How kernel anti-cheats work
s4dbrd.github.io
s4dbrd.github.io
Modern cheats use hypervisors or just compromise hyper-v and because hyper-v protects itself so it automatically protects your cheat.
Another option that is becoming super popular is bios patching, most motherboards will never support boot guard and direct bios flashing will always be an option since the chipset fuse only protects against flashing from the chipset.
DMA is probably the most popular by far with fusers. However, the cost of good ones has been increasing due to vanguard fighting the common methods which is bleeding into other anticheats (some EAC versions and ricochet).
These are not assumptions, every time anticheats go up a level so do the cheats. In the end the weakest link will be exploited and it doesn't matter how sophisticated your anticheat is.
What does make cheat developers afraid is AI, primarily in overwatch. It's quite literally impossible to cheat anymore (in a way that disturbs normal players for more than a few games) and they only have a usermode anticheat! They heavily rely on spoofing detection and gameplay analysis including community reports. Instead of detecting cheats, they detect cheaters themselves and then clamp down on them by capturing as much information about their system as possible (all from usermode!!!).
Of course you could argue that you could just take advantage that they have to go through usermode to capture all this information and just sit in the kernel, but hardware attestation is making this increasily more difficult.
The future is usermode anticheats and gameplay analysis, drop kernel mode anticheats.
No secure boot doesn't work if you patch SMM in bios, you run before TPM attestation happens.
I wouldn’t call BIOS patching “super popular”. That sounds like an admission that anti-cheat is working because running cheats now requires a lot of effort. Now that cheats are becoming more involved to run, it’s becoming less common to cheat.
When cheats were as simple as downloading a program and you were off to cheating, the barrier to entry was a lot lower. It didn’t require reboots or jumping through hoops. Anyone could do it and didn’t even have to invest much time into it.
Now that cheats are no longer an easy thing to do, a lot of would-be cheaters are getting turned off of the idea before they get far enough to cheat in a real game.
> Of course you could argue that you could just take advantage that they have to go through usermode to capture all this information and just sit in the kernel, but hardware attestation is making this increasily more difficult.
Didn’t the first half of your post just argue that these measures can be defeated and therefore you can’t rely on them?
Anticheats, especially kernel-mode ones does not make the problem smaller. All they do is make it more rewarding for capable people.
The average cheater is (or was) basically a troll. They delighted in the act of ruining other people’s games, not installing the cheat. The harder you make it for them to get to that point, the less enjoyment they get.
The people you describe who are in it for the thrill of breaking through are not the ones playing 6 hours every night because the game itself is not the thrill. It’s the exploration of the hardware and software. They might get cheats set up, but once it’s working they get bored with the game and move on to another technical challenge.
* I use easy cheats for single player games - for example, infinite jumps in cyberpunk 2077 are just huge amounts of fun :)
* I have zero desire for cheating in multilayer games. Not some high morality righteous horse, just, what's the point? I have fun even when I lose, and having something else play for you takes away from visceral fun that I get.
* I could understand, even if not agree, people who cheat for profit. That's the basis of all crime everywhere.
* I do not understand people who cheat in multilayer games not-for-profit. It feel you need to have both a) some sort of anti social / non social tendency, and b) dopamine rushes along pathways I don't.
I'd be genuinely curious to hear about your acquaintances who cheat in multilayer for no profit and why they do it :-)
Some are just addicted, they really love the game, but playing without cheats doesn't make them feel anything so they pick the easiest solution: continue to cheat... forever.
Some are just delusional, they do not want to deal with the reality that they're not good at the game without cheats.
Some are just trolling and want to spinbot piss people off, make people angry. It's what makes them happy.
Some don't have a choice, they started their competitive career with cheats.
Some justify it that "I made the cheat, I deserve to use it"
If you want more I got a whole book of reasons. I am in a unique situation since I happen to be friends from back when I was cheating a lot my self, in that time I established relationships with a lot of developers and personally for me it was curiosity that got me not only into cheating, but the whole process and development. I ended up just making roblox games though.
I, myself, got two accounts banned and I was innocent. I managed to make it through support and got them unbanned but I'm fairly certain that many players didn't, because they seem to employ AI in their support.
So I'm a bit skeptical about that kind of behavioural bans. You risk banning a lot of dedicated players who happened to play differently from the majority and that tend to bring bad reputation. For example I no longer purchase yearly subscription, because I'm afraid of sudden ban and losing lots of unspent subscription time.
You don't play a "match", you don't play "against" other players most of the time, in this context "botting" and "cheating" overlap because having your character do stuff 24/7 unattended is an evident advantage over the rest of the population, but it's not like you are hindering anyone's progress directly the vast majority of the time doing so.
How often does actual cheating happen in WoW, anywhere it matters? M+? Raiding? PvP?
That's indirectly hindering other players progression, because it causes deflation (so you can't earn as much gold selling your ores); because it causes inflation (more circulating gold, yes, these are contradictory); because it denies other player farm (if bot gathered ore, other player have to search for another vein) and so on; also illegal gold selling increases expectations (other players bought super good gear, why don't you do that) and causes burn-out (because farming gold fairly is much more hard, than just buying it).
But mainly it just makes players angry, because they can see these bots moving in a predetermined route and stealing resources from their noses. I'm not really sure if bots are that bad in the grand scheme of things, but living players certainly don't like to compete with automatons.
There were also cheaters who used instant cast interruptions at arenas, but it seems that competitive PvP is not that popular nowadays so I'm not sure how it's wide spread.
I only remember coming across one of these myself, basically a boss fight where you could exploit pathing to take one of the enemies out of the encounter.
This was all just for boasting rights - being server first for a given boss fight with an undergeared raid group.
It was always a coin flip sometimes to understand if the strategy you came up with was going to get flagged by a DM or not. Usually for brand new fights they'd come warn you before an actual take-down they disapproved of, and you'd only get banned if you ignored the warning and continued. I can only assume Blizzard had alerts of some sort so in-game DMs would be notified when a guild started a give encounter.
It's almost the same as saying "you don't need a password on your phone" or something like that.
False, people that have information they shouldn't have will act in detectable ways, even if they try their hardest not to.
ESP is a lot more obvious to a machine than one might think, the subtle behavior differences are obvious to a human and even more so for a model. Of course none of that can be proven, but it can increase the scrutiny of such players from player reports.
> you can achieve the same with user mode anticheats
A user mode anti cheat is immediately defeated by a kernel mode cheat, and cheaters have already moved past this in practice.
A user mode anti cheat (on windows) with admin privileges has pretty much full system access anyway, so presumably if you have a problem with kernel AC you also have a problem with user mode.
Lastly, cheating is an arms race. While in theory, the cheaters will always win, the only thing that actually matters is what the cheaters are doing in practice. Kernel mode is default even for free cheats you download, so the defaults have to cover that.
AKA the way that is easiest to detect, and the easiest way to claim that the game doesn't have cheaters. Behavioral analysis doesn't work with closet cheaters, and they corrupt the community and damage the game in much subtler ways. There's nothing worse than to know that the player you've competed with all this time had a slight advantage from the start.
And it is possible to silently put you into a cheating game match maker, so that you only ever match with other cheaters. This, to me, is prob. the better outcome than outright banning (which means the cheater just comes back with a new account). Silently moving them to a cheater queue is a good way to slow them down, as well as isolate them.
Not with 100% accuracy. This means some legitimate players would be qualified as potentially cheating.
You don't have to play with wallhacks constantly on, you can toggle. And it doesn't detect cases where you're camping with an AWP and have 150ms response time instead of 200ms. Sometimes people are just having a good day.
> cheating game match maker
This is already a thing. In CS2, you have a Trust Factor. The lower your trust factor is, the bigger the chance you will be queued with/against cheaters.
there are already systems that just use the video feed of the game and provide external inputs for popular games (see [1] for a goofy demo). this goes beyond the pc where the game is being run.
kernel-level anti-cheats came at the wrong standpoint imho, and since there are still cheats in games that support it (e.g. EA FC 25, some CoD Warzone stories, etc.), not quite worth the compromise.
They won way more than they lost, people who left got given a free pass for ratting the remaining people out.
Not sure what your point is. Most of your post is inaccurate, DMA cheats represent the minority of cheats because they're very expensive and you need a second computer.
The scene has shifted immensely in the last few years, everyone and their grandmother has DMA now, I mean you can buy these off amazon now. Korean's are a bit stuck since most of them use gaming cafes so they've been slow adopters, but cafe shops have the benefit of using an old version of hyper-v which allows you to just use the method described above. Hyper-V cheats are the most popular for valorant.
I would argue that valorant and overwatch are pretty much on the same level based on what it feels to play. I've seen just as many visible cheaters in valorant as in overwatch. Although I will admit that I am pretty outdated myself since around mid 2025. Valorant allows you to ** around so that might be related, overwatch bans rage hackers way faster than valorant does as well.
So no, my post is pretty accurate.
I did main support and tank at master level in OW and beside esp there is 0 benefit of cheating.
Mucking about in the kernel basically bypasses the entire security and stability model of the OS. And this is not theoretical, people have been rooted through buggy anticheats software, where the game sent malicious calls to the kernel, and hijacked to anti cheat to gain root access.
Even in a more benign case, people often get 'gremlins', weird failures and BSOD due to some kernel apis being intercepted and overridden incorrectly.
The solution here is to establish root of trust from boot, and use the OSes sandboxing features (like Job Objects on NT and other stuff). Providing a secure execution environment is the OS developers' job.
Every sane approach to security relies on keeping the bad guys out, not mitigating the damage they can do once they're in.
I really thought this might change over time given strong desire for useful attestation by major actors like banks and media companies, but apparently they cannot exert the same level of influence on the PC industry as they have on the mobile industry.
Secure boot with software attestation could also be used for good.
There should be a physical button inside the case labeled "set up secure boot"
This is just establishing chain of trust, and does not prevent you from doing anything on your system.
True, this could be hypothetically extended to disallow booting third party binaries, but I would say that's just extrapolation for now and not reality.
The reason cheating is a problem at all is that instead of playing with friends, you use online matchmaking to play with equally alienated online strangers. This causes issues well in excess of cheating, including paranoia over cheating.
To you. I’m perfectly happy to run a kernel level anticheay - I’m already running their code on my machine, and it can delete my files, upload them as encrypted game traffic, steal my crypto keys, screenshot my bank details and private photos all without running at a kernel level.
> trying to solve a social problem with technology
I disagree. I’m normally on the side of not doing that but increasing the player pool and giving players access to more people at the their own skill level is a good thing
The vast, vast majority of skilled FPS players will predict their shots and shoot where they think the enemy player will be relative to the known hit detection of the game. In high level play for something like r6 siege, I’d say it’s 99% shooting before you can possibly know where they are by “feeling”
The security of PCs is still poor. Even if you had every available security feature right now it's not enough for the game to be safe. We still need to wait for PCs to catch up with the state of the art, then we have to wait 5+ years for devices to make it into the wild to have a big enough market share to make targeting them to be commercially viable.
The thing about gaming is that it’s not acceptable to leave 5% performance on the table whereas for other uses it usually is.
> And I do want a high end PC for other use cases.,
Right, you don't want two devices (that's fair). How can you _possibly_ trust the locked down device won't interfere with the other open software it's installed side by side with?
Also you can plug a mouse in a console… that's a weird excuse.
This is the only defense Microsoft has against the growing Linux Gaming crowd. Microsoft forgot how to make good, consumer friendly software.
I think that’s an incredibly rare stance not held by the vast majority of gamers, including competitive ones.
That would mean those who are concerned about the integrity would want to sandbox everything else instead. And even if people are ok with giving up a small bit of perf when gaming, I’m sure they’re even more happy to give up perf when doing online banking.
That’s not true at all in the field of cybersecurity in general, and I have doubts that it’s true in the subset of the field that has to do with anticheat.
If you got RCE in the game itself, it's effectively game over for any data you have on the computer.
Hot take: It's also totally unnecessary. The entire arms race is stupid.
Proper anti-cheat needs to be 0% invasive to be effective; server-side analysis plus client-side with no special privileges.
The problem is laziness, lack of creativity and greed. Most publishers want to push games out the door as fast as possible, so they treat anti-cheat as a low-budget afterthought. That usually means reaching for generic solutions that are relatively easy to implement because they try to be as turn-key as possible.
This reductionist "Oh no! We have to lock down their access to video output and raw input! Therefore, no VMs or Linux for anyone!" is idiotic. Especially when it flies in the face of Valve's prevailing trend towards Linux as a proper gaming platform.
There's so many local-only, privacy-preserving anti-cheat approaches that can be done with both software and dirt cheap hardware peripherals. Of course, if anyone ever figures that out, publishers will probably twist it towards invasive harvesting of data.
I'd love to be playing Marathon right now, but Bungie just wholesale doesn't support Linux nor VMs. Cool. That's $40 they won't get from me, multiply by about 5-10x for my friends. Add in the negative reviews that are preventing the game's Steam rating from reaching Overwhelmingly Positive and the damage to sales is significant.
People always freak out when I mention secure boot, and the funniest response usually are the ones who threaten to abandon Windows for macOS (which has had secure boot for more than a decade by default)
I'm not super technically knowledgeable about secure boot, but as far as I understand, you need to have a kernel signed by a trusted CA, which sucks if you want to compile your own, but is a hurdle generally managed by your distro, if you're willing to use their kernel.
But if all else fails you can always disable secure boot.
I'm a big secure boot fan. The fact that it's becoming increasingly common for games to require it is the stupid part.
Said games tend to want that root of trust to be known OEM keys, not custom keys. At that point they're dictating the operating system and hardware you can use, and that's where that approach becomes garbage.
Hardware attestation should not be a requirement nor concern for games, period.
for now
It'd be really interesting to see what would happen - for instance, what fraction of players would pick each pool during the first few weeks after launch, and then how many of them would switch after? What about players who joined a few months or a year after launch?
Unfortunately, pretty much the only company that could make this work is Valve, because they're the only one who actually cares for players and is big enough that they could gather meaningful data. And I don't think that even Valve will see enough value in this to dedicate the substantial resources it'd take to try to implement.
Great video on Trackmania cheating investigation: https://youtu.be/yDUdGvgmKIw
This is roughly what Valve does for CS2. But, as far as I understand, it's not very effective and unfortunately still results in higher cheating rates than e.g. Valorant.
The example still kind of applies. In the CS world, serious players use Faceit for matchmaking, which requires you to install a kernel-level anticheat. This is basically what you're suggesting, but operated by a 3rd party.
But so far that still seems to be miles away.
But anyway counterstrike did have community policing of lobbies called overwatch - https://counterstrike.fandom.com/wiki/Overwatch
It was terrible as it required the community to conclude beyond reasonable doubt the suspect was cheating, and cheats today are sophisticated enough to make that conclusion very difficult to make
And the way community policing worked in the past is that the "police" (refs) could just kick or ban you. They don't need a trial system if the community doesn't want that.
I guess I didn't exactly make that clear...
A few of the arguments advanced by the "anti-anticheat" crowd that inevitably pops up in these threads are "anticheat is ineffective so there's no point to using it" and "anticheat is immoral because players aren't given a choice to use it or not and most of them would choose to not use it".
I don't believe that either of these are true (and given the choice I would almost never pick the no-anticheat queue), but there's not a lot of good high-quality data to back that up. Hence, the proposal for a dual-queue system to try to gather that data.
Putting in the community review of the no-anticheat pool is just to head off the inevitable goalpost-moving of "well of course no system would be worse than a crappy system (anticheat), you need to compare the best available alternative (community moderation)".
at least when focusing on counter-strike (CSGO/CS2), they've tried tons of ways to segregate the player base in terms of trustworthy vs not.
from "anti-cheat" vs not, verifying users using phones, paying vs not, you name it.
none of their initiatives managed to ward off the bad actors from the "secured" version. does not give me the confidence that they could make a system work effectively, but something that can work cross-platform, perhaps.
If you want a more serious competitive scene you have FACEIT, which AC is covered in the article.
Trust Factor, despite not being an Anti-Cheat, is arguably one of the best defenses against cheaters (and ultimately toxic players).
Community moderation simply doesn't work at scale for anticheat - in level of effort required, root cause detection, and accuracy/reliability.
I rather play with cheaters here and there than install some kernel level malware on machine just to make sure EA, Activision, et al can keep raking in money hand over fist.
Or better yet, I can just play on console where there is no cheating that I have ever seen.
Cheaters are by definition anomalies, they operate with information regular players do not have. And when they use aimbots they have skills other players don't have.
If you log every single action a player takes server-side and apply machine learning methods it should be possible to identify these anomalies. Anomaly detection is a subfield of machine learning.
It will ultimately prove to be the solution, because only the most clever of cheaters will be able to blend in while still looking like great players. And only the most competently made aimbots will be able to appear like great player skills. In either of those cases the cheating isn't a problem because the victims themselves will never be sure.
There is also another method that the server can employ: Players can be actively probed with game world entities designed for them to react to only if they have cheats. Every such event would add probability weight onto the cheaters. Ultimately, the game world isn't delivered to the client in full so if done well the cheats will not be able to filter. For example: as a potential cheater enters entity broadcast range of a fake entity camping in an invisible corner that only appears to them, their reaction to it is evaluated (mouse movements, strategy shift, etc). Then when it disappears another evaluation can take place (cheats would likely offer mitigations for this part). Over time, cheaters will stand out from the noise, most will likely out themselves very quickly.
So are very good players, very bad players, players with weird hardware issues, players who just got one in a million lucky…
When you have enough randomly distributed variables, by the law of big numbers some of them will be anomalous by pure chance. You can't just look at any statistical anomaly and declare it must mean something without investigating further.
In science, looking at a huge number of variables and trying to find one or two statistically significant variables so you can publish a paper is called p hacking. This is why there are so many dubious and often even contradictory "health condition linked to X" articles.
They will all cluster in very different latent spaces.
You don't automatically ban anomalies, you classify them. Once you have the data and a set of known cheaters you ask the model who else looks like the known cheaters.
Online games are in a position to collect a lot of data and to also actively probe players for more specific data such as their reactions to stimuli only cheaters should see.
If all you do is read Reddit threads all day, you'd think the game is unplayable. Although if you actually play the game, the problem is far less extreme than it is made out to be.
Source: 10,000 hours in CSGO/CS2.
But a good way of solving this in community managed multiplayer games is this: if a player is extremely good to the point where it’s destroying the fun of every other player: just kick them out.
Unfair if they weren’t cheating? Sure. But they can go play against better players elsewhere. Dominating 63 other players and ruining their day isn’t a right. You don’t need to prove beyond reasonable doubt they’re cheating if you treat this as community moderation.
it is, if you're not cheating and is in fact just that good. That's called competitive sports, which participants voluntarily engage in.
If a community manages a server, it’s basically private property. And community managed servers are always superior to official publisher-managed servers. Anticheat - or just crowd management - is done hands on in the server rather than automated, async, centralized.
Buying the game might mean you have a ”right” to play it, but not on my server you don’t.
People who engage in competitive sports all agree to it. Most people want to play for fun. They have a natural right to do so.
I’m talking about normal old fashioned server administration now, I.e people hosting/renting their game infra and doing the administration: making rules, enforcing the rules by kicking and banning, charging fees either for vip status meaning no queuing etc, or even to play at all.
> With that goal in mind, we released a patch as soon as we understood the method these cheats were using. This patch created a honeypot: a section of data inside the game client that would never be read during normal gameplay, but that could be read by these exploits. Each of the accounts banned today read from this "secret" area in the client, giving us extremely high confidence that every ban was well-deserved.
Valve has spent a lot of time and money on machine learning models which analyze demo files (all inputs). Yet Counter-Strike is still infested with cheaters. I guess we can speculate that it's just a faulty implementation, but clearly the problem isn't just "throw a ML model at the problem".
Behavioral analysis is way harder in practice than it sounds, because most closet cheaters do not give enough signal to stand out, and the clusters are moving pretty fast. The way people play the game always changes. It's not the problem of metric selection as it might appear to an engineer, you need to watch the community dynamics. Currently only humans are able to do that.
The problem is that traditional cheats (aimbot, wallhack, etc.) give users such a huge edge that they are multiple standard deviations from the norm on key metrics. I agree with you on that and there are anticheats that look for that exact thing.
I've also seen anticheats where flagged users have a session reviewed. EG you review a session with "cheats enabled" and try to determine whether you think the user is cheating. This works decently well in a game like CS where you can be reasonably confident over a larger sample size whether a user is playing corners correctly, etc.
The issue with probing for game world entities is that at some point, you have to resolve it in the client. EG "this is a fake player, store it in memory next to the other player entities but don't render this one on screen." This exact thing has happened in multiple games, and has worked as a temporary solution. End of the day, it ends up being a cat and mouse game. Cheat developers detect this and use the same resolution logic as the game client does. Memory addresses change, etc. and the users are blocked from using it for a few hours or a few days, but the developer patches and boom, off to the races.
These days game hacks are a huge business. Cheats often are offered as a subscription and can rank from anywhere from 10-hundreds of dollars a month. It's big money and some of the larger hack manufacturers are full blown companies which can have tens of thousands of customers. It's a huge business.
I think you're realistically left with two options. Require in-person LAN matches with hardware provided by the tournament which is tamper-resistant. Or run on a system so locked down that cheats don't exist.
Both have their own problems... In-person eliminates most of that risk but it's always possible to exploit. Running on a system which is super locked down (say, the most recent playstation) probably works, until someone has a 0day tucked away that they hoard specifically for their advantage. An unlikely scenario but with the money involved in some esports... Anything is possible.
https://www.documentcloud.org/documents/24698335-la22cv00051...
This is not well done. Only the server should be able to tell what the honeypot is. The point is to spawn an entity for one or more clients which will be 100% real for them but would not matter because without cheats it has no impact on them whatsoever. When the world evolves such that an impact becomes more likely then you de-spawn it.
This will only be possible if the server makes an effort to send incomplete entity information (I believe this is common), this way the cheats cannot filter out the honeypots. The cheats will need to become very sophisticated to try and anticipate the logic the server may use in its honeypots, but the honeypot method is able to theoretically approach parity with real behavior while the cheat mitigations cannot do that with their discrimination methods (false positives will degrade cheater performance and may even leak signal as well).
For example you can use a player entity that the client hasn't seen yet (or one that exited entity broadcast/logic range for some time) as a fake player that's camping an invisible corner, then as the player approaches it you de-spawn it. A regular player will never even know it was there.
Another vector to push is netcode optimizations for anti-cheating measures. To send as little information as possible to the client, decouple the audio system from the entity information - this will allow the honeypot methods to provide alternative interpretations for the audio such as a firefights between ghosts only cheaters will react to. This will of course be very complex to implement.
The greatest complexity in the honeypot methods will no doubt be how to ensure no impact on regular players.
Anyway, this isn’t the Olympics, a professional sport, or Chess. It’s more like pickup league. Preserving competitive purity should be a non-goal. Rather, aim for fun matches. Matchmaking usually tries to find similar skill level opponents anyway, so let cheaters cheat their way out of the wider population and they’ll stop being a problem.
Or, let players watch their killcams and tag their deaths. Camper, aimbot, etc etc. Then (for players that have a good sample size of matches) cluster players to use the same tactics together.
Treating games like serious business has sucked all the fun out of it.
Matching based on skill works only as long as you have an abundance of players you can do that based on. When you have to account for geography, time of day, momentary availability, and skill level, you realize that you have fractured certain players far too much that it’s not fun for them anymore. Keep in mint that “cheaters” are also looking for matches that would maximize their cheats. Maybe it’s 8PM Pacific Time with tons of players there, but it’s 3 AM somewhere else with much limited number of players. Spoof your ping and location to be there and have fun sniping every player in the map. Sign up for new accounts on every play, who cares. Your fun as a cheater is to watch others lose their shit. You’re not building a character with history and reputation. You are heat sniping others while they are not realizing it. It may sound limited in scope and not worth the effort for you, but it’s millions of people out there tht ruin the game for everyone.
Almost every game I know of lets players “watch their kill cam”, and cheaters have adapted. The snipped people have a bias to vote the sniper was cheating, and the snipers have a bias to vote otherwise. Lean one way or the other, and it’s another post on /r/gaming of how your game sucks.
Unpopular opinion: cheaters don’t, griefers do.
“Cheater” is a pejorative for someone who sidesteps the rules and uses technology instead of, uh, pardon a potentially word choice, innate skills. They don’t inherently want to see others suffer as they stomp - it’s a matchmaking bug they’re put where they don’t belong. They just want to do things they cannot do on their own, but what are technically possible. A more positive term for that is a “hacker”.
Griefers are a different breed, they don’t just enjoy own success but get entertained by others’ suffering. Not a cheating issue TBH (cheats merely enable more opportunities), more like “don’t match us anymore, we don’t share the same ideas of fun” thing. “Black hat” is close enough term I guess.
YMMV, but if someone performs adequately for my skill levels (that is, they also don’t play well) then they don’t deprive me of any fun irrespective of how they’re playing.
Cheaters want to dominate other players, feel like they deserve to dominate other players and are perfectly happy for other players to suffer as long as they feel good.
Best I’ve ever seen was some online discussions about motives, but I never compiled any statistics out of random anecdotes (that must be biased and probably not representative).
They have inhuman skills usually paired with terrible game IQ and generally awful toxicity. They get boosted up to play with intelligent players purely because they can hold a button to outplay. It gets to the point where you have a player on your team who has no idea how to play but is mechanically good and it breaks the entire competitiveness of the game.
In a 5v5 shooter this ruins 9 people’s game along the way, times however many games this takes. Enough people do this and the game is ruined
> or let players watch their killams and tag their deaths
Players are notoriously bad at this stuff. Valve tried it with “overwatch” and it didn’t work at all.
Forgetting about anti cheat for a minute though, may hamming for different behaviours is a super interesting topic in itself. It’s very topical right now [0] and a fairly divisive topic. Most games with a ranked mode already do this - there’s a hidden MMR for unranked modes that is match made on, and players self select into “serious” or “non serious” queues. It works remarkably well - if you ever read people saying that Quick Play is unplayable it proves that the separate queues are doing a good job of keeping the two groups separate!
[0] https://www.pcgamer.com/games/third-person-shooter/arc-raide...
I agree that killcam tagging is not great for, like, actual “you are breaking the rules” type enforcement (because, yeah, players will generate a ton of false-positives). But if players had a list of traits and match-making tried to minimize some distance in the trait space (admitting it could’ve be perfect), it might result in more fun matches.
Valve did it for CS, and it was called overwatch, sorry. [0]
Yes, its prize pool is order of magnitude higher than either of Olympics sports or Chess.
That solution only works on servers hosted by players - I've never seen huge game companies that run their own servers (like GTA) have dedicated server admins. I guess they think they can just code cheaters out of their games, but they never can.
I have always wondered why more companies don't do trust based anti cheat management. Many cheats are obvious from anyone in the game, you see people jumping around like crazy, or a character will be able to shoot through walls, or something else that impossible for a non-cheater to do.
Each opponent in the game is getting the information from the cheating player's game that has it doing something impossible. I know it isn't as simple as having the game report another player automatically, because cheaters could report legitimate players... but what if each game reported cheaters, and then you wait for a pattern... if the same player is reported in every game, including against brand new players, then we would know the were a cheater.
Unless cheaters got to be a large percentage of the player population, they shouldn't be able to rig it.
Players in some games with custom servers run webs of trust (or rather distrust, shared banlists). They are typically abused to some degree and good players are banned across multiple servers by admins acting in bad faith or just straight up not caring. This rarely ends well.
I used to run popular servers for PvP sandbox games and big communities, and we used votebans/reports to evict good players from casual servers to anarchy ones, where they could compete, but a mod always had to approve the eviction using a pretty non-trivial process. This system was useless for catching cheaters, we got them in other ways. That's for PvP sandboxes - in e-sports grade games reports are useless for anything.
Out of curiosity I did a quick internet search and a couple of months ago a new wave of bots has emerged. Those bots also join as majority group but never fully join the game, they simply take up slots in a team, preventing others from joining. Makes you wonder why the server isn't timing them out.
I played COD4 a lot, though not competitively. I used to say that I had a bad day if I didn't get called a cheater once.
I didn't cheat, never have, but some people are just not aware of where the ceiling is.
The cheaters that annoyed us back then were laughably obvious. They'd just hold the button with a machine gun and get headshots after headshots, or something blatant like that.
True of everything. Getting good just lets you see the skill gaps. I've sunk a serious chunk of time into both pool and chess. In both I'd be willing to take a bet that I can beat the median player with my eyes closed (in pool, closing them after walking the table but before getting down on the shot).
And in both of those activities, there are still like 10-20 levels of "person at skill level A should always win against person at skill level B" between me and someone who is ACTUALLY good at pool or chess. Being charitable, in the grand scheme of things I might be an intermediate player.
For example, in NBA2k there are a lot of players running around who are like 12 feet tall. The client has to render that, and the client could have a “if another client tells us their player is more than 8 feet tall, it is a cheater”
I grew up with star trek and star wars wondering what a “I’ll transfer 20 units to you” meant. Bitcoin was an eye opener in the idea of “maybe this is possible” to me. But it shortly became true to me that it’s not the case. There is no way still for random agents to prove they are not malicious. It’s easier in a network within the confines of Bitcoin network. But maybe I’m not smart enough to come up with a more generalized concept. After all, I was one of the people who read the initial bitcoin white paper on HN and didn’t understand it back then and dismissed it.
And even that's the (relatively) straightforward part. The hard part is doing this without injuring the kernel enough that the only sensible solution for the security conscious is a separate PC for gaming.
Problem is that only works if the two OSes are different (Windows vs Linux) or else they can just stomp each other
It's kind of weird that we still don't have distributed computing infrastructure. Maybe that will be another thing where agents can run near the data their crunching on generic compute nodes.
> The general simplistic answer from those who never had to design such a game or a system of “do everything on the server” is laughably bad.
What “Netflix did” was having dead-simple static file serving appliance for ISPs to host with their Netflix auth on top. In their early days, Netflix had one of the simplest “auth” stories because they didn’t care.
It would add some latency but could be opt-in for those that care enough for all players in a match to take the hit.
You can't make a competitive fps game with a dumb terminal, it can't work because the latency is too high so that's why you have to run local predictive simulation.
You don't want to wait the server to ack your inputs.
There's an exception with fighting games. Fighting games generally don't have server simulations (or servers at all), but every single client does their own full simulation. And 2XKO and Dragon Ball FighterZ have kernel anti cheat.
Well I'm just nitpicking and it's different because it's one of the few competitive genres where the clients do full game state simulations. Another being RTS games.
It works fine for LAN but as soon as the connection is further than inside your house, it’s utterly horrible.
(Not being sarcastic.)
Sort of like nuclear weapons
https://www.forbes.com/sites/paultassi/2025/01/20/elon-musk-...
Okay, chill. I'm willing to believe that anti-cheat software is "sophisticated", but intercepting system calls doesn't make it so. There is plenty of software that operates at elevated privilege and runs transparently while other software is running, while intentionally being unsophisticated. It's called a kernel subsystem.
No amount of netcode can solve the fact that if I see you on my screen and you didn’t see me, it’s going to feel unfair.
Not everyone enjoys that, and that’s fine, but acting like it’s somehow unnatural or pointless feels way off.
> So very often with these hyper competitive games played between strangers competing for global ranking, the whole thing turns very toxic, with gamers often seeming to not even enjoy the moment to moment process, often raging at their incompetent team mates or raging at their opponents for supposedly cheating, or whathaveyou.
This is very true! I'll further grant that many competitive video games have pain points that fester this. Competition, facing failure, and recognizing that what they perceived to be a fair challenge wasn't so (e.g. cheating) does sometimes out the worst in people.
However, my point is that competition, and enjoying it, is something that's been fundamentally human for all our recorded history. The sensation of straining against the edge of your capabilities, to overcome a wall, and then succeeding even just barely is supreme. Competitive video games are just a subset of activities that appeal to this. And I think just as much as they are infuriating, they are also good!
Moreover, competitive video games can also be fairly social. Playing a chiller game with friends is one way to socialize, that I have nothing against. But there's also special bonds that are forged through shared struggle, even minor. For example, the fighting game community has a very strong local scene. If you can play fighting games, in most major cities in NA you can attend your local and make friends. With team competitive games, invite your homies.
Once again, I definitely do not dispute that competitive video games can be toxic. Especially in today's online culture. Taking fighting games as an example again, the online, anonymous, communities can be quite toxic. Ah, now that I've written this far, I'm realizing that maybe I've missed your point? Are you saying that it's specifically the strangers, that you never get to know and therefore trust, that makes this worse off?
I enjoy cycling with my friends, but I also enjoy cycling with others both with myself and with my friends.
The overwhelming majority of players are playing fair, its the 1% of people that ruin it for the majority.
Kernel anticheat does work. It takes 5 seconds to look at Valve's record of both VAC (client based, signature analysis) and VACNet (machine learning) to know the cheating problem with those technologies is far more prevalent than platforms that use kernel level anticheat (e.g. FACEIT, vanguard). Of course, KLAC is not infallible - this is known. Yes, cheats do (and will continue to) exist. However, it greatly raises the bar to entry. Kernel cheats that are undetected by FACEIT or vanguard are expensive, and often recurring subscriptions (some even going down to intervals as low as per day or week). Cheat developers will 99% of the time not release these publicly because it would be picked up and detected instantly where they could be making serious money selling privately. As mentioned in the article, with DMA devices you're looking at a minimum of a couple hundred dollars just for hardware, not including the cheat itself.
These are video games. No one is forcing you to play them. If you are morally opposed to KLAC, simply don't play the game. If you don't want KLAC, prepare to have your experience consistently and repeatedly ruined.
I was not aware that attackers could potentially manipulate attestation! How could that be done? That would seemingly defeat the point of remote attestation.
Defeating remote attestation will be a key capability in the future. We should be able to fully own our computers without others being able to discriminate against us for it.
There is guidance on "Active" attacks [1], which is to set up your TPM secrets so they additionally require a signature from a secret stored securely on the CPU. But that only addresses secret storage, and does nothing about the compromised measurements. I also don't know what would be capable of providing the CPU secret for x86 processors besides... an embedded/firmware TPM.
[1] https://trustedcomputinggroup.org/wp-content/uploads/TCG_-CP...
A more sophisticated attacker could plausibly extract key material from the TPM itself via sidechannels, and sign their own attestations.
But the main point there is that this setup is prohibitively expensive for most cheaters.
It is not "fake", a software TPM is real TPM but not accepted/approved by anticheat due to inability to prove its provenance
(Disclosure: I am not on the team that works on Vanguard, I do not make these decisions, I personally would like to play on my framework laptop)
Himata is correct, too. After DMA-based stuff, it'll be CPU debugging mode exploits like DCI-OOB, some of which can be made detectable in kernel mode; or, stealthier hypervisors.
In 2015, Apple briefly used this “hall monitor” technique for iOS 9 [0] but abandoned it when they learned that the whole approach is fundamentally flawed. Looks like anti-cheat developers reinvented this old trick even though it doesn’t work.
[0]: https://xerub.github.io/ios/kpp/2017/04/13/tick-tock.html
Using a diversity of algorithms developed by the community could make detection a lot more accurate and more difficult to evade.
https://www.vice.com/en/article/fs-labs-flight-simulator-pas...
Company decides to "catch pirates" as though it was police. Ships a browser stealer to consumers and exfiltrates data via unencrypted channels.
https://old.reddit.com/r/Asmongold/comments/1cibw9r/valorant...
https://www.unknowncheats.me/forum/anti-cheat-bypass/634974-...
Covertly screenshots your screen and sends the image to their servers.
https://www.theregister.com/2016/09/23/capcom_street_fighter...
https://twitter.com/TheWack0lian/status/779397840762245124
https://fuzzysecurity.com/tutorials/28.html
https://github.com/FuzzySecurity/Capcom-Rootkit
Yes, a literal privilege escalation as a service "anticheat" driver.
Trusting these companies is insane.
Every video game you install is untrusted proprietary software that assumes you are a potential cheater and criminal. They are pretty much guaranteed to act adversarially to you. Video games should be sandboxed and virtualized to the fullest possible extent so that they can access nothing on the real system and ideally not even be able to touch each other. We really don't need kernel level anticheat complaining about virtualization.
You do not need kernel access to make spyware that takes screenshots. You do not need a privileged service to read the user’s browser history.
You can do all of this, completely unprivileged on Windows. People always seem to conflate kernel access with privacy which is completely false. It would in fact be much harder to do any of these things from kernel mode.
There are far better ways to detect cheating, such as calculating statistics on performance and behaviour and simply binning players with those of similar competency. This way, if cheating gives god-like behaviour, you play with other godlike folks. No banning required. Detecting the thing cheating allows is much easier than detecting ways in which people gain that thing, it creates a single point of detection that is hard to avoid and can be done entierly server side, with multiple teirs how mucb server side calculation a given player consumes. Milling around in bronze levels? Why check? If you aren't performing so well that yoh can leave low ranks, perhaps we need cheats as a handicap, unless co sistently performing well out of distribution, at which point you catch smurfing as well.
point is focusing on detecting the thing people care about rather than one of the myriad of ways people may gain that unfair edge, is going to be easier and more robust while asking for less ergregious things of users.
It usually takes months, if not years for cheaters to get banned, but it takes a couple of dollars for a cheater to get a new account and start cheating again. Every time Valve fine tunes their models, they end up accidentally banning more innocent players in the process, so nobody has trust in that system anyways. There's too many datapoints to handle in competitive games, and there is no way to set a threshold that doesn't end up hurting innocent people in the process.
> There are far better ways to detect cheating, such as calculating statistics on performance
Ask any CS player how VAC’s statistical approach compares to Valorant’s Vanguard and you will stop asserting such foolishness
The problem with what you are saying is that cheaters are extremely determined and skilled, and so the cheating itself falls on a spectrum, as do the success of various anticheat approaches. There is absolutely no doubt that cheating still occurs with kernel level anticheats, so you’re right it didn’t “solve” the problem in the strictest sense. But as a skilled player in both games, only one of them is meaningfully playable while trusting your opponents aren’t cheating - it’s well over an order of magnitude in difference of frequency.
Anti-cheat is not used to "protect" bronze level games. FACEIT uses a kernel level anti cheat, and FACEIT is primarily used by the top 1% of CS2 players.
A lot of the "just do something else" crowd neglects to realize that anticheat is designed to protect the integrity of the game at the highest levels of play. If the methods you described were adequate, the best players wouldn't willingly install FACEIT - they would just stick with VAC which is user-level.
I doubt for other newer games the option would ever be worth it. Why host to servers and matchmaking pools for a tiny player base, who is will probably already be prone to complaining?
Simply put, the game companies want to own our machines and tell us what we can or can't do. That's offensive. The machine is ours and we make the rules.
I single out kernel level anticheats because they are trying to defeat the very mitigations we're putting in place to deal with the exact problems you mentioned. Can't isolate games inside a fancy VFIO setup if you have kernel anticheat taking issue with your hypervisor.
By this same logic: As far as I'm concerned, if the game developer only wants to allow players running anticheat to use their servers then they're just exercising their god given rights as the owner of the server.
My position is this is unfair discrimination that should be punished with the same rigor as literal racism. Video games are the least of our worries here. We have vital services like banks doing this. Should be illegal.
You can argue about the methods used for anticheat, but your comment here is trying to defend the right to cheat in online games with other people. Just no.
I rather suspect that the reason for this is the current gaming economy of unlockable cosmetics that you can either grind for, or pay for. If people can cheat in single player or PvE, they can unlock the cosmetics without paying. And so...
Spending hours setting up conditions for the rare spawn to appear, and then before you can get to it having someone using a tracking cheat and a speed cheat get to it first is very annoying.
Don't play with untrusted randoms. Play with people you know and trust. That's the true solution.
Kernel level AC is a compromise for sure and it's the gamers job to assess if the game is worth the privacy risk but I'd say it's much more their right to take that risk than the cheaters right to ruin 9 other people's time for their own selfish amusement
You may think it's your "god-given right" to cheat in multiplayer games, but the overwhelming majority of rational people simply aren't going to play a game where every lobby is ruined by cheaters.
The computers are supposed to be ours. What we say, goes. Cheating may not be moral but attempts to rob us of the power that enables cheating are even less so.
Remote attestation is the ultimate surrender. It's not really your machine anymore. You don't have the keys to the machine. Even if you did, nobody would trust attestations made by those keys anyway. They would only trust Google's keys, Apple's keys. You? You need not apply.
Anti cheat don't run on modern console, game dev knoes that the latest firmware on a console is secure enough so that the console can't be tempered.
This is the exact sort of nonsense situation I want to prevent. We should own the computers, and the corporations should be forced to simply suck it up and deal with it. Cheating? It doesn't matter. Literal non-issue compared to the loss of our power and freedom.
It's just sad watching people sacrifice it all for video games. We were the owners of the machine but we gave it all up to play games. This is just hilarious, in a sad way.
It's a bigger problem because in a lobby of 100 people, 1 person cheating ruins it for 99 players. Whereas in a 20 person lobby you can just boot that one person and it only ruins the game for 19 others.
Play games which are beyond that: dota2, cs2 for instance.
On linux, there is a new syscall which allows a process to mmap into itself the pages of another process (I guess ~same effective UID and GID). That is more than enough to give hell to cheats...
But any of that can work only with a permanent and hard working "security" team. If some game devs do not want to do that, they should keep their game offline.
The harder thing probably is getting a dataset for “all x64/ARM64 Windows drivers that aren’t already considered vulnerable”.
Also it depends what’s considered a vulnerability here.
Now industry propaganda has gamers installing them voluntarily.
Question being: Why aren't they all blacklisted? Why does Microsoft allow known malware to run?
How about this: Instead of third-party companies installing their custom code to fuck with my operating system,
How about just having the OS offer an API that a game can request to reboot the OS into "console mode": A single-user, single-application mode that just runs that game only.
Similar to how consoles work.
That mode could be reserved for competitive ranked multiplayer only.
The article doesn’t go too in depth on the actually interesting things modern anticheats do.
In addition:
- you can’t really expect .text section of game/any modules except maybe your own to be 100% matching one on disk, because overlays will hook stuff like render crap (fun fact for you: Steam will also aggressively hook various WinAPI stuff presumably for VAC, at least on CS2)
This seems much more doable today than in the past as machines boot in moments. Switching from secure "xbox mode" to free form PC mode, would be barely a bump.
Now, I see one major difference, heterogenous vs homogenous hardware (and the associated drivers that come with that). In the xbox world, one is dealing with a very specific hardware platform and a single set of drivers. In the PC world (even in a trusted secure boot path), one is dealing with lots of different hardware and drivers that can all have their exploits. If users are more easily able to modify their PCs and set of drivers one, I'd imagine serious cheaters would gravitate to combinations they know they can exploit to break the secure/trusted boot boundary.
I wonder if there are other problems.
Well it's definitely not game developer written kernel anti-cheat on consoles.
They also have VM checks. I "accidentally" logged into MGM from a virtual machine. They put my account on hold and requested I write a "liability statement" stating I would delete all "location altering software" and not use it again. (Really!)
looking at cards is a way easier problem than rendering a 3d world with other players bouncing around. I imagine you could just send the card player basially a screenshot of what you want them to see and give them no other data to work with and that would mostly solve cheating.
But gambling can be way more complicated than just looking at cards so maybe there's a lot more to it.