Live data from Hacker News

/dev/null: Anti-Cheat Kernel Driver (2020)

leagueoflegends.com

131–140 of 142 posts

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#131
post #85

Riot's anti cheat is the only one I've found that causes my KVM virtual machine running Windows to BSoD. Ironic that the post title indicates Linux-awareness but the post content breaks any chance of playing Riot's games on a Linux computer.

Riot Vanguard outright states that virtual machines are not supported (for valid reasons; how do you ensure the guest OS memory isn’t just tampered with by cheats outside?). It doesn’t surprise me that it doesn’t work.

Yes, I know Riot has stated that VMs aren't supported.

I'm no expert on anti-cheat but other popular games (e.g. Apex Legends) run without BSoD and as far as I can see don't have serious issues with cheating.

I don't think this is an issue of technical necessity so much as an issue of there being very few Linux gamers and even fewer using something like VFIO to run games rather than dual-booting.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#132
post #72

Earlier quoted context omitted.

> yet many games still persist with these unacceptably hacky half measures. Unfortunately what you're suggesting is a hacky half measure. From a servers perspective there is no difference between a client with a shitty connection and a client who is pretending they have a shitty connection to cheat. The reality is that servers trust clients for some cases (and verifies that those things are possible) because it provi…

> From a servers perspective there is no difference between a client with a shitty connection and a client who is pretending they have a shitty connection to cheat. The reality is that servers trust clients for some cases (and verifies that those things are possible) because it provides a better experience for a large number of players. Lag switching is only one kind of cheat that applies mainly to multiplayer FPS ga…

Every now and again I read things on HN about the area that I work in that reminds me that HN despite being confident doesn't always know what it's talking about. If it's so easy, can you share a prototype of someone doing it? Surely, if you can solve the entire problem of anticheat in one HN post there must be some proof to back it up.

> Lag switching is only one kind of cheat that applies mainly to multiplayer FPS games, and as I said, it can be mitigated through statistical analysis

These methods are already in use with client side cheat detection. The thing about latency spikes is that there are many things that cause them. To use your example of checking when spikes appear near a kill in an FPs, presumably a kill is associated with a spike in traffic (multiple users shooting, extra movement, etc). So it's far more likely that you see spikes at the point of extra network traffic. Lag spikes wee also only one example.

> With server side heuristics, you are in a better position to understand how it works and document it so that others on your team understand it as well

You have control over all of these things with client side heuristics and cheat detection too don't forget.

> Running the game in a virtual machine? Banned. Running the client in WINE on Linux? Banned. Driver signature enforcement disabled? Flagged. User running AutoHotKey or WinDbg or Ghidra? Flagged. New Windows update that breaks some internal NT kernel ABI that my anti-cheat rootkit was relying on?

Firstly, the NT interface is probably the most stable of any software im aware of. I don't personally keep up with kernel breakages but my understanding of them is they're incredibly incredibly rare. They're also very well documented and published on a mostly expected cadence. If an anticheat isn't being kept up to date, it's ineffective, whether or not that's in relation to it's heuristics or its support for OS features. Secondly, there's a reason all of those things are suspicious. (And as an aside many games don't actually ban you for running them, they pop up and tell you to turn them off before killing the game . They _do_ ban if you bypass that check though).

> causing issues for legitimate players whose setup might deviate slightly from the norm.

Having ghidra or windgb running, or running via wine isn't "slightly" out of the norm, it's a statistical anomaly that would be flagged as "massive outlier" if heuristics were applied. Also, why is it ok for players whose software setup deviates from the norm, but not ok for players with outlying network setups?

> You can make it more difficult by issuing ban waves at fixed intervals, and slightly varying the thresholds by some small random amount each time.

So exactly the same methods in use right now?

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#133
It's infuriating that developers still espouse this secure client method.

It doesn't work.

You just chase the cheats higher and higher up the stack and once they're in the hardware, you're boned. And they're already in the hardware. Between direct memory access and actually external AI devices, people can cheat.

So either audit client actions to make sure they only do what they can do (via peers and server) or do the rendering server-side to stop information leaks. Anything else is dishonest and a waste of everyone's time and safety.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#134
post #85

Riot's anti cheat is the only one I've found that causes my KVM virtual machine running Windows to BSoD. Ironic that the post title indicates Linux-awareness but the post content breaks any chance of playing Riot's games on a Linux computer.

Riot Vanguard outright states that virtual machines are not supported (for valid reasons; how do you ensure the guest OS memory isn’t just tampered with by cheats outside?). It doesn’t surprise me that it doesn’t work.

Does this mean you have to disable Hyper-V to run LoL?

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#135

Earlier quoted context omitted.

So? You’re still using their server. They can choose to require you to follow certain rules to do so.

They can choose the server rules but I choose what code runs on my computer.

My point is that they can stipulate to run their code on your computer if you wish to connect to their server — which is the current situation. If you uninstall/disable anticheats, the server declines your connection.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#136

Earlier quoted context omitted.

Riot Vanguard outright states that virtual machines are not supported (for valid reasons; how do you ensure the guest OS memory isn’t just tampered with by cheats outside?). It doesn’t surprise me that it doesn’t work.

Does this mean you have to disable Hyper-V to run LoL?

No, League doesn’t use Vanguard to begin with, and Hyper-V is excepted because your OS is the root VM, i.e. another VM can’t manage it. Just LSASS and such, and they’re trusted.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#137
post #131

Earlier quoted context omitted.

Riot Vanguard outright states that virtual machines are not supported (for valid reasons; how do you ensure the guest OS memory isn’t just tampered with by cheats outside?). It doesn’t surprise me that it doesn’t work.

Yes, I know Riot has stated that VMs aren't supported. I'm no expert on anti-cheat but other popular games (e.g. Apex Legends) run without BSoD and as far as I can see don't have serious issues with cheating. I don't think this is an issue of technical necessity so much as an issue of there being very few Linux gamers and even fewer using something like VFIO to run games rather than dual-booting.

Apex Legends has its own troubles of cheating but it’s less seen because it’s a battle royale game, you spectate them “once” compared to playing 20-so rounds against a cheater.

And IIRC Vanguard is purposefully strict.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#138

Earlier quoted context omitted.

They can choose the server rules but I choose what code runs on my computer.

My point is that they can stipulate to run their code on your computer if you wish to connect to their server — which is the current situation. If you uninstall/disable anticheats, the server declines your connection.

That's what I meant in my first post that we need to get rid of. There is too much of this behavior that companies try to get into people's computers and control what they can do with their own computer.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#139

Earlier quoted context omitted.

My point is that they can stipulate to run their code on your computer if you wish to connect to their server — which is the current situation. If you uninstall/disable anticheats, the server declines your connection.

That's what I meant in my first post that we need to get rid of. There is too much of this behavior that companies try to get into people's computers and control what they can do with their own computer.

But, again, why can’t they stipulate requirements for using their services? If you don’t want to run their anti cheat then you can’t play on their servers, simple.

It bothers you and (relatively) few others that they need to run a kernel driver to prevent cheats, but it bothers countless players when a game is plagued with cheaters, and yes, there’s some prevention done by anti-cheats. Call of Duty: Warzone has/had a notorious cheating problem and absolutely no anti-cheat system.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#140

Earlier quoted context omitted.

That's what I meant in my first post that we need to get rid of. There is too much of this behavior that companies try to get into people's computers and control what they can do with their own computer.

But, again, why can’t they stipulate requirements for using their services? If you don’t want to run their anti cheat then you can’t play on their servers, simple. It bothers you and (relatively) few others that they need to run a kernel driver to prevent cheats, but it bothers countless players when a game is plagued with cheaters, and yes, there’s some prevention done by anti-cheats. Call of Duty: Warzone has/had a…

> why can’t they stipulate requirements for using their services?

They can and they do, but there is too much of this behavior that companies require too much access and control of people's computers. My computer is my private thing. It's like my home. No company requires to come home to me when I want to do something; they send mail. I want more things to work like the web: everyone has 100% control of their computer and web browser and they can connect to web servers and those web servers can have whatever rules they want but they don't try to get into people's computers.

Post reply on HN