Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Anti-cheat engines are a major part of modern video games. Historically, anti-cheat has ran in a kernel driver with Vanguard from Riot Games. This post shows a way to stop cheaters in an easier way than previously known.

There are a lot of ways to cheat in modern video games (2024-2026. This includes purpose-built Direct Memory Access (DMA) to get extra information from the system undetected, pixelbots with computer vision capabilities, and kernel-level cheats. Of all of these, kernel-level cheats occurred the most often: many of them occurring pre-OS via exploitable firmware vulnerabilities before it fully loads (bootkits). They tried fixing with by requiring SecureBoot.

At the kernel level, there are multiple ways to cheat. One of them is stealing/buying an EV certificate for $600 to create valid kernel drivers, but this doesn't last long. The next one is bringing your own vulnerable driver (BYOVD); this is taking a driver with a known vulnerability, and exploiting that driver. Some users add a bootkit to their system. Others use a hypervisor to MitM operating system and device calls with data they want instead.

To prevent the BYOVD problem, Vanguard has a blocklist of vulnerable drivers being exploited. If one of these appears, then the game won't boot; this has led to several hundred bans a day. Microsoft recently added Runtime Driver Attestation Report. This is core functionality that keeps track of device drivers that entered the system, even when the anti-cheat wasn't on via TPM measurements. This solves the who loaded first problem.

To use the Vanguard Pre-Check, a lot of settings need to be turned on. Secure Boot, TPM 2.0, IOMMU (to shield from DMA attacks), and Microsoft Virtualization Based Security (VBS). Overall, a good but long post on the innovations of their anti-cheat engine.