Kernel-based drivers can also create system-wide stability issues that bring with them the dreaded BSOD (blue screen of death). If you recall the 2005 Sony DRM rootkit fiasco, this level of risk might make you nervous. Running a driver in kernel-mode raises concerns that Riot is only improving its cheat detection at the cost of increasing the attack surface of Windows, and at the root level no less.

We've even seen specialized hardware utilizing DMA1 to read and process system memory-a vector that, done perfectly, could be undetectable2 from user-mode.' The problem here arises from the fact that code executing in kernel-mode can hook the very system calls we would rely on to retrieve our data, modifying the results to appear legitimate in a way we might have difficulty detecting. 'In the last few years, cheat developers have started to leverage vulnerabilities or corrupt Windows' signing verification to run their applications (or portions of them) at the kernel level. Regular applications cannot detect kernel-mode drivers because of the higher privileges required.īack in February, Riot explained the new anti-cheat software, initially designed for use in League of Legends, and why it was needed. Riot claims that it needs this since some cheating software uses kernel-mode drivers to evade detection. However, there is a kernel-mode driver for the system that loads when you boot into Windows. When the game launches, the Vanguard client loads with it into the userspace. Riot Games' new team shooter Valorant has an anti-cheat system called 'Vanguard' that has raised some security concerns. As such, game developers are always working on new ways to detect and thwart these types of programs. Whether using external software to enhance their performance or just to troll other players, these unscrupulous players ruin the game for everyone.

Why it matters: When it comes to online multiplayer gaming, nobody likes a cheater, not even cheaters.

Faceit anti cheat kernel level