AI
The cheat ecosystem and commercial market
Game cheats are a commercial industry. Over six months the researchers monitored cheat-selling websites: subscription prices up to $200 a month, user reviews, credit card payments, and in some cases tax records with the names of company owners. Cheats are legal in most countries, and the money is good enough that vendors skip the malware side business entirely.
The attack-defense cycle runs faster than anything in enterprise security. The Valorant cheat uptime red/green chart (06:27) shows cheats countered within days, then rebuilt — a faster cycle than any malware/AV pair.
What it takes to investigate software that resists analysis
Anti-cheat software is designed to resist analysis. Reverse engineering required attaching to a hypervisor to debug from outside the system. When the researchers pushed too far, anti-cheats crashed the machine, then falsified the crash dump. Attaching a debugger to Warden triggered a message in the symbols:
“Hello, it’s Wangard. Who this?” — Marius Muench
Fake symbol files link to a photo of the development team. The system also banned researcher accounts and tied those bans to hardware IDs, forcing the team to desolder motherboard chips and modify DIMM slots just to keep the machines analyzable.
How anti-cheats block bring-your-own-vulnerable-driver attacks
Windows requires all kernel code to be signed, but BYOVD sidesteps that: exploit a legitimate buggy driver and your unsigned code runs in the kernel. Cheat developers used this. So did BlackByte, Scattered Spider, and APT41 around 2022.
Anti-cheats were already ahead. The Gigabyte gdrv.sys driver got a public CVE in December 2018. Eight days later, cheat forums were discussing the exploit. BattlEye blocked the driver in May 2019. Sophos’s EDR took until late 2019. As Marius Muench noted:
“anticheets move way faster than mailware”
Vanguard’s kernel defense: NX traps and PatchGuard silencing
Load-time blocking and memory scanning share a blind spot: zero-days and DMA-mapped code slip through either way.
Vanguard uses two inline hooks. The first patches the Windows page fault handler. At boot, Vanguard marks non-paged pool regions as no-execute — only one or two pages per system, so the write is instant. Any execution there faults into Vanguard’s custom handler. The second hook silences PatchGuard, which would otherwise kill the process for touching the fault handler. Vanguard injects a return-early call into the software interrupt handler, queues wait times of 0xFFFFFFFF on running PatchGuard threads, and corrupts their deferred procedure call structures. PatchGuard stalls; the trap holds.
Software diversification and rogue hardware detection
Rainbow Six Siege ships multiple distinct build pools, each with different offsets, encryption keys, and obfuscation. That means one cheat per pool, minimum. A cheat targeting one pool breaks on another, and dynamically scanning for offsets at runtime still drives up cost per update cycle.
DMA cards read game memory from a second machine over PCI, bypassing the kernel and every defense layered on it. Anti-cheats scan all connected hardware, check register behavior, and send test traffic. A card claiming to be a network adapter that ignores a test packet gets disabled by the kernel.
Memory hiding, empirical impact, and the hypervisor frontier
Vanguard hides sensitive values by cloning the process address space. When a context switch targets an allowed Valorant thread, it rewrites CR3 to a secret second space. The normal space holds status fields. The secret space holds enemy locations. Anything attaching through normal APIs sees nothing.
The market data confirms. Valorant, with the most protections, saw cheat uptime around 50%. Counter-Strike, with the fewest, was close to 100%. Stronger anti-cheat correlates with an order-of-magnitude price increase. Cheats from “ring minus one” vendors specify Intel-only CPUs, signaling dependence on hypervisor features. Anti-cheat developers are discussing VBS integration. The hypervisor is next.
Notable Quotes
Hello, it’s Wangard. Who this? Marius Muench · ▶ 10:54
anticheets move way faster than mailware Marius Muench · ▶ 17:13
when a user is playing Fortnite or Valerant. Marius Muench · ▶ 39:48
Key Takeaways
- Anti-cheat systems blocked BYOVD drivers years before enterprise EDR vendors — study them to accelerate your own detection timelines.
- Software diversification with per-player build pools raises attacker cost without changing game logic; apply it to any high-value binary.
- Kernel-level memory hiding via CR3 remapping and NX traps are production-deployed defenses worth porting beyond gaming.