver and looks like a normal mouse?
        iscoelho 3mo ago
        At least in Valorant, DMA is becoming impossible due to IOMMU / Memory Integrity enforcement. The only option is becoming pixel bots. As for faking the input device: I'm sure it's possible, but I'm also sure that perfectly spoofing an input device is much easier said than done. Even if it is possible, all they have to do is make it hard enough to where the percentage of players cheating is at the point where you will rarely if ever encounter a cheater in your matches. As far as I'm aware, Valorant is one of the only games that has accomplished that.
- charcircuit 3mo ago
  Windows has no security between processes reading and writing each other's memory as long as they are from the same user. You doing need kernel level access to do it.
  - glitchc 3mo ago
    That hasn't been true since Windows 98/ME. Windows uses virtual addressing plus ASLR and DEP for process isolation/protection. See here: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/virtual-address-spaces https://learn.microsoft.com/en-us/windows-hardware/drivers/g...
    - ChocolateGod 3mo ago
      You can use system APIs to get the memory space of another application in Windows as long as their run by the same user. However iirc processes can opt out of this so only administrators can.
      - Hikikomori 3mo ago
        >However iirc processes can opt out of this so only administrators can. Can override those opts without admin as well.
    - charcircuit 3mo ago
      ReadProcessMemory and WriteProcessMemory are APIs Windows exposes for using other processes memory. Even if a process changes the default DACL to block it, admin level access can bypass it. https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory https://learn.microsoft.com/en-us/windows/win32/api/memoryap... https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory https://learn.microsoft.com/en-us/windows/win32/api/memoryap...
  - charcircuit 3mo ago
    don't need
- jjmarr 3mo ago
  > An arms race is the inevitable outcome. It's either that or competitive gaming is not viable. I'd rather just give my passport and do one of those face turning challenges to play competitive video games. Then if I get caught cheating, my real life identity can't play anymore, rather than make a new account and "get better at cheating". If I am a habitual cheater in literally any other sport on Earth, governing body figures that out and issues me a lifetime ban. At that point, I'm blacklisted. Even my Tuesday night dodgeball league can issue bans that actually stick because they know my real identity.

sitzkrieg 3mo ago

long beforehand naturally. the arms race is as good of an excuse as any to trample user rights though

glitchc 3mo ago

Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations in memory in a specific order, which brings me to my point: An anti-cheat mechanism can always be defeated if the cheater can access a lower order of abstraction from the mechanism. An arms race is the inevitable outcome. It's either that or competitive gaming is not viable.

gopher_space 3mo ago
I mean the assumption here is that administration needs to be automated. Cheating is an intermittent problem at worst on moderated servers.
ButlerianJihad 3mo ago
> The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.
- jjmarr 3mo ago
  You can buy an autoclicking device or software that recognizes screen pixels of enemy avatars and instantly clicks to kill them. This works in "remote streaming" situations and is ~30% of the cheating dataset detected by Riot's kernel level anticheat: https://www.riotgames.com/en/news/vanguard-on-demand https://www.riotgames.com/en/news/vanguard-on-demand > A “pixelbot” is a computer vision cheat that injects player input for the purposes of aiming at heads or casting spells with perfect timing. Coming in “external” (hardware microcontroller) and “internal” (python script) varieties, pixelbots can be extremely impactful in VALORANT due to the low time-to-kill, sometimes just simply pulling the trigger for the cheater when an enemy enters their reticle (also known as a “triggerbot”).
  - iscoelho 3mo ago
    This isn't possible in Valorant. Their kernel module is extremely particular about input devices: 1) only allows a single mouse input device at a time 2) completely ignores virtual mouse input 3) flags "special"/"uncommon" input devices Their anti-cheat is actually much more involved and effective than most would assume.
    - Hikikomori 3mo ago
      Websites that sell DMA devices also sell devices that merge mouse usb and hdmi signals that allows you to run the cheat on another machine and let it display en ESP overlay and do aimbot. It's likely that a naive implementation of such an usb device would be detected. But can you create such a device that uses a normal mouse usb driver and looks like a normal mouse?
      - iscoelho 3mo ago
        At least in Valorant, DMA is becoming impossible due to IOMMU / Memory Integrity enforcement. The only option is becoming pixel bots. As for faking the input device: I'm sure it's possible, but I'm also sure that perfectly spoofing an input device is much easier said than done. Even if it is possible, all they have to do is make it hard enough to where the percentage of players cheating is at the point where you will rarely if ever encounter a cheater in your matches. As far as I'm aware, Valorant is one of the only games that has accomplished that.
charcircuit 3mo ago
Windows has no security between processes reading and writing each other's memory as long as they are from the same user. You doing need kernel level access to do it.
- glitchc 3mo ago
  That hasn't been true since Windows 98/ME. Windows uses virtual addressing plus ASLR and DEP for process isolation/protection. See here: https://learn.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/virtual-address-spaces https://learn.microsoft.com/en-us/windows-hardware/drivers/g...
  - ChocolateGod 3mo ago
    You can use system APIs to get the memory space of another application in Windows as long as their run by the same user. However iirc processes can opt out of this so only administrators can.
    - Hikikomori 3mo ago
      >However iirc processes can opt out of this so only administrators can. Can override those opts without admin as well.
  - charcircuit 3mo ago
    ReadProcessMemory and WriteProcessMemory are APIs Windows exposes for using other processes memory. Even if a process changes the default DACL to block it, admin level access can bypass it. https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-readprocessmemory https://learn.microsoft.com/en-us/windows/win32/api/memoryap... https://learn.microsoft.com/en-us/windows/win32/api/memoryapi/nf-memoryapi-writeprocessmemory https://learn.microsoft.com/en-us/windows/win32/api/memoryap...
- charcircuit 3mo ago
  don't need
jjmarr 3mo ago
> An arms race is the inevitable outcome. It's either that or competitive gaming is not viable. I'd rather just give my passport and do one of those face turning challenges to play competitive video games. Then if I get caught cheating, my real life identity can't play anymore, rather than make a new account and "get better at cheating". If I am a habitual cheater in literally any other sport on Earth, governing body figures that out and issues me a lifetime ban. At that point, I'm blacklisted. Even my Tuesday night dodgeball league can issue bans that actually stick because they know my real identity.