Skip to content

Instantly share code, notes, and snippets.

@stdNullPtr

stdNullPtr/Why You Should Reconsider Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md

Last active November 6, 2025 21:13
Show Gist options
  • Save stdNullPtr/2998eacb71ae925515360410af6f0a32 to your computer and use it in GitHub Desktop.
Save stdNullPtr/2998eacb71ae925515360410af6f0a32 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. stdNullPtr revised this gist Dec 29, 2024. 1 changed file with 2 additions and 0 deletions.
    2 changes: 2 additions & 0 deletions ...der Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md
    View file
    Original file line number Diff line number Diff line change
    @@ -6,6 +6,7 @@ Here are just a few examples of what they can do:
    * [Gaming co ESEA hit by $1m fine for hidden Bitcoin mining enslaver](https://www.theregister.com/2013/11/20/esea_gaming_bitcoin_fine/)
    * [Gaming Company Fined $1M for Turning Customers Into Secret Bitcoin Army](https://www.wired.com/2013/11/e-sports/)
    * [Easy Anti-Cheat hacked](https://www.pcgamer.com/games/battle-royale/easy-anti-cheat-washes-its-hands-of-the-apex-legends-hacking-disaster-that-saw-streamer-accounts-hijacked-live-there-is-no-rce-vulnerability-within-eac/)
    * Crowdstrike Blue Screen of Death Incident

    ## Who am I?

    @@ -83,6 +84,7 @@ Don't believe me how dangerous this is?
    * [Gaming co ESEA hit by $1m fine for hidden Bitcoin mining enslaver](https://www.theregister.com/2013/11/20/esea_gaming_bitcoin_fine/)
    * [Gaming Company Fined $1M for Turning Customers Into Secret Bitcoin Army](https://www.wired.com/2013/11/e-sports/)
    * [Easy Anti-Cheat hacked](https://www.pcgamer.com/games/battle-royale/easy-anti-cheat-washes-its-hands-of-the-apex-legends-hacking-disaster-that-saw-streamer-accounts-hijacked-live-there-is-no-rce-vulnerability-within-eac/)
    * Crowdstrike Blue Screen of Death Incident

    And MANY MORE that did not get caught, as it's extremely hard to get caught with this :)

  2. stdNullPtr revised this gist Aug 6, 2024. 1 changed file with 0 additions and 8 deletions.
    8 changes: 0 additions & 8 deletions ...der Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,11 +1,3 @@
    <div align="center">
    <a href="https://guidedhacking.com/members/nullptr.274895/?referralcode=V8lJp">
    <img src="https://raw.githubusercontent.com/dsasmblr/hacking-online-games/master/resources/guidedhacking-hero.png" />
    </a>
    <br>
    <span align="center"><a href="https://guidedhacking.com/members/nullptr.274895/?referralcode=V8lJp">Read My Game Hacking Tutorials at GuidedHacking.com!</a></span>
    </div>

    # TL;DR

    When Riot Games introduces the Vanguard anti-cheat to League of Legends, you should **STOP** playing and you must **NOT** install the anti-cheat when you get the pop-up. Vanguard is a kernel-level anticheat and these anticheats operate at a privilege level **HIGHER THAN YOUR OWN**. **The anti-cheat can do things that even YOU can't do, without asking or letting you know**. It's like Riot installing a camera in every room of your house and getting a copy of every key inside.
  3. stdNullPtr revised this gist May 5, 2024. 1 changed file with 25 additions and 32 deletions.
    57 changes: 25 additions & 32 deletions ...der Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md
    View file
    Original file line number Diff line number Diff line change
    @@ -8,96 +8,89 @@

    # TL;DR

    When Riot Games introduces the Vanguard anti-cheat to League of Legends, you should **STOP** playing and you should not install the anti-cheat when you get the pop-up. Vanguard is a kernel-level anticheat and these anticheats operate at a privilege level **HIGHER THAN YOUR OWN**. **The anti-cheat can do things that even you can't do**, **without asking or letting you know**. It's like Riot installing a camera in every room of your house and getting a copy of every key inside.
    When Riot Games introduces the Vanguard anti-cheat to League of Legends, you should **STOP** playing and you must **NOT** install the anti-cheat when you get the pop-up. Vanguard is a kernel-level anticheat and these anticheats operate at a privilege level **HIGHER THAN YOUR OWN**. **The anti-cheat can do things that even YOU can't do, without asking or letting you know**. It's like Riot installing a camera in every room of your house and getting a copy of every key inside.

    Here is just one example of what they can do: [https://www.theregister.com/2013/11/20/esea\_gaming\_bitcoin\_fine/](https://www.theregister.com/2013/11/20/esea_gaming_bitcoin_fine/)

    [https://www.wired.com/2013/11/e-sports/](https://www.wired.com/2013/11/e-sports/)
    Here are just a few examples of what they can do:
    * [Gaming co ESEA hit by $1m fine for hidden Bitcoin mining enslaver](https://www.theregister.com/2013/11/20/esea_gaming_bitcoin_fine/)
    * [Gaming Company Fined $1M for Turning Customers Into Secret Bitcoin Army](https://www.wired.com/2013/11/e-sports/)
    * [Easy Anti-Cheat hacked](https://www.pcgamer.com/games/battle-royale/easy-anti-cheat-washes-its-hands-of-the-apex-legends-hacking-disaster-that-saw-streamer-accounts-hijacked-live-there-is-no-rce-vulnerability-within-eac/)

    ## Who am I?

    Just a random player with a cheat developer past, that likes to reverse-engineer malware occasionally.

    ## Why did I decide to write this lengthy boring post?

    Anticheats are getting **more and more intrusive**, it's getting out of hand and people should have a better understanding of how intrusive and dangerous kernel mode software can be. It's driving me crazy how game developers get away with this.
    Anticheats are getting **more and more intrusive**, it's getting out of hand and people should have a better understanding of how intrusive and dangerous kernel mode software, in general, can be. It's driving me crazy how game developers get away with this.

    ## Goal

    I want to convince you NOT to voluntarily install (anti-tamper, or whatever) kernel-level software of any kind, shooting yourself in both feet.
    I want to convince you **NOT** to voluntarily install kernel-level software of any kind (anti-tamper, or whatever they try to push to you), shooting yourself in both feet.

    ## Audience

    All you ordinary gamers
    All you ordinary gamers. This articles explains in simple terms the issue at hand.

    ## Some Clarifications

    * Lower, higher access levels - consider lower -> closer to hardware, meaning MORE privileged (may be counter-intuitive to some)
    * The software that runs in the kernel namespace is referred to as a driver.
    * _"Lower"_ and _"higher"_ access levels: consider lower -> closer to hardware, meaning **MORE** privileged (may be counter-intuitive to some)
    * Any software that runs in the kernel namespace is referred to as a "driver".

    ## The Problem

    Only after diving into the world of reverse engineering and cheat development was I able to understand how incredibly intrusive anti-cheats can be. I get it, we all do, cheating is bad, ruins legit players' experience, and so on - but that's not the point here. The point is - that cheating is inevitable, so why force your player base to install a [**rootkit**](https://en.wikipedia.org/wiki/Rootkit) into their PCs?

    The only difference Vanguard will bring is that the cheating players will just have to spend a **bit** more money for the premium kernel-mode cheats since a user-mode anti-cheat can hardly deal with a kernel-mode one. Valorant has Vanguard, so what? It still has cheaters and the premium cheat developers are not even charging that much. Speaking of "premium cheats", all this introduces a whole new problem, more usage of kernel cheats, which means just like with Vanguard - the user will voluntarily infect their PC with yet another kernel-level software to **mine some crypto** and **share their bank account with their favorite cheat developer** <3.

    Why don't game devs implement better detection methods server-side while keeping the user-mode piece of the software? You can detect and log "unreal" behavior without installing a rootkit into your players' PCs. We're not just talking about another piece of software, this is the core of your computer's operating system.
    Why don't game devs implement better detection methods server-side while keeping the user-mode piece of the anti-cheat? Because it's cheaper to deploy a rootkit to everyone's PC! You can detect and log "unrealistic" behavior without installing a rootkit into your players' PCs. We're not just talking about another piece of software, this is the core of your computer's operating system.

    ## What is the kernel (in simple terms)?

    In a computer, the kernel is the core software of the operating system. It handles all the fundamental operations, like managing memory, processing tasks, and communicating between your hardware (like your keyboard, mouse, and monitor) and software (like your games and applications).

    The kernel operates at the **DEEPEST** level of your system and has complete control over anything happening in your computer. It decides which programs get resources, serves as a bridge between software and hardware using drivers, and controls essential security measures.

    Your everyday apps and games run at Ring3 (least privileged, safest for you). Can you guess who wants to be in Ring0? That's right - viruses, rootkits, spyware. Everything that can compromise your system and privacy. Casually running kernel-level software that YOU DON'T NEED exposes you and your system to risks that we cover below.
    There exists a concept of "[Ring protection levels](https://en.wikipedia.org/wiki/Protection_ring)". Their purpose is to define an access level hierarchy in your system. Your everyday apps and games run at Ring3 (least privileged, safest for your system). Can you guess who wants to be in Ring0? That's right - viruses, rootkits, spyware. Everything that can compromise your system and privacy, casually running kernel-level software that **YOU DON'T NEED** exposes you and your system to risks that we cover below.

    After these few sentences you might say "Wow that sounds important and complex!", well **IT IS, THAT'S WHY YOU DON'T LET RANDOM SOFTWARE IN THERE.**
    After these few sentences you might say "Wow the kernel sounds important and complex!", well **IT IS, THAT'S WHY YOU DON'T LET RANDOM SOFTWARE IN THERE.**

    Consider this:

    >When you are having guests over at home, do you hand over a key to your house to each one of them when they first come? NO??? Why not? They won't have to ring the doorbell next time, think of the insane convenience that this brings. What? They can come at any point, even when you are not there? Naaaaah come on why would they do that, they even promised not to! Wait what? You don't want to give them keys? Well too bad since it was not a question or a request, prepare to be evicted.
    That's you, inviting Vanguard over, FOREVER... well technically until you uninstall it but with such privileged software a complete **OS purge is recommended alongside all your drives.**
    That's you, inviting Vanguard over, **FOREVER**... well technically until you uninstall it but with such privileged software a complete **OS purge is recommended alongside all your drives.**

    ## The risks of kernel-level access

    Repeat after me, again, >!kernel-level software operates with the highest level of privilege on your computer - it can do things that you CAN'T DO.!<
    Repeat after me, again, **kernel-level software operates with the highest level of privilege on your computer - it can do things that even you CAN'T DO!**

    So far we only covered how incredibly privileged this software is on your machine, but let's talk about what CAN happen.

    * Security Vulnerabilities: The most concerning risk is related to security. When a program operates at the kernel level, ANY vulnerability in that program can potentially open the door to the entire system. If exploited, such vulnerabilities can lead to serious security breaches. In the case of Vanguard, any flaw in its design could be exploited by malicious entities to gain deep access to your system. Remember earlier about the keys? if someone untrustworthy gets a hold of them, they have access to everything inside. Kernel drivers are the keys to the kingdom. Have you ever wondered how viruses "nest" themselves into a system? By exploiting a driver developer's mistakes, malware can leverage the vulnerable driver to load itself into the kernel namespace and bring chaos. You are essentially voluntarily nesting kernel software into the kernel namespace :)

    &#x200B;

    * System Stability: Kernel-level software has the power to make changes that can affect the entire system's stability. Ever wondered why you get "bluescreen"? Well, there you go! When an issue occurs inside kernel-level software, it doesn't just crash - it takes the whole system with it, potentially corrupting it before the next boot. This can be caused by a simple mistake by the developer of the driver, which inherently means that introducing unneeded kernel software into your system can increase the chance of instability. When a user-level application crashes, you just restart it without threatening your whole system's stability.
    * Security Vulnerabilities: The most concerning risk is related to security. When a program operates at the kernel level, **ANY** vulnerability in that program can potentially open the door to the entire system. If exploited, such vulnerabilities can lead to serious security breaches. In the case of Vanguard, any flaw in its design could be exploited by malicious entities to gain deep access to your system. Remember earlier about the keys? if someone untrustworthy gets a hold of them, they have access to everything inside. Kernel drivers are the keys to the kingdom. Have you ever wondered how viruses "nest" themselves into a system? By exploiting a driver developer's mistakes, malware can leverage the vulnerable driver to load itself into the kernel namespace and bring chaos. You are essentially voluntarily nesting kernel software into the kernel namespace :). One might say that some god-level developers at Riot cannot produce a vulnerable driver, but know this - **bugs are a fact of life** - the more complex your driver is, the higher the chance of the developer making a mistake. That chance is never zero, not even close.

    &#x200B;
    * System Stability: Kernel-level software has the power to make changes that can affect the entire system's stability. Ever wondered why you get "bluescreen"? Well, there you go! When an issue occurs inside kernel-level software, it doesn't just crash - it takes the whole system with it, potentially corrupting it before the next boot. This can be caused by a simple mistake by the developer of the driver, which inherently means that introducing unneeded kernel software into your system can increase the chance of instability. In contrast, when a user-level application crashes, you just restart it without threatening your whole system's stability.

    * Privacy Concerns: Privacy is another area of concern. Kernel-level access means the software can monitor all activities on the computer at all times, with full permissions and privileges, without asking any questions or even informing you in any way :). I am sure that Vanguard will only "enable itself" while you are playing league, but that's just a "promise". You can't rely on such "promises" when your privacy is at stake. You are giving it your house keys and pretending it didn't happen.
    * Privacy Concerns: Privacy is another area of concern. Kernel-level access means the software can monitor all activities on the computer at all times, with full permissions and privileges, without asking any questions or even informing you in any way :). I am sure that Vanguard will only "enable itself" while you are playing league, but that's just a "**promise**". You can't rely on such "promises" when your privacy is at stake. You are giving it your house keys and pretending it didn't happen.

    &#x200B;

    * The Contrast with User-Level Software: Normally, your everyday software like games, discord, or whatever, operates at a much higher, more restricted level - we can call this user mode, userland, or user level. Userland software runs with virtual memory and has to ASK before doing ANYTHING. Whenever there is a malfunction, it is limited to that specific program, unlike kernel mode software, where the entire system collapses. There is absolutely no reason for a normal user to expose himself to this just to play a game.
    * The Contrast with User-Level Software: Normally, your everyday software like games, discord, or whatever, operates at a much higher, more restricted level - we can call this user mode, userland, or user level. Userland software runs with virtual memory and has to **ASK before doing ANYTHING**. Whenever there is a malfunction, it is limited to that specific program, unlike kernel mode software, where the entire system collapses. There is absolutely no reason for a normal user to expose themselves to this just to play a game.

    ## The intrusiveness

    Now that we have a clearer understanding of the risks involved in purposely allowing a piece of software access to the kernel, we can say a few things about the intrusive aspect of it all.

    * Deep System Access and Privacy: Kernel-level anti-cheats have an unparalleled depth of access to your system. The traditional anti-cheat "most of the time" operates only on the game files and starts up with the game ONLY. With Vanguard and other kernel-level anti-cheats, your whole system is being observed and monitored, including non-gaming related activities, even when you are NOT PLAYING :) It's like having a security camera that's meant to monitor your front door but ends up recording every corner of your house???

    &#x200B;

    * Continuous Operation: Another aspect of intrusiveness is the continuous operation of such software. With Vanguard and other kernel-level anti-cheats, your system is being monitored completely, from boot to shutdown, since the software boots up with your PC, and DOESN'T JUST RUN WHEN LEAGUE OF LEGENDS IS ACTIVE, it runs ALL THE TIME :) This constant surveillance raises concerns, not just about privacy, but also about the impact on system resources and performance.
    * Deep System Access and Privacy: Kernel-level anti-cheats have an unparalleled depth of access to your system. The traditional anti-cheat "most of the time" operates only on the game files and starts up with the game **ONLY**. With Vanguard and other kernel-level anti-cheats, your whole system is being observed and monitored, including non-gaming related activities, even when you are **NOT PLAYING** :) It's like having a security camera that's meant to monitor your front door but ends up recording every corner of your house???

    &#x200B;
    * Continuous Operation: Another aspect of intrusiveness is the continuous operation of such software. With Vanguard and other kernel-level anti-cheats, your system is being monitored completely, **from boot to shutdown**, since the software boots up with your PC, and **DOESN'T JUST RUN WHEN LEAGUE OF LEGENDS IS ACTIVE**, it runs ALL THE TIME :) This constant surveillance raises concerns, not just about privacy, but also about the impact on system resources and performance.

    * Potential for Data Collection: And of course, we must mention the "anonymous" data constantly being collected by the anticheat. With kernel-level anti-cheats being so intrusive, do you really trust them with the data they collect? There is absolutely no control over what the software can monitor, we are working on promises here...

    ## Any proof?

    Don't believe me how dangerous this is?

    A simple example, one of many: [https://www.wired.com/2013/11/e-sports/](https://www.wired.com/2013/11/e-sports/)
    * [Gaming co ESEA hit by $1m fine for hidden Bitcoin mining enslaver](https://www.theregister.com/2013/11/20/esea_gaming_bitcoin_fine/)
    * [Gaming Company Fined $1M for Turning Customers Into Secret Bitcoin Army](https://www.wired.com/2013/11/e-sports/)
    * [Easy Anti-Cheat hacked](https://www.pcgamer.com/games/battle-royale/easy-anti-cheat-washes-its-hands-of-the-apex-legends-hacking-disaster-that-saw-streamer-accounts-hijacked-live-there-is-no-rce-vulnerability-within-eac/)

    And MANY MORE that did not get caught, as it's extremely hard to get caught with this :)

    @@ -107,7 +100,7 @@ So, there we have it, we managed to barely scrape the surface on the topic... ov

    If you choose to install Vanguard and keep playing League, just remember that someone has unrestricted access to your PC the entire time it is being turned on (in the case of Vanguard at least) and that someone doesn't need your permission when he wants to do something :)

    Is it worth sacrificing a piece of your digital freedom and security to continue playing League of Legends?
    **Is it worth sacrificing a piece of your digital freedom and security to continue playing League of Legends?**

    Stay safe, stay informed:

  4. stdNullPtr revised this gist May 4, 2024. 1 changed file with 8 additions and 0 deletions.
    8 changes: 8 additions & 0 deletions ...der Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,11 @@
    <div align="center">
    <a href="https://guidedhacking.com/members/nullptr.274895/?referralcode=V8lJp">
    <img src="https://raw.githubusercontent.com/dsasmblr/hacking-online-games/master/resources/guidedhacking-hero.png" />
    </a>
    <br>
    <span align="center"><a href="https://guidedhacking.com/members/nullptr.274895/?referralcode=V8lJp">Read My Game Hacking Tutorials at GuidedHacking.com!</a></span>
    </div>

    # TL;DR

    When Riot Games introduces the Vanguard anti-cheat to League of Legends, you should **STOP** playing and you should not install the anti-cheat when you get the pop-up. Vanguard is a kernel-level anticheat and these anticheats operate at a privilege level **HIGHER THAN YOUR OWN**. **The anti-cheat can do things that even you can't do**, **without asking or letting you know**. It's like Riot installing a camera in every room of your house and getting a copy of every key inside.
  5. stdNullPtr revised this gist Jan 14, 2024. 1 changed file with 41 additions and 3 deletions.
    44 changes: 41 additions & 3 deletions ...der Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,3 +1,11 @@
    # TL;DR

    When Riot Games introduces the Vanguard anti-cheat to League of Legends, you should **STOP** playing and you should not install the anti-cheat when you get the pop-up. Vanguard is a kernel-level anticheat and these anticheats operate at a privilege level **HIGHER THAN YOUR OWN**. **The anti-cheat can do things that even you can't do**, **without asking or letting you know**. It's like Riot installing a camera in every room of your house and getting a copy of every key inside.

    Here is just one example of what they can do: [https://www.theregister.com/2013/11/20/esea\_gaming\_bitcoin\_fine/](https://www.theregister.com/2013/11/20/esea_gaming_bitcoin_fine/)

    [https://www.wired.com/2013/11/e-sports/](https://www.wired.com/2013/11/e-sports/)

    ## Who am I?

    Just a random player with a cheat developer past, that likes to reverse-engineer malware occasionally.
    @@ -23,7 +31,7 @@ All you ordinary gamers

    Only after diving into the world of reverse engineering and cheat development was I able to understand how incredibly intrusive anti-cheats can be. I get it, we all do, cheating is bad, ruins legit players' experience, and so on - but that's not the point here. The point is - that cheating is inevitable, so why force your player base to install a [**rootkit**](https://en.wikipedia.org/wiki/Rootkit) into their PCs?

    The only difference with Vanguard will be that the cheating players will just have to spend a **bit** more money for the premium kernel-mode cheats since a user-mode anti-cheat can hardly deal with a kernel-mode one. Valorant has Vanguard, so what? It still has cheaters and the premium cheat developers are not even charging that much. Speaking of "premium cheats", all this introduces a whole new problem, more usage of kernel cheats, which means just like with Vanguard - the user will voluntarily infect their PC with yet another kernel-level software to **mine some crypto** and **share their bank account with their favorite cheat developer** <3.
    The only difference Vanguard will bring is that the cheating players will just have to spend a **bit** more money for the premium kernel-mode cheats since a user-mode anti-cheat can hardly deal with a kernel-mode one. Valorant has Vanguard, so what? It still has cheaters and the premium cheat developers are not even charging that much. Speaking of "premium cheats", all this introduces a whole new problem, more usage of kernel cheats, which means just like with Vanguard - the user will voluntarily infect their PC with yet another kernel-level software to **mine some crypto** and **share their bank account with their favorite cheat developer** <3.

    Why don't game devs implement better detection methods server-side while keeping the user-mode piece of the software? You can detect and log "unreal" behavior without installing a rootkit into your players' PCs. We're not just talking about another piece of software, this is the core of your computer's operating system.

    @@ -33,6 +41,8 @@ In a computer, the kernel is the core software of the operating system. It handl

    The kernel operates at the **DEEPEST** level of your system and has complete control over anything happening in your computer. It decides which programs get resources, serves as a bridge between software and hardware using drivers, and controls essential security measures.

    Your everyday apps and games run at Ring3 (least privileged, safest for you). Can you guess who wants to be in Ring0? That's right - viruses, rootkits, spyware. Everything that can compromise your system and privacy. Casually running kernel-level software that YOU DON'T NEED exposes you and your system to risks that we cover below.

    After these few sentences you might say "Wow that sounds important and complex!", well **IT IS, THAT'S WHY YOU DON'T LET RANDOM SOFTWARE IN THERE.**

    Consider this:
    @@ -48,18 +58,41 @@ Repeat after me, again, >!kernel-level software operates with the highest level
    So far we only covered how incredibly privileged this software is on your machine, but let's talk about what CAN happen.

    * Security Vulnerabilities: The most concerning risk is related to security. When a program operates at the kernel level, ANY vulnerability in that program can potentially open the door to the entire system. If exploited, such vulnerabilities can lead to serious security breaches. In the case of Vanguard, any flaw in its design could be exploited by malicious entities to gain deep access to your system. Remember earlier about the keys? if someone untrustworthy gets a hold of them, they have access to everything inside. Kernel drivers are the keys to the kingdom. Have you ever wondered how viruses "nest" themselves into a system? By exploiting a driver developer's mistakes, malware can leverage the vulnerable driver to load itself into the kernel namespace and bring chaos. You are essentially voluntarily nesting kernel software into the kernel namespace :)

    &#x200B;

    * System Stability: Kernel-level software has the power to make changes that can affect the entire system's stability. Ever wondered why you get "bluescreen"? Well, there you go! When an issue occurs inside kernel-level software, it doesn't just crash - it takes the whole system with it, potentially corrupting it before the next boot. This can be caused by a simple mistake by the developer of the driver, which inherently means that introducing unneeded kernel software into your system can increase the chance of instability. When a user-level application crashes, you just restart it without threatening your whole system's stability.

    &#x200B;

    * Privacy Concerns: Privacy is another area of concern. Kernel-level access means the software can monitor all activities on the computer at all times, with full permissions and privileges, without asking any questions or even informing you in any way :). I am sure that Vanguard will only "enable itself" while you are playing league, but that's just a "promise". You can't rely on such "promises" when your privacy is at stake. You are giving it your house keys and pretending it didn't happen.

    &#x200B;

    * The Contrast with User-Level Software: Normally, your everyday software like games, discord, or whatever, operates at a much higher, more restricted level - we can call this user mode, userland, or user level. Userland software runs with virtual memory and has to ASK before doing ANYTHING. Whenever there is a malfunction, it is limited to that specific program, unlike kernel mode software, where the entire system collapses. There is absolutely no reason for a normal user to expose himself to this just to play a game.

    ## The intrusiveness

    Now that we have a clearer understanding of the risks involved in purposely allowing a piece of software access to the kernel, we can say a few things about the intrusive aspect of it all.

    * Deep System Access and Privacy: Kernel-level anti-cheats have an unparalleled depth of access to your system. The traditional anti-cheat "most of the time" operates only on the game files and starts up with the game ONLY. With Vanguard and other kernel-level anti-cheats, your whole system is being observed and monitored, including non-gaming related activities, even when you are NOT PLAYING :) It's like having a security camera that's meant to monitor your front door but ends up recording every corner of your house??
    * Deep System Access and Privacy: Kernel-level anti-cheats have an unparalleled depth of access to your system. The traditional anti-cheat "most of the time" operates only on the game files and starts up with the game ONLY. With Vanguard and other kernel-level anti-cheats, your whole system is being observed and monitored, including non-gaming related activities, even when you are NOT PLAYING :) It's like having a security camera that's meant to monitor your front door but ends up recording every corner of your house???

    &#x200B;

    * Continuous Operation: Another aspect of intrusiveness is the continuous operation of such software. With Vanguard and other kernel-level anti-cheats, your system is being monitored completely, from boot to shutdown, since the software boots up with your PC, and DOESN'T JUST RUN WHEN LEAGUE OF LEGENDS IS ACTIVE, it runs ALL THE TIME :) This constant surveillance raises concerns, not just about privacy, but also about the impact on system resources and performance.

    &#x200B;

    * Potential for Data Collection: And of course, we must mention the "anonymous" data constantly being collected by the anticheat. With kernel-level anti-cheats being so intrusive, do you really trust them with the data they collect? There is absolutely no control over what the software can monitor, we are working on promises here...

    ## Any proof?

    Don't believe me how dangerous this is?

    A simple example, one of many: [https://www.wired.com/2013/11/e-sports/](https://www.wired.com/2013/11/e-sports/)

    And MANY MORE that did not get caught, as it's extremely hard to get caught with this :)

    ## Conclusion

    So, there we have it, we managed to barely scrape the surface on the topic... overall, it's your job to protect your privacy, since apparently the incredibly intrusive kernel anti-cheats are somehow still legal.
    @@ -74,4 +107,9 @@ Stay safe, stay informed:
    * [https://en.wikipedia.org/wiki/Rootkit](https://en.wikipedia.org/wiki/Rootkit)
    * [https://documents.trendmicro.com/assets/white\_papers/wp-an-in-depth-look-at-windows-kernel-threats.pdf](https://documents.trendmicro.com/assets/white_papers/wp-an-in-depth-look-at-windows-kernel-threats.pdf)
    * [https://cpu.land/](https://cpu.land/)
    * [https://www.youtube.com/watch?v=nk6aKV2rY7E](https://www.youtube.com/watch?v=nk6aKV2rY7E) (I'm pissed off as well mate)
    * [https://www.youtube.com/watch?v=nk6aKV2rY7E](https://www.youtube.com/watch?v=nk6aKV2rY7E) (I'm pissed off as well mate)
    * [https://www.theregister.com/2013/11/20/esea\_gaming\_bitcoin\_fine/](https://www.theregister.com/2013/11/20/esea_gaming_bitcoin_fine/) driver mining bitcoin

    Update 1: Added TL;DR

    Update 2: Added ring protection levels
  6. stdNullPtr revised this gist Jan 11, 2024. 1 changed file with 0 additions and 3 deletions.
    3 changes: 0 additions & 3 deletions ...der Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md
    View file
    Original file line number Diff line number Diff line change
    @@ -10,8 +10,6 @@ Anticheats are getting **more and more intrusive**, it's getting out of hand and

    I want to convince you NOT to voluntarily install (anti-tamper, or whatever) kernel-level software of any kind, shooting yourself in both feet.

    *Also, English is not my native, don't be that guy.*

    ## Audience

    All you ordinary gamers
    @@ -20,7 +18,6 @@ All you ordinary gamers

    * Lower, higher access levels - consider lower -> closer to hardware, meaning MORE privileged (may be counter-intuitive to some)
    * The software that runs in the kernel namespace is referred to as a driver.
    * *placeholder for more*

    ## The Problem

  7. stdNullPtr created this gist Jan 10, 2024.
    80 changes: 80 additions & 0 deletions ...der Playing League of Legends: The Risks of Kernel-Level Anti-Cheat Software.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,80 @@
    ## Who am I?

    Just a random player with a cheat developer past, that likes to reverse-engineer malware occasionally.

    ## Why did I decide to write this lengthy boring post?

    Anticheats are getting **more and more intrusive**, it's getting out of hand and people should have a better understanding of how intrusive and dangerous kernel mode software can be. It's driving me crazy how game developers get away with this.

    ## Goal

    I want to convince you NOT to voluntarily install (anti-tamper, or whatever) kernel-level software of any kind, shooting yourself in both feet.

    *Also, English is not my native, don't be that guy.*

    ## Audience

    All you ordinary gamers

    ## Some Clarifications

    * Lower, higher access levels - consider lower -> closer to hardware, meaning MORE privileged (may be counter-intuitive to some)
    * The software that runs in the kernel namespace is referred to as a driver.
    * *placeholder for more*

    ## The Problem

    Only after diving into the world of reverse engineering and cheat development was I able to understand how incredibly intrusive anti-cheats can be. I get it, we all do, cheating is bad, ruins legit players' experience, and so on - but that's not the point here. The point is - that cheating is inevitable, so why force your player base to install a [**rootkit**](https://en.wikipedia.org/wiki/Rootkit) into their PCs?

    The only difference with Vanguard will be that the cheating players will just have to spend a **bit** more money for the premium kernel-mode cheats since a user-mode anti-cheat can hardly deal with a kernel-mode one. Valorant has Vanguard, so what? It still has cheaters and the premium cheat developers are not even charging that much. Speaking of "premium cheats", all this introduces a whole new problem, more usage of kernel cheats, which means just like with Vanguard - the user will voluntarily infect their PC with yet another kernel-level software to **mine some crypto** and **share their bank account with their favorite cheat developer** <3.

    Why don't game devs implement better detection methods server-side while keeping the user-mode piece of the software? You can detect and log "unreal" behavior without installing a rootkit into your players' PCs. We're not just talking about another piece of software, this is the core of your computer's operating system.

    ## What is the kernel (in simple terms)?

    In a computer, the kernel is the core software of the operating system. It handles all the fundamental operations, like managing memory, processing tasks, and communicating between your hardware (like your keyboard, mouse, and monitor) and software (like your games and applications).

    The kernel operates at the **DEEPEST** level of your system and has complete control over anything happening in your computer. It decides which programs get resources, serves as a bridge between software and hardware using drivers, and controls essential security measures.

    After these few sentences you might say "Wow that sounds important and complex!", well **IT IS, THAT'S WHY YOU DON'T LET RANDOM SOFTWARE IN THERE.**

    Consider this:

    >When you are having guests over at home, do you hand over a key to your house to each one of them when they first come? NO??? Why not? They won't have to ring the doorbell next time, think of the insane convenience that this brings. What? They can come at any point, even when you are not there? Naaaaah come on why would they do that, they even promised not to! Wait what? You don't want to give them keys? Well too bad since it was not a question or a request, prepare to be evicted.
    That's you, inviting Vanguard over, FOREVER... well technically until you uninstall it but with such privileged software a complete **OS purge is recommended alongside all your drives.**

    ## The risks of kernel-level access

    Repeat after me, again, >!kernel-level software operates with the highest level of privilege on your computer - it can do things that you CAN'T DO.!<

    So far we only covered how incredibly privileged this software is on your machine, but let's talk about what CAN happen.

    * Security Vulnerabilities: The most concerning risk is related to security. When a program operates at the kernel level, ANY vulnerability in that program can potentially open the door to the entire system. If exploited, such vulnerabilities can lead to serious security breaches. In the case of Vanguard, any flaw in its design could be exploited by malicious entities to gain deep access to your system. Remember earlier about the keys? if someone untrustworthy gets a hold of them, they have access to everything inside. Kernel drivers are the keys to the kingdom. Have you ever wondered how viruses "nest" themselves into a system? By exploiting a driver developer's mistakes, malware can leverage the vulnerable driver to load itself into the kernel namespace and bring chaos. You are essentially voluntarily nesting kernel software into the kernel namespace :)
    * System Stability: Kernel-level software has the power to make changes that can affect the entire system's stability. Ever wondered why you get "bluescreen"? Well, there you go! When an issue occurs inside kernel-level software, it doesn't just crash - it takes the whole system with it, potentially corrupting it before the next boot. This can be caused by a simple mistake by the developer of the driver, which inherently means that introducing unneeded kernel software into your system can increase the chance of instability. When a user-level application crashes, you just restart it without threatening your whole system's stability.
    * Privacy Concerns: Privacy is another area of concern. Kernel-level access means the software can monitor all activities on the computer at all times, with full permissions and privileges, without asking any questions or even informing you in any way :). I am sure that Vanguard will only "enable itself" while you are playing league, but that's just a "promise". You can't rely on such "promises" when your privacy is at stake. You are giving it your house keys and pretending it didn't happen.
    * The Contrast with User-Level Software: Normally, your everyday software like games, discord, or whatever, operates at a much higher, more restricted level - we can call this user mode, userland, or user level. Userland software runs with virtual memory and has to ASK before doing ANYTHING. Whenever there is a malfunction, it is limited to that specific program, unlike kernel mode software, where the entire system collapses. There is absolutely no reason for a normal user to expose himself to this just to play a game.

    ## The intrusiveness

    Now that we have a clearer understanding of the risks involved in purposely allowing a piece of software access to the kernel, we can say a few things about the intrusive aspect of it all.

    * Deep System Access and Privacy: Kernel-level anti-cheats have an unparalleled depth of access to your system. The traditional anti-cheat "most of the time" operates only on the game files and starts up with the game ONLY. With Vanguard and other kernel-level anti-cheats, your whole system is being observed and monitored, including non-gaming related activities, even when you are NOT PLAYING :) It's like having a security camera that's meant to monitor your front door but ends up recording every corner of your house??
    * Continuous Operation: Another aspect of intrusiveness is the continuous operation of such software. With Vanguard and other kernel-level anti-cheats, your system is being monitored completely, from boot to shutdown, since the software boots up with your PC, and DOESN'T JUST RUN WHEN LEAGUE OF LEGENDS IS ACTIVE, it runs ALL THE TIME :) This constant surveillance raises concerns, not just about privacy, but also about the impact on system resources and performance.
    * Potential for Data Collection: And of course, we must mention the "anonymous" data constantly being collected by the anticheat. With kernel-level anti-cheats being so intrusive, do you really trust them with the data they collect? There is absolutely no control over what the software can monitor, we are working on promises here...

    ## Conclusion

    So, there we have it, we managed to barely scrape the surface on the topic... overall, it's your job to protect your privacy, since apparently the incredibly intrusive kernel anti-cheats are somehow still legal.

    If you choose to install Vanguard and keep playing League, just remember that someone has unrestricted access to your PC the entire time it is being turned on (in the case of Vanguard at least) and that someone doesn't need your permission when he wants to do something :)

    Is it worth sacrificing a piece of your digital freedom and security to continue playing League of Legends?

    Stay safe, stay informed:

    * [https://en.wikipedia.org/wiki/Kernel\_(operating\_system)](https://en.wikipedia.org/wiki/Kernel_(operating_system))
    * [https://en.wikipedia.org/wiki/Rootkit](https://en.wikipedia.org/wiki/Rootkit)
    * [https://documents.trendmicro.com/assets/white\_papers/wp-an-in-depth-look-at-windows-kernel-threats.pdf](https://documents.trendmicro.com/assets/white_papers/wp-an-in-depth-look-at-windows-kernel-threats.pdf)
    * [https://cpu.land/](https://cpu.land/)
    * [https://www.youtube.com/watch?v=nk6aKV2rY7E](https://www.youtube.com/watch?v=nk6aKV2rY7E) (I'm pissed off as well mate)